Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security //

Compliance

// // //
2/28/2018
08:05 AM
Simon Marshall
Simon Marshall
Simon Marshall

GDPR: The New Price We Pay for Data Privacy

When the EU's GDPR regulations come into effect in May, the rules around how companies and individuals regard data privacy will change forever. Even for those outside Europe, this could be an expensive journey to take.

May 25 sees the launch of the General Data Protection Regulation (GDPR) in the European Union. It's a complex task to secure every single piece of personal data that firms process or store from EU residents.

With deep implications for privacy and data protection for EU and US companies, how prepared are we?

GDPR compliance touches many critical business areas: the relationships firms have with their customers, the technology that supports data protection, internal data process leadership and process change, legal issues and of course the cost of initiating and maintaining individual company GDPR strategies.

(Source: GDJ via Pixabay)
(Source: GDJ via Pixabay)

"Some companies will approach EU GDPR opportunistically and see it as a way to get more value out of the data," Joe Carson, chief security scientists at Thycotic -- a US privileged account security firm -- told SecurityNow. "[But] some organizations will see this as a painful process... [and] are organizations that hate change and see EU GDPR as preventing them from doing business."

About 30% of firms worldwide report being ready for GDPR, according to new stats from Forrester. Interestingly more US companies report they're fully prepared than their counterparts in the EU An additional 35% of firms say they're partially compliant today, or will be compliant within six months. (See GDPR Readiness Goes Beyond Security Controls.)

"These numbers are encouraging," said Enza Ianopollo, a security and risk analyst at Forrester, "however, few firms are approaching GDPR compliance with a comprehensive program and a sound risk-based approach."

"I do think that companies, especially outside of Europe, are overconfident about their ability to meet the new requirements because they doubt that EU regulators' reach will go beyond the EU. I think that they are taking a huge risk," Ianopollo added.

The new cost of data privacy
Firms in regulated industries clearly have had a head-start with GDPR because they are accustomed to operating within a tight compliance framework. According to Forrester's report, companies in the financial sector are the most GDPR mature, but media and retail firms -- which hold and process vast amounts of customer data -- lag, and have only just started their GDPR journey. They need to get it right because failure to comply with GDPR's rule set comes with a stiff price tag.

Organizations in breach of GDPR can be fined up to a maximum of 4% of global turnover, or E20m, whichever is the greater, in a tiered penalty system covering relatively minor to major infractions. Observers say it's possible that the EU could make an example out of a big US firm that fails to comply, in order to send a signal to the market right from the outset.

"The EU has a long history of standing for user freedom and fair competition," said Ambuj Kumar, CEO and co-founder of Fortanix, a data protection firm. "It's likely that the EU could impose an exemplary fine on a high-profile, well-known consumer company."

Potential fines aside, the cost of compliance for firms is somewhat of an unknown quantity, since GDPR is such a wide-sweeping regulation without an easily comparable precedent. Every company will have their own unique cost to stomach. (See GDPR, Cloud Changing Security Pros' Priorities Report.)

"On the negative side, I see a drawback in the increase of short-term costs for companies to rearchitect their security architectures," said Dr. Salvatore Stolfo, CTO of Allure Security. "We might also see a high short-term cost in the redesign of their business processes." He adds that because penalties could be high, this could complicate the risk management and estimates for future corporate liabilities.

"While many US companies will feel a financial strain to comply, a positive outcome is that underfunded security budgets will be right-sized due to compliance requirements," said Misha Govshteyn, co-founder of Alert Logic, a cloud security provider.

Legal implications
There are many recent examples of firms that failed to take adequate consumer data security precautions, and who also appeared sluggish to publicly acknowledging a breach. A prime example is the Sonic Drive-In breach last October, but notable consumer poster children include UPS, Barnes & Noble and Uber. (See SONIC Quiet on Data Breach Details.)

GDPR specifies that breaches notified outside of 72 hours will require an additional written explanation, and if the breach places a data subject at high risk, the notification must be made without "undue delay," which already appears a challenge for some companies.

"Companies who are not regulated usually do nothing to protect the data they have been entrusted to secure," said Thycotic's Carson. "It wasn't until cyberattacks became more expensive for insurance companies that as a result those that failed to secure and protect sensitive data began risking major financial losses."

Next page: GDPR adds additional complexity

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The 10 Most Impactful Types of Vulnerabilities for Enterprises Today
Managing system vulnerabilities is one of the old est - and most frustrating - security challenges that enterprise defenders face. Every software application and hardware device ships with intrinsic flaws - flaws that, if critical enough, attackers can exploit from anywhere in the world. It's crucial that defenders take stock of what areas of the tech stack have the most emerging, and critical, vulnerabilities they must manage. It's not just zero day vulnerabilities. Consider that CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilitlies in widely used applications that are "actively exploited," and most of them are flaws that were discovered several years ago and have been fixed. There are also emerging vulnerabilities in 5G networks, cloud infrastructure, Edge applications, and firmwares to consider.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2023-1172
PUBLISHED: 2023-03-17
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...
CVE-2023-1469
PUBLISHED: 2023-03-17
The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions up to, and including, 2.2.8 due to insufficient input sanitization and output escaping. This makes it possible for authenti...
CVE-2023-1466
PUBLISHED: 2023-03-17
A vulnerability was found in SourceCodester Student Study Center Desk Management System 1.0. It has been rated as critical. This issue affects the function view_student of the file admin/?page=students/view_student. The manipulation of the argument id with the input 3' AND (SELECT 2100 FROM (SELECT(...
CVE-2023-1467
PUBLISHED: 2023-03-17
A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt le...
CVE-2023-1468
PUBLISHED: 2023-03-17
A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=reports&date_from=2023-02-17&date_to=2023-03-17 of the component Report Handler. The manipula...