May 9, 2018

Database Compliance & Security: What You Need to Know

For many organizations, meeting data and database regulatory compliance and security requirements is a top priority. Failing to meet regulatory requirements can make the difference between remaining in business or going bankrupt due to substantial fines and penalties. Similarly, a security breach can quickly tarnish a brand – with users losing trust and confidence in the company and its services.

The challenge in maintaining database compliance and security arises when teams push to accelerate software delivery while existing regulations evolve and new regulations get passed. To avoid any issues when external auditors show up, it’s important for development and data teams to transparently document and ensure that they meet database security requirements.

At the heart of most of these requirements is sensitive data that is stored in an enterprise database system. One of the key charters for DBAs and Operations Teams is to maintain database compliance and keep data secure and in line with regulations. In order to keep up with changing regulations, teams need the right tools and processes. Without the proper investments, it’s easy for databases to fall into non-compliance or to accidentally expose sensitive data to attackers.

Learn more about how Liquibase helps keep your database in compliance.

Top 5 Regulatory Compliance Requirements for Databases

To add context to the capabilities that organizations must bring to better govern and secure database systems, here are some notable regulatory compliance requirements that heavily impact the database:

GDPR Database Compliance

The General Data Protection Regulation is a European Union law on data protection and privacy for all individuals in the EU. The law regulates the export of personal data outside the EU and aims to give EU citizens and residents control over their personal data. This law includes articles that regulate data breaches, the right for citizens to access their personal data, the right for citizens to request the erasure of personal data, and data portability. Given the scope of the GDPR, there are substantial ramifications for how user data is stored, accessed, and shared from enterprise database systems.

Sarbanes-Oxley Act (SOX)

The Sarbanes-Oxley Act (SOX) of 2002, known also as the “Public Accounting Reform and Investor Protection Act” and “Corporate and Auditing Accountability, Responsibility, and Transparency Act”, sets requirements for and regulates how companies operating in the US report and disclose finances in order to improve the reliability and accuracy of financial disclosures and subsequently reduce fraud. Such financial data is usually stored across data warehouses and databases that are constantly in flux as companies modify prices, products, and processes.

HIPAA Database Compliance

The Health Insurance Portability and Accountability Act of 1996 consists of five titles. Title II of HIPAA establishes policies and procedures for safeguarding the privacy and security of individually identifiable health information to control fraud and abuse in the health care system. Effectively, any part of an individual’s medical record or payment history is protected by this regulation. Organizations with a footprint in healthcare must carefully manage database systems that contain personally identifiable information and payment information to meet this regulation and must have means to allow individuals to access and request corrections to PHI.

GLB Act or GLBA

The Gramm-Leach-Bliley Act, also known as the Financial Modernization Act of 1999, controls the ways that financial institutions deal with the private information of individuals. The Act has three sections: the first regulates the collection and disclosure of private financial information; the second regulates security programs for protecting private financial information, and the third prohibits accessing private financial information using false pretenses. Similar to the other regulations, this Act requires organizations to carefully manage and secure their database systems.

PCI DDS Database Compliance

The Payment Card Industry and Data Security Standard is an information security standard for organizations that handle credit cards, designed to reduce credit card fraud. For companies that accept credit card payment, this effectively means that data that is stored or transmitted that includes cardholder data must be carefully managed and secured.

While these are not an exhaustive list of the regulations that govern database compliance, it should be clear, that organizations across industries are pressed to properly secure the data in their databases and meet regulations on how the data is processed, shared, or otherwise used.

Meeting Database Compliance Requirements

To efficiently and effectively meet data and database security and regulatory requirements, organizations need automated tools that can guarantee compliance. In the face of accelerating software release cycles and ever-changing regulations, it’s simply not enough to rely solely on database professionals and operational engineers. Those teams are already laden with maintenance and tactical tasks, from handling breaches to testing APIs. Instead, this is precisely where database version control and release automation solutions like Liquibase Enterprise can help.

Liquibase Enterprise requires all database changes to be tracked in source code control, provides transparent, role-based access to the status of database deployments across the enterprise, and automatically creates reports and dashboards to track database change activity. With a solution like Liquibase Enterprise, it becomes easy to answer who made a change, what the change was, where and when the change was made, and why the change was required. Combined with role-based access control and a solution for centralizing and securing database credentials, Liquibase equips teams to efficiently and effectively meet security and audit requirements in the face of accelerating software deployments and an ever-changing regulatory landscape. Learn more about how we help meet database compliance needs.

Learn more about database compliance enforcement in our resources: