More on outsourcing...

[SandiF]

Endangered species: US programmers
http://story.news.yahoo.com/news?tmpl=st...esusprogrammers

[i]Contrary to what this article is alluding, the US programmer will never be an "endangered species". However, Programmers (I prefer Software Developers) will continue seeing a shrank in their rank as other professional fields outside the scope of IT development take a more leading role.

Outsourcing can undermine compliance

http://news.zdnet.com/2100-9589_22-5406621.html

Without a doubt. Working in IT Governance (set standards and enforcers of key process), compliance issues, business processes and standards and worse security are one areas I've often stated *may* be overlooked.

This article address much of my concern with outsourcing where corporate compliance is concerned.

More outsourcing news... JP Morgan Chase cancels IBM outsource contract

http://news.zdnet.com/2100-3513_22-5367781.html

http://news.zdnet.com/2100-9589_22-5370315.html

[j-kid]

Re: More on outsourcing...

A large portion of di USA companies seems to gone hog-wild wid dis outsourcing. It would seems foolish for USA to keep doing this. What if things got bad in that country, like say it is in Iraq. Not only your knowledgebase, but your expertise is in jeopardy.

USA could end up at the mercy of other countries or their political whims. You are also directly leaving yourself open for anyone to plant hidden or malicious software codes in any type of equipment you choose to design and build outside the country in these weird times that we are living in. We are sending sensitive documents (such as Income Tax forms) outside the country to be processed. They sure are making it very easy for the secret terrorist that they may wish to plant into any USA based off-shore organization.

[j-kid]

Re: More on outsourcing...

Outsourcing can undermine compliance:

Commentary--Outsourcing and off-shoring have been profitable strategies for U.S. business in the past few years, dramatically reducing the costs for services like software development and call center management. But recent legislative and regulatory activity focusing on the improvement of corporate governance and IT security has raised serious, yet often overlooked, compliance issues for those organizations that outsource significant processes and sensitive data to other companies or independent contractors.

The health care and financial services industries, for example, are required to hold business partners, contractors, consultants, and outsourced vendors responsible for maintaining the confidentiality, integrity, and availability of sensitive data, particularly their proprietary databases containing the non-public personal information of their own customers. Organizations that choose to outsource must carefully document their due diligence in selecting third parties and managing business processes and IT security over the life of the contract.

In the United States, it is relatively easy for the client organization to verify compliance with Federal regulation through audits and inspections, even when the business partner resides in a different state; even so, not all organizations take the time to thoroughly review the IT security controls in place in the business partner’s corporate computing environment.

The client organization is ultimately responsible for understanding how business processes and data security are managed. Does the business partner outsource, for example? Are background checks performed on employees? Are there employees that work remotely or from home? Is strong authentication used for remote access for these employees? Do they share passwords or user accounts? Are networks and databases properly segmented, so that one client organization cannot access the data of another? How is the facility physically secured?


These issues can become even more complex when client organizations send core processes or sensitive data overseas performed--the most popular being India, Ireland, and Georgia (Eastern Europe)--where issues such as industry standard practices, legal liability, and even business ethics can become muddied. Off-shoring is of particular concern for any organization having code written, applications developed, or significant call center/support work. How can the client organization ensure the protection of its data? What are its responsibilities in evaluating appropriate information security in the business partner’s environment? What are the organization’s liabilities in the event of a breach over which it has no control?

Take for example, the October 2003 case involving Heartland Information Services in Ohio. Heartland, a medical transcription firm, had outsourced some work to a firm in Bangalore, India. Several disgruntled employees at the Indian firm broke into a manager’ office and stole proprietary information belonging to Heartland. The thieves then sent anonymous e-mails to Heartland, complaining about the Indian firm’s management practices and demanding money from Heartland for the return of the information. If Heartland refused to pay, the thieves would release the information, which they claimed contained patient records, on the Internet.

Fortunately, the perpetrators were identified and caught within a few hours, and the information was never publicly disclosed. Unfortunately, it was not an isolated incident. Another such event in October 2003 involved the University of California--San Francisco Medical Center, which had also outsourced to an Indian firm. That firm in turn outsourced transcription work to a number of independent contractors, one of whom notified UCSF that she had not been paid according to her agreement with the firm and would therefore post patient files on the Internet if she did not receive payment from UCSF. The issue was ultimately resolved when she was paid by the Indian firm, and no patient files were publicly disclosed.

These were close calls for both Heartland and UCSF, being affected by HIPAA and California SB 1386, both of which require the protection of consumer’s personal information. CA SB 1386: the Database Breach Notification Security Act applies to all organizations doing business in California, and/or storing records of consumers, customers, or employees that are California citizens. The organization must notify those individuals if it experiences a breach in security to the extent that the database was compromised, and records were, or may have been, exposed. The Act does not discriminate between data processed and stored in-house and that processed and stored with an outsourced business partner. While SB1386 applies to all industries, the health care industry has specific regulation for protecting consumers’ personal and medical information under the Health Information Portability and Accountability Act (HIPAA).

