Information Security and Risk Management

Cet article decrit, du point de vue d'un clinicien generaliste, une solution pour l'implementation de dossiers concernant les patients en toute securite, ainsi que les strategies mises en place pour cette implementation. Cet article souligne donc l'importance de la securite pour la confidentialite de ces dossiers, mais aussi la difficulte de mettre en place un systeme de protection de l'information sur

Click to increase image sizeClick to decrease image size Notes 1. "As a result of increasing interconnectivity, information systems and networks are now exposed to a growing number and a wider variety of threats and vulnerabilities. This raises new issues for security." OECD Guidelines for the Security of Information Systems and Networks, July 25, 2002, at p. 7, available at www.oecd.org/dataoecd/16/22/15582260.pdf. 2. Although not the subject of this article, it is important to note that countries are also enacting cybercrime legislation to make clear that certain online activities are illegal and to assist law enforcement in efforts to prosecute cyber criminals. To that end, the Privacy and Computer Crime Committee of the American Bar Association Section of Science & Technology Law has recently undertaken a project to develop a Model Cybercrime Law for the UN International Telecommunication Union's (ITU) Cybersecurity Work Programme to Assist Developing Countries. See also the International Guide to Combating Cybercrime published by this Committee, available at http://www.abanet.org/dch/committee.cfm?com=ST202003. 3. See the Appendix for a compilation of some of the key laws and regulations governing information security. 4. See, e.g., EU Data Protection Directive and HIPAA, cited in the Appendix. 5. See, e.g., E-SIGN, UETA, and UN Convention cited in the Appendix. 6. See, e.g., Kimberly Kiefer and Randy V. Sabett, Openness of Internet Creates Potential for Corporate Information Security Liability, BNA Privacy & Security Law Report, Vol. 1, No. 25 at 788 (June 24, 2002); Alan Charles Raul, Frank R. Volpe, and Gabriel S. Meyer, Liability for Computer Glitches and Online Security Lapses, BNA Electronic Commerce Law Report, Vol. 6, No. 31 at 849 (August 8, 2001); Erin Kenneally, The Byte Stops Here: Duty and Liability for Negligent Internet Security, Computer Security Journal, Vol. XVI, No. 2, 2000. 7. See, e.g., Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007); Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006); and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005) (all affirming a negligence cause of action). See also, In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007) (rejecting a negligence claim due to the economic loss doctrine, but allowing a negligent misrepresentation claim to proceed). 8. See, e.g., American Express v. Vinhnee, 2005 Bankr. Lexis 2602 (9th Cir. Bk. App. Panel, 2005); Lorraine v. Markel, 2007 U.S. Dist. Lexis 33020 (D. MD. May 4, 2007). 9. Available at www.pcisecuritystandards.org. 10. Available at www.cabforum.org. 11. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC 27001"), available for purchase at http://www.standards-online.net/InformationSecurityStandard.htm. 12. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 13. See statutes listed in the Appendix. 14. See statutes listed in the Appendix. 15. Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), 42 U.S.C. 1320d-2 and 1320d-4, (providing that "each person … who maintains or transmits health information shall maintain reasonable and appropriate administrative, technical, and physical safeguards: (A) to ensure the integrity and confidentiality of the information; (B) to protect against any reasonably anticipated: (i) threats or hazards to the security or integrity of the information; and (ii) unauthorized uses or disclosures of the information; and (C) otherwise to ensure compliance with this part by the officers and employees of such person," at 42 U.S.C. 1320d-2(d)(2). 16. Gramm-Leach-Bliley Financial Services Modernization Act ("GLB"), Pub. L. No. 106-102, 113 Stat. 1338 (November 12, 1999), at §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, providing that "[E]ach financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information." 17. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC). 18. Final HIPAA Security Regulations, 45 C.F.R. Part 164. 19. There have also been efforts in the United States to pursue comprehensive federal privacy similar to the approach taken by many other countries. See e.g., Microsoft position paper at www.microsoft.com/presspass/download/features/2005/PrivacyLegislationCallWP.doc. Although it remains to be seen whether that approach will ultimately be adopted, it is clear that the combination of U.S. state and federal law has, in effect, imposed a comprehensive obligation of security with respect to all personal information held by all companies. 20. See, e.g., FTC enforcement actions regarding In the Matter of Sunbelt Lending Services, Inc.; In the Matter of Petco Animal Supplies, Inc.; In the Matter of MTS, Inc., d/b/a Tower records/Books/Video; In the matter of Guess?, Inc.; FTC V. Microsoft; and In the Matter of Eli Lilly and Company cited in the Appendix. 21. See, e.g., FTC enforcement actions regarding In the Matter of CardSystems Solutions, Inc.; United States v. ChoicePoint, Inc.; In the Matter of DSW Inc.; and In the Matter of BJ's Wholesale Club, Inc. cited in the Appendix. 22. See list in the Appendix. 23. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). 24. 205 Mich. App. Lexis 353 at ∗16 (Mich. App. 2005). 25. 2006 U.S. Dist. Lexis 4846 at ∗9 (D. Minn. 2006). 26. Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). 27. In Re TJX Companies Retail Security Breach Litigation, 2007 U.S. Dist. Lexis 77236 (D. Mass. October 12, 2007), at pp. 28–29. 28. Ibid. 29. The Homeland Security Act of 2002 defines the term "information system" to mean "any equipment or interconnected system or subsystems of equipment that is used in the automatic acquisition, storage, manipulation, management, movement, control, display, switching, interchange, transmission, or reception of data or information, and includes—(A) computers and computer networks; (B) ancillary equipment; (C) software, firmware, and related procedures; (D) services, including support services; and (E) related resources." Homeland Security Act of 2002, Pub. L. 107-296, at Section 1001(b), amending 44 U.S.C. § 3532(b)(4). 30. See, e.g., Australia, Information Privacy Principles under the Privacy Act 1988, Principle No. 4, available at www.privacy.gov.au/publications/ipps.html; AICPA and the Canadian Institute of Chartered Accountants (CICA), Generally Accepted Privacy principles, Principle No. 8, available at http://infotech.aicpa.org/Resources/Privacy/Generally+Accepted+Privacy+Principles; APEC, Privacy principles, Principle No. 7, available at http://austlii.edu.au/∼graham/APEC/APECv10.doc; US-EU Safe Harbor Privacy Principles, available at www.export.gov/safeharbor/SHPRINCIPLESFINAL.htm; Direct Marketing Association, Online Marketing Guidelines, available at www.the-dma.org/guidelines/onlineguidelines.shtml. 31. Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter "EU Data Protection Directive"). 32. EU Data Protection Directive, Preamble at Para. 46. 33. EU Data Protection Directive, Article 17(1). 34. See statutes listed in the Appendix. 35. See statutes listed in the Appendix. 36. See generally, Bruce H. Nearon, Jon Stanley, Steven W. Teppler, and Joseph Burton, Life after Sarbanes-Oxley: The Merger of Information Security and Accountability, Jurimetrics Journal, Vol. 45, 379–412 (2005). 37. American Express v. Vinhnee, 336 B.R. 437; 2005 Bankr. Lexis 2602 (9th Cir. December 16, 2006). 38. Ibid., at p. 444. 39. Ibid., at p. 445. 40. Ibid., at pp. 446–447. 41. Ibid., at p. 449. 42. See, e.g., National Association of Corporate Directors, Information Security Oversight (2007). 43. Sarbanes-Oxley Act, Section 302. 44. See, e.g., GLB Security Regulations (Federal Reserve) 12 C.F.R. 208, Appendix D-2.III(A). 45. HIPAA Security Regulations, 45 C.F.R. Section 164.308(a)(2). 46. See, FTC Decisions and Consent Decrees listed in the Appendix, including Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. 27(a), p. 7; Eli Lilly Decision at II.A. 47. FISMA, 44 U.S.C. 3544(a). 48. E. Michael Power and Roland L. Trope, Sailing in Dangerous Waters: A Director's Guide to Data Governanc e , American Bar Association (2005), p. 13; Roland L. Trope, "Directors' Digital Fiduciary Duties," IEEE Security & Privacy, January/February 2005 at p. 78. 49. Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). 50. Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005), at pp. 11–13 (noting that harm was foreseeable, but Board took no action). 51. Securing Cyberspace: Business Roundtable's Framework for the Future, Business Roundtable, May 19, 2004 at pp. 1, 2; available at www.businessroundtable.org/pdf//20040518000CyberSecurityPrinciples.pdf. The Business Roundtable is an association of chief executive officers of leading U.S. corporations with a combined workforce of more than 10 million employees in the United States. See www.businessroundtable.org. 52. Information Security Governance: A Call to Action, Corporate Governance Task Force Report, National Cyber Security Partnership, April 2004, pp. 12–13, available at www.cyberpartnership.org/InfoSecGov4_04.pdf. The National Cyber Security Partnership (NCSP) is led by the Business Software Alliance (BSA), the Information Technology Association of America (ITAA), TechNet, and the U.S. Chamber of Commerce in voluntary partnership with academicians, CEOs, federal government agencies, and industry experts. Following the release of the 2003 White House National Strategy to Secure Cyberspace and the National Cyber Security Summit, this public–private partnership was established to develop shared strategies and programs to better secure and enhance America's critical information infrastructure. Further information is available at www.cyberpartnership.org. 53. GLB Security Regulations (OCC), 12 C.F.R. Part 30, Appendix B, Part III.A and Part III.F. 54. See, e.g., Homeland Security Act of 2002 (Federal Information Security Management Act of 2002) 44 U.S.C. Section 3542(b)(1); GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part II.B; HIPAA Security Regulations, 45 C.F.R. Section 164.306(a)(1); Microsoft Consent Decree at II, p. 4. 55. See, e.g., 44 USC 3532(b)(1), emphasis added. See also FISMA, 44 U.S.C. Section 3542(b)(1). Most of the foreign privacy laws also focus their security requirements from this perspective. This includes, for example, the EU Privacy Directive, Finland's Privacy Law, Italy's Privacy Law, and the UK Privacy Law. Also in this category is the Canadian Privacy Law. 56. Although they often focus on categories of security measures to address. See, e.g., HIPAA Security Regulations, 45 C.F.R. Part 164. 57. See, e.g., FDA regulations at 21 C.F.R. Part 11 (procedures and controls); SEC regulations at 17 C.F.R. 257.1(e)(3) (procedures); SEC regulations at 17 C.F.R. 240.17a-4 (controls); GLB regulations (FTC) 16 C.F.R. Part 314 (safeguards); Canada, Personal Information Protection and Electronic Documents Act, Schedule I, Section 4.7 (safeguards); EU Data Privacy Directive, Article 17(1) (measures) available at http://europa.eu.int/comm/internal_market/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf. 58. See, e.g., HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; COPPA, 15 U.S.C. 6502(b)(1)(D), and COPPA regulations 16 C.F.R. 312.8; IRS Rev. Proc. 97-22, sec. 4.01(2); SEC regulations 17 C.F.R. 257. See also UCC Article 4A, Section 202 ("commercially reasonable" security procedure), and Microsoft Consent Decree. 59. "Appropriate" security required by: HIPAA 42 U.S.C. 1302d-2, and HIPAA Security regulations, 45 CFR 164.306; EU Data Protection Directive, Article 17(1). 60. EU Data Protection Directive, Article 17(1) (emphasis added) 61. See, e.g., Belgium—Belgian Law of 8 December 1992 on Privacy Protection in relation to the Processing of Personal Data, as modified by the law of 11 December 1998 Implementing Directive 95/46/EC, and the law of 26 February 2003, Chapter IV, Article 16(4); Denmark—Act on Processing of Personal Data,; Act No. 429 of 31 May 2000 (unofficial English translation), Title IV, Part 11, Section 41(3); Estonia—Personal Data Protection Act; Passed February12, 2003 (RT1 I 2003, 26, 158), entered into force October 1, 2003, Chapter 3, Sections 19(2); Greece—Law 2472/1997 on the Protection of Individuals with regard to the Processing of Personal Data (as amended by Laws 2819/2000 and 2915/2001); Article 10(3); Ireland—Data Protection (Amendment) Act 2003; Section 2.-(1)(d) and First Schedule Article 7; Lithuania—Law on Legal Protection of Personal Data, January 21, 2003, No. IX-1296, Official translation, with amendments April 13, 2004, Article 24(1); Netherlands—25 892—Rules for the protection of personal data (Personal Data Protection Act) (Unofficial translation); Article 13; Portugal—Act on the Protection of Personal Data (transposing into the Portuguese legal system Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data), Article 14(1); Slovakia—Act No 428 of July 3, 2002 on personal data protection; Section 15(1); Sweden—Personal Data Act (1998:204); issued April 29, 1998, Section 31; and UK—Data Protection Act 1998, Schedule 1, Part I, Seventh Principle. 62. See, e.g., Finland—The Finnish Personal Data Act (523/1999), given on 22.4.1999, Section 32(1); Germany—Federal Data Protection Act as of January 1, 2003, Section 9; Hungary—Act LXIII of 1992 on the Protection of Personal Data and Public Access to Data of Public Interest, Article 10(1); Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, Sections 31 and 33; Spain—Organic Law 15/1999 of December 13 on the Protection of Personal Data, Article 9. 63. 5 USC Sec. 552a. 64. 5 U.S.C. § 552a (d)(10) (emphasis added). 65. 42 U.S.C. 1320d-2(d)(2). 66. See, Gramm-Leach-Bliley Act ("GLB"), Public Law 106-102, §§ 501 and 505(b), 15 U.S.C. §§ 6801, 6805, and implementing regulations at 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift Supervision) and 16 C.F.R. Part 314 (FTC) (emphasis added). 67. Cal. Civil Code § 1798.81.5(b). 68. See UN Convention at Article 9(3), 9(4), and 9(5). 69. ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005). See text at footnotes 157–169, infra. February 1, 12 C.F.R. Part 30, Appendix B (OCC), 12 C.F.R. Part 208, Appendix D (Federal Reserve System), 12 C.F.R. Part 364, Appendix B (FDIC), 12 C.F.R. Part 568 (Office of Thrift May 16 C.F.R. Part 44 U.S.C. Section 45 C.F.R. 164. See of the on by of the Technology and Homeland Security of the Committee on the United States 21, 2007 at p. (noting that FTC under the GLB Act as a for the obligation to maintain reasonable and appropriate available at See also, of the the on Information and the Committee on U.S. House of on April 21, 2004, at p. 5 (noting that is an of reasonable and appropriate measures in of the available at See, e.g., FTC Decisions and Consent Decrees listed in the Appendix. See, e.g., National Association of Insurance for Information Model available at in at See, e.g., Consent Decrees listed in the Appendix. 78. See, e.g., Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006) and Bell v. Michigan Council, 2005 Mich. App. 353 (Mich. App. February 15, 2005). Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 (D. Minn. February 7, 2006). Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). Committee on available at See, e.g., Italy—Personal Data Protection Code, Legislative Decree No. 196 of 30 June 2003, B, § Act No 428 of July 2002 on personal data § the Appendix, Act, B, Section Act, Section the Appendix, Act, Article Act, Section Act, 16(4); Act, Section 41(3); Act, Section Act, Section 32(1); Act, Section 9; Act, Article 10(3); Act, Article 10(1); Act, Article 24(1); Act, Article 13; Act, Article 14(1); Act, Section 15(1); Act, Article 9; Act, Section 31; UK Act, Schedule 1, Part I, Seventh Act, Article 7. the Appendix, Act, Schedule 2, Section Act, Act, Schedule 1, 4.7 Principle 7, Act, Section Act, Section Act, B, Sections and Act, Sections 17 and the Appendix, Act, Section A Security § Act, Section Decree the Appendix, Decree the Appendix, Act, Section Principle 4; Act, Article Act, Article Act, Sections and Act, Section Act, Section Act, Section Act, B, Sections and Act, Sections 17 and Bruce & Digital Security in a & at p. See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. p. Eli Lilly Decision at II.B; GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at See, e.g., FISMA, 44 U.S.C. Sections and GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part See, e.g., In Electronic July 30, Financial Council, 2; available at See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations (OCC), 12 C.F.R. Part 30 Appendix B, Part Eli Lilly Decision at II.B; HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Information Security Management Act of 2002 44 U.S.C. Section See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Information Security Management Act of 2002 44 U.S.C. Section See, e.g., Microsoft Consent Decree at II, p. 4; GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section See, e.g., HIPAA Security Regulations, 45 C.F.R. Section See, e.g., United States v. Cir. See, e.g., Inc. v. also v. or of to with and of See, e.g., HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part and Part FISMA, 44 U.S.C. Sections and Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of HIPAA Security Regulations, 45 CFR Section and and on HIPAA Security of & Section of Science & Technology Law, No. April 2003, at p. 2, available at See, e.g., HIPAA regulations 45 C.F.R. Sections and GLB Regulations, 12 C.F.R. 208, Appendix and 12 C.F.R. Part 30, Appendix B, Part Microsoft Consent at p. 4. