|
I agree with your statement on this matter. Who cares if you change a
table name if the actual privacy data is still available? FISMA does not
explicitly state the requirement of changing names of personal data in
applications, or that changing the label of data in
a database is recommended or required. In fact, performing this type of
action is like an extremely weak "security through obscurity" mechanism
and really isn't obscure at all.
Even if you change the name from SSN to GovAssignedIdNumber, certain security controls still need to be applied in order to
ensure the data is protected appropriately. The name assigned to the
data is not relevant, instead, how the data is secured is the priority.
When an assessment is being performed of the data, the assessor is not
concerned with what the data is titled, but instead, on how the data is
protected. Therefore, even if you title "home phone" as "other phone",
the assessor will need to ensure the appropriate security controls are
in place in order to show compliance against FISMA.
|
