Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/22/2018
02:30 PM
Marc French
Marc French
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

GDPR 101: Keeping Data Safe Throughout the 'Supply Chain'

There are a lot of moving pieces involved with data collection, retention, and processing in the EU's new General Data Protection Regulation. Here's how to break down responsibilities between your security team and service providers.

While there has been a lot of chatter about the magnitude of penalties organizations may find themselves hit with (up to €20 million in fines) under the impending General Data Protection Regulation (GDPR), there isn't nearly enough talk about how to avoid penalties in the first place.

Sure, there are conversations about pre-ticked opt-in boxes and breach notification protocols ("You have 72 hours to report personal data breaches to the appropriate authorities," for one). But businesses are failing to address the root of the problem — the data itself.

To ensure compliance with GDPR, personal data must be kept only for as long as necessary, an issue that clearly is up for debate, as length of time varies by organization and industry. Then there is the "right to be forgotten," which means that data subjects can request that their data be deleted at any time.

But to understand how to identify, recall, and protect that data, organizations must first understand the nature of the data itself. For example, if I, Marc French, log in to your website, you need to keep track of where I go — and in a timely manner. If I ask for you to remove my data so the Googles and Facebooks of the world can't access bits and pieces of my "identity," you're now obligated by law to destroy any trace of it. And, if you don't know where that data is, you can't get rid of it.

Whether it's in the finance department's hands, the marketing department's in-boxes, or even with your shipping company for deliveries, there are a lot of different parties that are constantly using, holding, and updating personal data. That's why it's important to look at the data custody process in terms of tiers and outside forces — a supply chain, essentially.

Here are three examples of supply chain data you might not be considering but that could have GDPR impacts:

1. Escalation personnel phone numbers of your European IT staff for the cloud service to which you subscribe. Phone numbers are personal data, and you need to ensure that they do not leave the cloud service to its downstream partners without your consent.

2. The event registration data you collected for that big marketing conference that includes dietary restrictions for attendees. Not only is the attendee registration data considered personal data, but you are now also collecting sensitive medical data by way of the dietary restrictions. Because of this, you need to track what the caterer is doing with the information that is provided.

3. Your building's security desk that signs in visitors to your office, prints a badge, and gives it to the visitor, who later returns it upon leaving. Not only is data on the badge likely personal, but how you dispose of it, or how the security vendor handles it in its system, has GDPR implications.

As you can see with data collection, retention, and processing, there are a lot of moving pieces involved, and each of these parties comes into contact with personal data at some point along the line. Because of this, there's now a responsibility for both data processors (such as service providers) and data controllers (such as your organization) to work together in the case of a breach under GDPR.

According to the regulations, both parties might be liable for breaking the law and are required to notify regulators, their customers, and end users, and, ultimately, both parties are obligated to pay all fines and compensate customers for damages. If anyone in your supply chain loses control of the data, you too may also be responsible — and experience both pricey financial and reputational costs.

Before you develop a plan for working with the different tiers, the first step will be to consider how you classify the data. It's important that you qualify the data you collect and determine its value/risk to the business before doing anything else. For example: Is the data critical to your revenue stream (credit card data), or would the loss of the data be catastrophic to your intellectual property strategy (formula to your specialty cola)? If so, you rate the risk/value high.

Next, you'll need to rank your vendors. Ask employees who are provisioning new vendors what data they are collecting, and then rank the vendors based on the data valuation you developed during step one. They'll typically be split into two levels, which many organizations break down as:

Tier 1: Vendors that operate on the most sensitive data you have. You will want to do a dive deep with these folks and conduct a thorough vendor review, ensure contractual protections, and regularly review them for compliance and security.

Tier 2:  These vendors may operate on less sensitive data. Keep track of these folks in a central system on a regular schedule, so you can dust the list off and sample your internal customers to see if they are using additional services that might elevate them to tier 1. You may be surprised that the tier 2 vendor you set up two years ago has become tier 1 as the partnership has evolved.

With the GDPR deadline upon us, it is important to start work closely with tier 1 and tier 2 vendors to guide your organization's data protection strategy moving forward.

Related Content:

Marc French is the senior vice president and chief trust officer at Mimecast. He has more than 25 years of technology experience in engineering, operations, product management, and security. Prior to his current role, Marc was the CSO of Endurance International Group/Constant ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .