One step in the process of getting set up to participate in the
ALD is to satisfy the state’s concern related to system
security. This article highlights some of the areas discussed
recently as we worked with Nebraska Board of Public Accountancy
staff and consultants to evaluate NASBA’s security measures.
Early on it was determined that using the social security number
as a personal identifier for the ALD was not acceptable. Using a
one-way hashing algorithm that uses the date of birth and the
last four digits of the SSN a unique identifier is generated at
the state board office and then transmitted to the ALD database.
This eliminates the need to store SSN in the ALD database. NASBA
has begun implementing controls based on industry standards
including, but not limited to, the Federal Information Security
Management Act of 2002 (FISMA) and the Open Web Application
Security Project (OWASP). Although no security system can ever
be guaranteed to be completely secure or prevent all intrusions,
these standards he