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Sections and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. p. 5 and Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. 25, p. HIPAA Security Regulations, 45 C.F.R. Sections and Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. Ziff Davis Assurance of Discontinuance, Para. 25, p. 6. HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, and 26, pp. HIPAA Security Regulations, 45 C.F.R. Section GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., FISMA, 44 U.S.C. Section HIPAA Security Regulations, 45 C.F.R. Section Ziff Davis Assurance of Discontinuance, Para. p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4. FISMA, 44 U.S.C. Section Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Ziff Davis Assurance of Discontinuance, Para. and p. 7; Eli Lilly Decision at GLB Security Regulations, 12 C.F.R. Part 30, Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section Microsoft Consent Decree at II, p. 4; Eli Lilly Decision at Microsoft Consent Decree at p. 5. Ziff Davis Assurance of Discontinuance, Para. p. 7. See, e.g., of the of the of National on 21, at See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part See, e.g., GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part HIPAA Security Regulations, 45 C.F.R. Section and GLB Security Regulations, 12 C.F.R. Part 30 Appendix B, Part Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). See Bell v. Michigan Council, 2005 Mich. App. Lexis 353 (Mich. App. February 15, 2005). See Guin v. Brazos Higher Education Service, Civ. No. 05-668, 2006 U.S. Dist. Lexis 4846 at (D. Minn. February 7, 2006) that a was the to and a of a was not a of a of reasonable The Financial is a of U.S. federal agencies, that the Board of of the Reserve Insurance the National the of the of the and the of Thrift on on in an Internet 8, 2006 at p. available at on on in an Internet 8, 2006 at p. available at Guide for the Guidelines Information Security December available at Information Security July available at See National Institute of and Management Guide for Information Technology No. available at ISO/IEC 27001, Information Technology—Security Techniques—Information Security Management Systems—Requirements (October 2005) (hereinafter "ISO/IEC ISO/IEC § for is the and of International and is of a of the of with and a in that the The American National Institute the United States. See, The also in and in related to including The of make its with the United States. See ISO/IEC 27001, § (emphasis added). ISO/IEC 27001, § ISO/IEC 27001, § ISO/IEC 27001, § 164. ISO/IEC 27001, § ISO/IEC 27001, §§ and 6. ISO/IEC 27001, §§ and 8. ISO/IEC 27001, §§ ISO/IEC that with an International not in from legal p. 1. EU Data Protection Directive, Article 8. Article Data Protection on the processing of personal data to health in health February 15, at pp. available at (emphasis in See list of state laws in Report, Security and Laws of 15, 2005 at Appendix available at Code, § Rev. Stat. Available at www.pcisecuritystandards.org. See list in the Appendix. See, e.g., 16 CFR Section Health Insurance Portability and Accountability Act Security Regulations, 45 C.F.R. § HIPAA security regulations to in the Act Security Regulations, 12 C.F.R. Part 30 Appendix B, Part security regulations to information in the financial Homeland Security Act of 2002 § 1001(b), amending 44 U.S.C. § and § amending 44 U.S.C. § information and information systems from unauthorized and regulations, 21 C.F.R. Part 11. See, e.g., Cal. Civil Code § 1798.81.5(b). See April 2, the Matter of of the Act of of Information and Information Services, No. No. April 2, at available at (hereinafter Wolfe v. MBNA America Bank, 485 F.Supp.2d 874, 882 (W.D. Tenn. 2007). in an Internet 12, 2005 available at This was by an on on in an Internet 8, available at of No. 25, The is an See, e.g., HIPAA Security Regulations, 45 C.F.R. § at p. 6. Ibid., at p. 3. Ibid. v. National 2007 U.S. App. Lexis 2007), at p. 13. See, e.g., on of Security Breach Personal of Privacy of April 2006 (hereinafter at pp. at note , at p. a of such in the United States and a of the number of individuals Privacy at IRS Rev. Proc. § See list of statutes in the Appendix. on for Access to Information and Part of A to Appendix, at 12 C.F.R. Part 30 (OCC), 12 C.F.R. Part (Federal Reserve System), 12 C.F.R. Part (FDIC), and 12 C.F.R. Part 568 (Office of Thrift 29, Vol. No. 29, at p. (hereinafter the maintains personal information that the not in the laws the to the or of the information, than the individuals of any of the security of the See, e.g., Code § Rev. Stat. § Code, § Stat. § Code § 2007 The also any combination of of information that to or the such as and or and See, e.g., Breach to the of & Financial Services, December 15 USC Section This that with the of at 15 USC Section and are of in this and are of in this See, and of a Duty to Information Security Computer & L. See and to Law the Protection of Personal BNA Privacy & Security Law Report, 19, p. May See at on the of the Framework for Electronic and Services, with focus on the 26, available at Science and Technology Committee, House of Internet of July 24, at Para. of the Privacy of Canada, for in to Privacy available at See Privacy Breach of the Privacy available at Privacy available at See, of the Privacy to the Law of February at available at Available at Available at to information to state

Automation of production processes of enterprise today has enormous scales. The spread of automated control systems of technological processes (ACSTP) and their integration with corporate information systems have led to increase in proportion of successfully implemented malicious impacts on ACSTP. Occurrence of new types of attacks and increase in number of successfully implemented attacks cause the need to form protection systems of industrial systems. Designing protection system of ACSTP is multi-stage process, starting with collection of data on object of protection, its main components, information assets, links with other systems, and identification of relevant information security threats to the system. In this article analysis of structure of typical automated control system of technological process is carried out. The most important components of ACSTP from the point of view of information security are identified. The article defines the need to form project of protection system of ACSTP on the basis of monitoring data of events that occur in ACSTP. Main classes of system events from the point of view of information security are defined. The most typical information security threats for this type of automated systems are considered. Neutralization of groups of threats relevant to ACSTP is carried out by means of forming effective protection system. The typical composition of data protection system of ACSTP is defined. According to results of analysis, the correspondence between security events of ACSTP, current threat groups and typical means of information protection is determined. Choosing the composition of information security tools is complex task that requires a lot of time. To achieve greater efficiency in its solving, it is proposed to use decision support system and system of artificial intelligence. Authors developed functional model of selection of protection system's project using intelligent method of decision support with neural network in it.

The structure of modern information and communication systems (ICS) is characterized by considerable spatial diversity of a large number of interacting subscribers. In these conditions, technologies of processing, storage, protection, transmission and reception of information on the network under conditions of natural and artificial interferences (impacts), as well as limited frequency and energy resources of ICS play an extremely important role in ensuring the quality of service of end users. ICS, especially for critical applications, are increasingly demanding to ensure the effectiveness of their functioning (speed of information transmission, electromagnetic compatibility, noise immunity, information security, survivability, secrecy, information security). The ability to implement these requirements is largely disregarded by applicable information technology. There is a contradiction between the strict requirements for secrecy, confidentiality, integrity, authenticity of data stored and transmitted through communication lines, on the one hand, and existing models, methods and technologies for managing telecommunications networks, information security, services and quality of service, on the other hand. The main ways to resolve this contradiction is to increase the noise immunity, secrecy and information security of ICS based on the improvement of methodological bases for the construction of ICS by developing methods of information exchange, methods of synthesis of signals of physical data carriers with the necessary properties. The principles of construction of derivative signal systems are given. The requirements for output and source signals are defined. The justification of the possibility of using random (pseudorandom) processes for the production of signals is used to construct them. The results of studies of ensemble, correlation, and structural properties of the obtained systems of derivative signals are presented. It is shown that the use of this class of complex nonlinear discrete signals in modern ICS will improve such performance indicators of such systems as noise immunity, information and structural stealth.

Introduction. Confidentiality and protection of information contained in Country-by-Country Reports is one of the most important aspects of implementation of provisions of Action 13 of the Base erosion and Profit Shifting Action Plan (BEPS Action Plan) into national legislation of countries around the world. Problem statement. Considering Ukraine`s commitments to Organization for Economic Cooperation and Development (ОЕСD) in frames of combating against tax evasion by multinational groups of companies, a particular relevance receives the study of model legislation on confidentiality and protection of information, which is the subject of voluntary automatic exchange between countries, and approaches to its implementation into national legislation. Purpose. Complementary analysis of institutional basis for ensuring confidentiality and protection of information that is the subject of exchange between OECD member countries in frames of the BEPS Action Plan. Materials and methods. The research is based on a combination of general scientific methods, methods of comparison and empirical approach. Results. The need for harmonization of domestic legislation with OECD regulatory requirements that regulate confidentiality of information on taxpayers (including information exchanged in accordance with international agreements) has been substantiated. Conclusions. Based on the results of the conducted research it has been proved that there is the need for further improvement of institutional provision of protection and confidentiality of tax information, including information exchanged in accordance with international agreements.

У статті представлено результати дослідження асоціативного поля концепту «інформаційна безпека». Теоретико-методологічною основою роботи стали новітні підходи до інформаційної безпеки як складової психологічної та інформаційної захищеності суспільства. Метою дослідження є виявлення асоціативного поля концепту «інформаційна безпека» за даними асоціативного експерименту з бакалаврами освітніх програм «Журналістика», «Міжнародна журналістика», «Реклама та зв’язки з громадськістю», «Видавнича справа та редагування», діяльність яких безпосередньо пов’язана з інформаційною сферою.Аналіз концепту «інформаційна безпека» як такого, що формується у свідомості споживача інформації через певне усвідомлення інформаційної та особистісної захищеності в площині соціальних комунікацій у мережі Інтернет, а також такого, що презентує мовну картину світу індивіда в інформаційну епоху, здійснювався на міждисциплінарному рівні.Зокрема, у дослідженні подано аналіз асоціативного поля концепту «інформаційна безпека» відповідно до отриманих логічних і граматичних реакцій ста вісімнадцяти респондентів. Аналіз за логічним компонентом виявив сім тематичних груп асоціацій: сфера захисту особистої інформації; сфера засобів масової інформації / соціальних мереж; сфера технологій; сфера державної інформаційної безпеки; соціальна сфера; психологічна захищеність; сфера захисту авторської інформації.Важливість поняття «інформаційна безпека» для цілої низки сфер інформаційної діяльності зумовлюється подальшим розвитком інформаційних технологій та технічних засобів обробки та захисту інформації, тому незаперечною є перспектива подальшого дослідження поняття в контексті виявлення рівня усвідомлення інформаційної безпеки як підґрунтя інформаційного та особистісного комфорту, а також для вивчення специфіки кореляції асоціативних полів концептів «інформаційна безпека», «інформаційна культура», «інформаційний комфорт», «інформаційний дискомфорт» тощо.

