Reference no: EM133714035

Assignment: PKI & Encryption at Work

Learning Objectives and Outcomes

Develop a plan to deploy public key infrastructure (PKI) and encryption solutions to protect data and information.

Task

In this assignment, you play the role of chief information technology (IT) security officer for the Quality Medical Company (QMC). QMC is a publicly traded company operating in the pharmaceutical industry.

QMC is expanding its arena of work through an increase in the number of clients and products. The senior management of the company is highly concerned about complying with the multitude of legislative and regulatory laws and issues in place. The company has an internal compliance and risk management team to take care of all compliance-related issues. The company needs to make important decisions about the bulk of resources it will need to meet the voluminous compliance requirements arising from the multidimensional challenge of expansion.

QMC will be required to conform to the following compliance issues:

1) Public company regulations, such as the Sarbanes-Oxley (SOX) Act

2) Regulations affecting financial companies, companies that make loans and charge interest, such as the U.S. Securities and Exchange Commission (SEC) rules and Gramm-Leach-Bliley Act (GLBA)

3) Regulations affecting healthcare privacy information, such as Health Insurance Portability and Accountability Act (HIPAA)

4) Intellectual Property Law is important for information asset protection, particularly for organizations in the pharmaceutical and technology industry.

5) Regulations affecting the privacy of information, including personal identification information, such as personally identifiable information (PII) regularly collected from employees, customers, and end-users

6) Corporate governance policies, including disclosures to the board of directors and the auditors and the policies related to human resources, governance, harassment, code of conduct, and ethics.

Compliance with regulatory requirements implies encrypting sensitive data at rest (DAR) and allowing access to role-holders in the enterprise who require access. It also implies that sensitive data in motion (DIM) or data being communicated via e-mail, instant message (IM), or even Web e-mail must be suitably protected and sent only to the individuals who have a right to view it. The company is conscious of the loss it may face in terms of penalty and brand damage if it fails to abide by the compliance laws, especially in the online information transfer phase. Therefore, as a dedicated employee, your task is to develop a content monitoring strategy using PKI as a potential solution. You must determine a process or method to identify multiple data types, processes, and organizational policies. Incorporate them into a plan, and select a PKI solution that will effectively address the content management needs of your company.