The HIPAA Security Standard requires physical and logical data access control, background checks on employees, encrypting customer data in transit and in storage, change control management, incident response and disaster recovery plans, monitoring system use, data handling policies and procedures, and application criticality analysis. The affected organizations must maintain a high security posture in-house, and through business associate agreements, must hold all third-parties that access, process, transmit and store sensitive patient data accountable for maintaining equivalent security controls.

The new Sarbanes-Oxley regulations add another wrinkle to the compliance mix. Sarbanes affects all publicly traded companies in the United States, and foreign filers in U.S. markets, mandating the reporting of internal controls over financial data and financial reporting. The regulation makes no distinction between processes performed and data stored in-house or with third parties.

Management of the client organization must make assertions as to the effectiveness of the internal control structure around the systems, services, devices, and in some cases personnel, that are involved in the processing and storage of financial data and the creation of financial reporting; the organization is held accountable for data integrity no matter what the point of origin or where the place of residence.

Ultimately, no organization can afford to take IT security for granted. When considering outsourcing or off-shoring, the client organization must require a security audit of the business partner’s environment, at minimum. Ideally, the client organization should actively review the report of findings and any results of testing, and perform an on-site inspection the physical facility annually. Finally, security responsibility and liability in must be clearly documented in contracts and/or service level agreements in order to avoid finger-pointing and allow for effective response to breaches or security incidents when they occur. Client organizations are often putting their most important resources in the hands of outsourced business partners--they must make it a priority to ensure that those assets are adequately protected.

Five Tips for Maintaining Effective Information Security when Off-Shoring

1. Obtain legal advice from in-country counsel.
It may be tempting, and even seem cost effective, for the client organization to rely on its business partner(s)’ legal counsel for contracts, routine paperwork, and potential disputes. It is imperative, however, that the organization has an advocate that represents its own interests, rather than those of the business partner(s), in the foreign country in which the outsourced work is performed. When dealing with European Union member countries, consider SafeHarbor/EUDPD compliance.

2. Specifically state U.S. regulatory requirements in contracts, MSAs, and SLAs.,br /> All written agreements between the client organization and its business partner(s) must specifically state the intention to hold overseas business partner(s) responsible for maintaining regulatory requirements relevant to the processes performed by or data maintained within the outsourced environment. HIPAA and GLB, for example, mandate that third parties provide information security controls equivalent to what is maintained in-house by the client organization. The organization is responsible for verifying that appropriate controls exist and function effectively. Sarbanes-Oxley makes no distinction between processes performed and information maintained in-house or outsourced, but mandates safeguards and control measures for financial data and organizational records across the board.

3. Do not allow the business partner(s) to ‘outsource’ outsourcing.
In many instances, the business partner will send work out to other firms or even independent contractors. These third parties maintain little or no contact with the primary client organization, which may find itself a victim in disputes between its business partner(s) and their third parties. It is difficult to validate and/or maintain control of information security in these circumstances – the longer the outsourcing chain, the more likely the degradation in quality of information security.

4. Perform thorough due diligence.
Make certain that the business partner(s) can produce reliable information security documentation, preferably from a recognized source. The client organization, particularly in heavily regulated industries, is responsible for understanding how its information is created, manipulated, processed, transmitted, stored, and destroyed--in both electronic and hard copy form. For example--are print outs and hard copies containing sensitive data securely shredded? Are file cabinets locked when not in use? Are old equipment and data media formatted and “scrubbed” before being re-used, re-sold, or thrown out? Are employees allowed to remove data/media from the facility? Do employees work at home, and if so, do they use personal computing equipment or corporate property? How are home and remote locations secured? Etc.

5. Make a physical inspection of the partner facility at least once annually.
This is an important, but often overlooked, part of due diligence, particularly when it involves overseas travel for the client organization. But an inspection of the facility, and the opportunity to observe standard operating procedures and controls in place, can ease the common concerns of the client organization’s senior staff and regulators.

Remember, it is impossible to put too high a price on information security, particularly in today’s regulatory environment. A little time and effort spent up front can save any organization potential loss in terms of revenue, resources, and reputation.

biography
Marne Gordan is the Director of Regulatory Affairs for TruSecure Corporation, where she is responsible for managing industry relations and maintaining regulatory intelligence on health care, the financial services industry, and the Federal Government.

[dahjah]

Re: More on outsourcing...

with all the outsourcing it look like dem nuh realize seh aftah dem get rid a all de good paying jobs dat not a sole cyan buy de product.

Soon we cyaan even afford gyas