HOW MUCH ICT SECURITY HAS IMPROVED DURING THE LAST DECADE

The article based on current legislation from the standpoint of adaptation of the national legal framework to the requirements of the European Union considers the protection of information in the context of information security. The methodology of scientific research based on factor, causal analysis, aimed at identifying the circumstances for a comprehensive and systematic study of the nature of the impact of information protection on information security. The relevance of the study is due to the impact of the development of information and communication technologies on information protection in the context of information security. It is noted that information security covers the protection of confidentiality and ensuring the state of protection of constitutional rights and freedoms of man and citizen, provides access to and use of information, raising questions about the protection of information. Information protection ensures the integrity, reliability, accuracy and completeness of information. Regulatory and legal regulation of information protection includes norms that regulate public relations that arise in the process of information interaction between individuals and legal entities and the state. It pointed out that the development of the digital economy has necessitated amendments to the legal regulation of information protection, which does not have time to adequately respond to changes in technological and social aspects in society. The need to protect trade and professional secrets, state secrets, insider information, personal data is emphasized. Based on the analysis of the implementation of information protection to ensure the confidentiality of restricted information in the context of information security, a number of patterns are identified, which are taken into account in determining trends in information protection. It is stated that the protection of information should be regulated for all types of restricted information.

The necessity of formation of an effective information security system of the enterprise is substantiated. It is emphasized that when designing an information policy, the firm must comply with the requirements of the current legislation, take into account the level of technical support, especially the regulation of employees' access to confidential information, etc. It is stated that the costs of organizing information security measures should be appropriate to its value. The article identifies major threats that could be breached by confidential information. The list of the main normative legal acts aimed at bringing to civil, administrative and criminal responsibility for illegal collection, disclosure and use of information constituting a trade secret. The main stages of building an information security policy are summarized, the most common types of information threats related to the use of modern computer technologies are described. The necessity of developing a domestic original accounting (management) program that could be used in the long term by the vast majority of Ukrainian enterprises is pointed out. There are three groups of tools that are applied in the theory and practice of information security of the enterprise (active, passive and combined), emphasizing the need for planning and continuous monitoring in real time of all important processes and conditions that affect data security. It is noted that even if the information security system is built taking into account all modern methods and means of protection, it does not guarantee one hundred percent protection of the information resources of the enterprise, but a well-designed information security policy allows to minimize the corresponding risks. Key words: information security, information policy, information security, confidential information, information threats, information and communication technologies, software.

This article provides the modern cybersecurity trends directly related to aim ant tasks of criminals. It reflect the assessment of global technological risks discussed at 2020 World Economic Forum. The article covers estimations on increase on negative impact of geopolitical sharpness elements on economic potential of next generation technologies. Data fraud and cyberattacks are considered as priority key indicators at assessment of the most possible global risks, and attacks at informational infrastructure are equal to the cyberattacks risks at the rating of the most possible risks. Forecast indicates that cyberattacks are the most likely to be used as indirect conflicts between countries which look forward to expand their range on influence. In such situation the cybersecurity issues can`t stay on the second place or be the issues which should be solved at existence of direct cyber threats to the modern informational systems, IoT systems and SCADA. Obviously, we should revise the approaches to creation and development of modern informational technologies and cybersecurity issues should be considered as constituent element in development of modern informational systems from the very moment of its initiation, projecting, and on all stages of production and support. Reorientation of informational system developers to creation of new integrated platforms with cybersecurity constituent elements demands the research and implementation of new approaches to its development, as well as engagement of the world community at elaboration of relevant standards and protocols, which ensure the secure functioning of informational systems at world net. The article provides the basic requirements to constituent elements at development of concept of informational and cyber security in conditions of hybrid threats especially provides recommendations on organizational structure for informational security department and general principles to organize the activities and controls on informational and cyber protection. The article defines tasks for informational security department, provides the list of basic actions to secure information, and formulates the tasks, which should be ensured by technical infrastructure, organizational, procedural and hardware and technical actions to manage the informational security, and other principles to ensure informational security in development of concept of informational security within the hybrid threats conditions.

Information security is a critical field in which many different factors and constraints must be taken into account to ensure that data and infrastructure are protected. One of the main challenges in this area is the optimal allocation of limited resources between different security measures, which requires the use of mathematical methods to find optimal solutions. This article discusses the use of linear programming methods to solve problems related to optimizing the costs of information security risk reduction measures. The article reviews scientific sources on the applied aspect of linear programming for risk assessment and information security risk management. The article shows the process of building a model based on a linear programming problem, starting with the formalization of the problem, selection of the objective function and constraints, and ending with obtaining an optimal solution with its analysis and interpretation. The model in the form of a linear programming problem allows optimizing the total costs of information security, taking into account the chosen direction of optimization and given the given constraints on resources - budget, time, technical and other. The article presents the use of linear optimization based on the SWOT analysis of information security risks, which allows organizations to systemize and specify the risk management process, directing limited resources to the most critical areas and ensuring optimal protection of data and information systems. The obtained results show that the use of linear programming methods allows to achieve a significant optimization of information security costs, providing a high level of protection. Among the promising directions for further research are multi-criteria optimization and dynamic planning with consideration of time changes in risks and costs. This study can be used as an illustrative example of intersubject connections of the disciplines of the specialty 125 Cybersecurity and information protection in the educational activities of students of this specialty.

Nowadays, information protection and cybersecurity are one of the urgent tasks defined by the normative documents of our country in the field of national security and defence. In a state of tense foreign policy conditions, information protection is an urgent problem of our society. This article presents a unified approach to the systematization of cyber threats. The essence of this approach is to eliminate uncertainties regarding the description of cyber threats. Based on the results of the analysis of existing works on this topic, the advantages and disadvantages of existing approaches are identified. It is important to note that the classification of vulnerabilities in information systems is currently developing rapidly, but the problem of classification of threats remains relevant. The vulnerability remains only a tool for realizing the existing threat. Given the possible risks of information security and cybersecurity of information systems and process control systems at critical infrastructure facilities, a study of known cyberattacks has been conducted. Based on the experience of the world community in the field of cybersecurity and information technology, the classification of methods of intrusion and types of attacks on information systems. Using a formalized approach with the help of drawings and diagrams, the vectors of attacks, the structure of the attack and the development of the information security incident are presented. The description of possible approaches to the development of cyber threat taxonomy is investigated and presented. The definition of key concepts is given. The results of this study can be useful for assessing information security risks, in particular in determining the criticality of the organization’s assets, in creating information security management systems and developing appropriate technical regulations to ensure the continuity of business processes of the organization.KeywordsCybersecurityTaxonomyVulnerabilityCyber threatClassificationAttack

The article examines the administrative and legal foundations of the participation of the State Bureau of Investigation (SBI) in Ukraine’s informational relations, with a focus on contemporary challenges and development prospects for this institution. The author analyzes the role of the SBI in ensuring national security through information management and the protection of confidential data amid dynamic changes in the informational space. Special attention is paid to issues of information protection in the face of modern cyber threats and the absence of unified standards for data storage and processing, which present significant challenges for law enforcement activities. The article also highlights legal and organizational aspects of working with information, particularly mechanisms for storing, processing, and using confidential data. The author emphasizes the importance of implementing international information security standards and integrating them into the national legal framework, considering contemporary challenges, especially under martial law conditions. Given the rapid development of information technologies and the constant evolution of cyber threats, the need for regular updates to the legal mechanisms governing the interaction of the SBI with other state bodies and international partners becomes evident. This process involves creating an integrated cybersecurity system that ensures a high level of security for information systems at all stages of data processing, from collection and storage to usage. The need to improve these mechanisms stems not only from global challenges, such as the increasing number of cyberattacks, but also from specific demands placed on law enforcement agencies in protecting national security and confidential information. One of the key aspects requiring attention is the comprehensive training of personnel in the field of cybersecurity. This includes both the education of existing staff and the preparation of new specialists capable of effectively responding to modern cyber threats and possessing the necessary knowledge about cutting-edge information protection technologies. Systematic training demands the development of specialized training programs and courses covering all aspects of cybersecurity, from the basic principles of information protection to advanced technical knowledge in combating cyberattacks and identifying vulnerabilities in systems. The conclusion emphasizes the need to develop a unified approach to protecting information systems in the SBI, improve legal regulation, and enhance international cooperation to strengthen cybersecurity. This will improve the efficiency of the bureau’s operations while maintaining the confidentiality and security of information in the face of modern challenges.

This article examines the problems of information security organization of electronic trading platforms systems. The requirements of regulatory documents on the protection of confidential information and ensuring the continuity of business processes are considered and systematized. The article presents the results of the analysis of the data processed in the information system, establishes the level of security and the level of protection of confidential information, provides a methodology for determining current threats to information security and a list of current threats taking into account incident statistics.

The article analyzes the problematic issues of determining the content of the concept of protection of restricted information, in particular, the authors analyze the existing terminology used by the legislation of Ukraine on the protection of restricted information. The authors of the article, based on existing legislation regulating such information storage measures as information protection, technical protection of information, cryptographic protection of information, cyber protection, using the deductive method of research derived the definition of “protection of restricted information”. In addition, using various scientific research methods, the authors of the article highlight the issues of legal uncertainty and contradictions in the concepts of some types of restricted information protection, which are found in the guidance documents on the subject of research. Also, in the article: the properties of information are derived and the types of operations with information are determined. This took into account the understanding of the concept of “restricted information”, which was defined by one of the authors in his previous work; the idea of the content of protection of restricted information is summarized, and also each of properties of the information which make the content of its protection is investigated.