Endpoint

5/22/2018
02:30 PM
Marc French
Marc French
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

GDPR 101: Keeping Data Safe Throughout the 'Supply Chain'

There are a lot of moving pieces involved with data collection, retention, and processing in the EU's new General Data Protection Regulation. Here's how to break down responsibilities between your security team and service providers.

While there has been a lot of chatter about the magnitude of penalties organizations may find themselves hit with (up to €20 million in fines) under the impending General Data Protection Regulation (GDPR), there isn't nearly enough talk about how to avoid penalties in the first place.

Sure, there are conversations about pre-ticked opt-in boxes and breach notification protocols ("You have 72 hours to report personal data breaches to the appropriate authorities," for one). But businesses are failing to address the root of the problem — the data itself.

To ensure compliance with GDPR, personal data must be kept only for as long as necessary, an issue that clearly is up for debate, as length of time varies by organization and industry. Then there is the "right to be forgotten," which means that data subjects can request that their data be deleted at any time.

But to understand how to identify, recall, and protect that data, organizations must first understand the nature of the data itself. For example, if I, Marc French, log in to your website, you need to keep track of where I go — and in a timely manner. If I ask for you to remove my data so the Googles and Facebooks of the world can't access bits and pieces of my "identity," you're now obligated by law to destroy any trace of it. And, if you don't know where that data is, you can't get rid of it.

Whether it's in the finance department's hands, the marketing department's in-boxes, or even with your shipping company for deliveries, there are a lot of different parties that are constantly using, holding, and updating personal data. That's why it's important to look at the data custody process in terms of tiers and outside forces — a supply chain, essentially.

Here are three examples of supply chain data you might not be considering but that could have GDPR impacts:

1. Escalation personnel phone numbers of your European IT staff for the cloud service to which you subscribe. Phone numbers are personal data, and you need to ensure that they do not leave the cloud service to its downstream partners without your consent.

2. The event registration data you collected for that big marketing conference that includes dietary restrictions for attendees. Not only is the attendee registration data considered personal data, but you are now also collecting sensitive medical data by way of the dietary restrictions. Because of this, you need to track what the caterer is doing with the information that is provided.

3. Your building's security desk that signs in visitors to your office, prints a badge, and gives it to the visitor, who later returns it upon leaving. Not only is data on the badge likely personal, but how you dispose of it, or how the security vendor handles it in its system, has GDPR implications.

As you can see with data collection, retention, and processing, there are a lot of moving pieces involved, and each of these parties comes into contact with personal data at some point along the line. Because of this, there's now a responsibility for both data processors (such as service providers) and data controllers (such as your organization) to work together in the case of a breach under GDPR.

According to the regulations, both parties might be liable for breaking the law and are required to notify regulators, their customers, and end users, and, ultimately, both parties are obligated to pay all fines and compensate customers for damages. If anyone in your supply chain loses control of the data, you too may also be responsible — and experience both pricey financial and reputational costs.

Before you develop a plan for working with the different tiers, the first step will be to consider how you classify the data. It's important that you qualify the data you collect and determine its value/risk to the business before doing anything else. For example: Is the data critical to your revenue stream (credit card data), or would the loss of the data be catastrophic to your intellectual property strategy (formula to your specialty cola)? If so, you rate the risk/value high.

Next, you'll need to rank your vendors. Ask employees who are provisioning new vendors what data they are collecting, and then rank the vendors based on the data valuation you developed during step one. They'll typically be split into two levels, which many organizations break down as:

Tier 1: Vendors that operate on the most sensitive data you have. You will want to do a dive deep with these folks and conduct a thorough vendor review, ensure contractual protections, and regularly review them for compliance and security.

Tier 2:  These vendors may operate on less sensitive data. Keep track of these folks in a central system on a regular schedule, so you can dust the list off and sample your internal customers to see if they are using additional services that might elevate them to tier 1. You may be surprised that the tier 2 vendor you set up two years ago has become tier 1 as the partnership has evolved.

With the GDPR deadline upon us, it is important to start work closely with tier 1 and tier 2 vendors to guide your organization's data protection strategy moving forward.

Related Content:

Marc French is the senior vice president and chief trust officer at Mimecast. He has more than 25 years of technology experience in engineering, operations, product management, and security. Prior to his current role, Marc was the CSO of Endurance International Group/Constant ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
12 Free, Ready-to-Use Security Tools
Steve Zurier, Freelance Writer,  10/12/2018
Most IT Security Pros Want to Change Jobs
Dark Reading Staff 10/12/2018
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.