There has been much speculation as to whether the recently-instated Mass. 201 CMR 17.00, as well as the other 40-plus state breach laws, will actually be effective in getting businesses up to speed, security-wise, or if the laws are too onerous and confusing for small to medium-sized businesses. The new Massachusetts data protection law applies to all persons that own, license, store or maintain personal information about a resident of Massachusetts and requires that businesses encrypt any documents sent over the Internet or saved on laptops or flash drives, encrypt data transmitted wirelessly and deploy up-to-date firewalls.

This law need not be difficult to comply with, technology-wise. Deploying a firewall is simple and most SMBs will not have trouble doing so.

Encryption can also be easy. Businesses that often exchange data with another office or organization can set up a VPN connection between networks, allowing for frequent exchange of information in a secure manner. Businesses with remote workers or that only occasionally exchange information with other offices or organizations can employ a Road Warrior solution. This type of connection allows for a single device, such as an employee’s laptop, to connect back to the office and securely send and receive data.

Email encryption also helps in compliance with data security laws; however, it is advisable to choose a solution that performs the encryption transparently at the gateway with no employee involvement.

Unified threat management (UTM) solutions often offer firewall, VPN and email encryption in one security appliance. By using a UTM product to protect your network and encrypt sensitive documents, you will not only be complying with the law; a UTM security appliance will also help you to increase IT productivity, decrease risk to the network and increase the control you have over your environment. To learn about how Astaro can help you comply with data protection laws or to receive your Astaro Security Gateway evaluation unit at no charge, visit www.astaro.com.

The difficult part of complying with new data protection laws will not likely be the technological aspect; the real challenge will be properly training all personnel and ensuring they follow the new security best practices. 

By Jack Daniel
Support Engineer, Astaro
Director, National Information Security Group (NAISG)