Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

5/25/2017
11:50 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

You Have One Year to Make GDPR Your Biggest Security Victory Ever

The EU's new razor-toothed data privacy law could either rip you apart or help you create the best security program you've ever had. Here's how.

Set new processes and policies and ways to enforce them.

Decide whether or not you're going to set different policies for EU citizen data or apply those standards to all data. "That presumes that you know the difference between EU citizens and others," Vecci points out. Before you can decide whether to segregate that data or secure it differently, you must first set processes and technologies for properly classifying it, he says.

Data collection and consent. What can you avoid collecting altogether? What can you do to make consent for data collection as user-friendly and low-friction as possible, while also making sure that it's very clear what is being collected and how it will be used?  

Data storage. Should you consider separate storage on EU-based servers, to make some of the Article 46 rules on data transfer easier to follow?

Data retention/destruction. The Blancco study found that only basic deletion was used by 28% of IT pros in the US, and free data wiping solutions by 25%.

Get your developers on board. Secure development practices, encryption, pseudonymization, identity, vulnerability assessments, and proper security testing are, to varying degrees, mandated or encouraged by GDPR. The data protection by design and by default rule means that bolted-on application security isn't enough anymore.

Revisit procurement procedures and third-party contracts. According to Gartner analysts, "Outside parties must also comply with relevant requirements that can impact supply, change management and procurement processes."

Prepare for breach response and complaint response: You will need to have a system for receiving and responding to complaints. According to Gartner analysts, "If a business is not yet prepared to adequately handle data breach incidents and subjects exercising their rights, now is the time to start implementing additional controls."

Get that extra budget.

Here are some things to tell your board of directors and CFO when you need extra money for this effort.

GDPR would have cost Tesco Bank billions. Had GDPR been in place when Tesco Bank was breached and hit with a heist in November 2016, they might have been liable to fines of up to £1.9 billion ($2.46 billion USD) for its November 2016 breach. Cybercriminals lifted roughly £2.5 million from 9,000 of Tesco's customers, but the breach could have cost the bank far, far more than that.

The GDPR requires data controllers have adequate security protections in place, and a violation of that rule could have cost the bank up to 4 percent of its sizeable annual turnover. Seventy-five percent of the people surveyed in the Varonis study said that the fines imposed as a result of breaching the regulation could "cripple" some organizations.

Fines aren't the only punishment. As Ilias Chantzos, Symantec's senior director of global government affairs and cybersecurity policy wrote May 12: “Data Protection Authorities have many more arrows in their quiver that may prove even more problematic than the fines. Decisions by [data protection authorities] such as ban of processing of certain categories of data or suspension of data flows can kill complete business models." He also mentions that there are no caps on liability and law suits.  

Don't assume the laws won't be enforced. Not only can nations' data protection authorities take action against violators, but individual European citizens can. Individuals have already had major legal victories against giant companies over privacy, the quintessential case being Austrian Max Schrems' complaints about Facebook's data transfers.

Individuals are now further empowered by GDPR, and any violations, particularly in the form of data breaches, could draw more attention and class action suits than US companies might expect from Americans. 

Just keep things secure.

"GDPR is not that onerous when you think about it," Vecci notes.

Knowing what and where your data is, being able to change it or destroy it, making sure that only the people who should have access to it do, and keeping it secure are really just common sense controls that organizations already apply to other assets, he says.

"We would never have a bank account with no protections around it ... but we treat data that way," he says. 

GDPR is a way of codifying this data security and gives CISOs more leverage to do it. It also broadens the definition of "private data," which means that more systems and data will need protections; something that Vecci says was necessary already. 

"Meeting the regulations really just means doing the basics."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/4/2017 | 9:08:57 AM
Re: What Authority Does a Foreign Entity Have on a Sovereign Nation?
@Dr.T: It's more about the businesses -- who subject themselves to that jurisdiction by reaching out to do business there -- than it is about the government of the US.

(And, besides, that's what treaties are for.)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
6/4/2017 | 9:07:41 AM
Re: What Authority Does a Foreign Entity Have on a Sovereign Nation?
@geriatric: I've not 100% made my way through GDPR yet, but it's unlikely so simple.

Realistically, regulators go affter the big targets and the targets that are most egregious. Realistically speaking, almost nobody cares about lone eBay seller who hasn't dotted his i's.

(*NOT LEGAL ADVICE.)
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2017 | 4:41:21 PM
Re: Going on different directions
It's a bigger political issue in Europe -- where people are still old enough to remember oppressive Communist regimes spying on citizens in a pre-digital era.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
5/30/2017 | 4:36:35 PM
Re: HIPAA
@Dr. T: You would think, but it's not quite so simple (not that HIPAA is "simple") -- especially because fo the relative fungibility of EU privacy rules/regs/laws.  Privacy Shield and GDPR could very well be gone in five years time in favor of another period of BCR-mitigated chaos followed by yet a new rubric.
geriatric
50%
50%
geriatric,
User Rank: Moderator
5/30/2017 | 6:43:51 AM
Re: What Authority Does a Foreign Entity Have on a Sovereign Nation?
@Pablo Valerio - while I certainly agree that any corporation with a physical presence would be subject to the reg, I'm not at all convinced that the EU's authority would extend to an American citizen with an eBay storefront who sells a t-shirt to someone living in France, or even to a small U.S. community bank whose database contains the address of an ex-pat living in Germany. So it all comes down to what 'doing business' means.
Pablo Valerio
50%
50%
Pablo Valerio,
User Rank: Strategist
5/29/2017 | 3:19:15 PM
Re: What Authority Does a Foreign Entity Have on a Sovereign Nation?
@geriatric... actally it doesn't, except if a company does business in Europe. In that case they have all the authority.

If a company such as Facebook wants to quit the European market, and delete all the data they have on EU citizens, then they don't have to worry about GDPR.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/29/2017 | 2:59:43 PM
GDPR
GDPR Is just a start I would say, all other countries will most likely have their own version of regulations to provide privacy to their citizens.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/29/2017 | 2:55:00 PM
Re: DPO and "costl[iness]"
"When it comes to compliance and risk management, you get what you pay for." Agree. It requires lot of effort, time and money.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/29/2017 | 2:53:43 PM
Re: What Authority Does a Foreign Entity Have on a Sovereign Nation?
"Why would the United States agree to comply with a foreign regulation?" No but mos likely you have branch in there or customers, then you are part of the regulation.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
5/29/2017 | 2:52:11 PM
Re: Going on different directions
"Looks to me that the EU and the US are going on opposite drections" Good point. We are making it political in here US.
Page 1 / 2   >   >>
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16680
PUBLISHED: 2019-09-21
An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.
CVE-2019-16681
PUBLISHED: 2019-09-21
The Traveloka application 3.14.0 for Android exports com.traveloka.android.activity.common.WebViewActivity, leading to file disclosure and XSS.
CVE-2019-16677
PUBLISHED: 2019-09-21
An issue was discovered in idreamsoft iCMS V7.0. admincp.php?app=members&do=del allows CSRF.
CVE-2019-16678
PUBLISHED: 2019-09-21
admin/urlrule/add.html in YzmCMS 5.3 allows CSRF with a resultant denial of service by adding a superseding route.
CVE-2019-16679
PUBLISHED: 2019-09-21
Gila CMS before 1.11.1 allows admin/fm/?f=../ directory traversal, leading to Local File Inclusion.