Monthly Archives: October 2017

Data Protection, GDPR

GDPR – How do we go about it ?

Think I’m on a roll, this is my 5th GDPR themed post.

Here’s a more practical article that’ll help you towards alignment with GDPR.

 

Content for this web log.

  1. Essentials for success.
  2. Information Security Management Systems
  3. What to do with old or archived PII

Essentials for GDPR Success

Educate

The C suite, the board and your employees must be made aware of the organisation’s obligations and their obligations.

Design

Ensure that your on-boarding, training, strategy, policy and procedures take into account the data protection demands of GDPR.

Accountability

Be clear on who is accountable for the data you hold and process. That you can prove that PII is correctly collected, processed, used and treated for the whole Data Life Cycle.

Red Herrings and dead-ends

GDPR is not a technology problem

You can not solve with tools alone, though they may make life easier for some tasks.
Don’t make the mistake of assigning the whole task of GDPR compliance to IT.
IT apply the controls, they’ll tell you where your data is and where it’s going.
It is not solely an InfoSec problem either, though it plays a significant role.
GDPR belongs right at the top, with the head honcho.
The CEO no less.

 

A significant structure like GDPR, isn’t self-supporting, it relies on good information security and well implemented  information technology.

(Unless you totally paper based and you don’t use any IT systems, for processing of PII, but information security part still applies)

Unfortunately unless your process and IT maturity is realistically rated as managed or above, there is work and improvement required on the underlying technology, so that it is properly designed and operated too.

For this, a good route to take is an already established information security management system (ISMS) such as ISO27001.

Isn’t it a monster ? We can’t afford it ? It’s too disruptive!

I hear you say. No, it is designed as a framework, it is scalable. Not all of it will apply to your organisation. You don’t have to go for accreditation immediately, but it’s extra kudos if you do, something to aim for in continual improvement.

Be clear I’m not saying ISO27001, COBIT, Cyber Essentials  etc  are  mandatory. You may be doing your own thing which is just as good or better. Although it is another level of control you may need to prove and justify.

Prioritise and Segment

Determine where your data or operations impact on the data subjects most. Deal with that first.

Old / Archived PII

Do you need to keep it for legal or regulatory reasons ?
Is there a clear and lawful reason for you to retain this information ?Do you have explicit consent to use the PII for your intended use ?

No ? delete it (properly).

If you want to keep it or re-purpose it, strip out the PII elements, so that you end up with anonymised data.

Otherwise anonymise it

Proportionality

You are not expected to spend a dis-proportionate of effort to achieve 100% data sanitisation. If the archives are properly secured it doesn’t mean you have to pull out every archive since year dot to scan for PII.

However, if it is recalled for any reason, you’ll need to ensure that the data on there is properly treated by removing the PII where necessary, for example removing people who have requested the right to be forgotten.

See Articles 35, 36 and 83 and Recitals 84, 89-96

Any other business ?

There will be more follow-ons from this one that’ll build upon what’s been said above. Examples of other things you should know and should be doing are :

  • What do you have in your software estate ? Shadow IT has the means of scuppering your GDPR efforts. Seek out the old MS Access databases ….
  • Vulnerability management
  • What does your network look like ?
  • How does your data flow ?
  • Are all those rules necessary on your firewall ?
  • When was the last time the firewall rules were audited ?
  • Can you show why that rule is in place and trace it back to the change request and associated approval ….?

Plenty to mull over and discuss, but that’s enough for today.

cybersecurity, Data Loss, Hacked, Information Security

The value of patching, The cost of not patching

(One) Major cause of data breaches

Over 50% of data breaches are due to published exploits where fixes or patches are available.

The actual percentage varies to which study you refer to. The vulnerabilities may be through the OS, platforms like Java and Flash or applications.

Secure Configuration is essential, one such aspect is patching. Making sure that you’ve employed the most up-to-date software.

The reality is that many organisations do not adequately patch their software and hardware. For many it is an onerous task. They may be worried about introducing issues to their production services or it may be the lack of resources.

The risk is real, whether it is risk to production from using different (updated) software or from crackers exploiting vulnerabilities.

Regression and user-acceptance testing is essential here. There are other mitigation schemes where a staged patching is adopted, where a proportion of servers or instances of the software is patched and then used in production. It could be a test or development units.

I’ve just talked about the value and reasons for patching.

The other considerations are the cost of not patching.

There are many examples, but I’ll just share a couple with you.

Talktalk looses data

Talktalk, a communications company in the UK mobile telephone, TV and broadband market. They lost 157000 customer details in 2015. The vulnerability was on a website that had not been patched for 3.5 years. In the aftermath they lost of more than 150000 customers. Their share price dropped 30%.

Promotions and incentives cost them 35M GBP. Their 2016 profits dropped by 56%. They were also fined 400000 GBP by the ICO. Under GDPR the fine imposed could’ve been more than 70M GBP.

Equifax looses even more data

Moving to a more recent data breach, Equifax. They provide credit scoring services to the public and businesses. Many financial organisations use them to assess the credit-worthiness of individuals and companies.

They hold data on more than 820 million individuals and 91 million businesses.

In 2017, they lost the details of which 145 million people in the USA, at least 400000 in the UK and 100000 in Canada.

Heads Roll

Within Equifax, the chief information officer Susan Mauldin and chief security officer David Webb were retiring and within two weeks Richard Smith, the CEO said he was stepping down after having to explain the breach to a US Congress committee in October.

The market is not impressed

Their share price was trading around 140 USD, then plunged to a low of 94 USD a few days after the disclosure, which is comparable to Talktalk’s share price drop.

The actual financial impact to Equifax is unknown at this time, as it’s still so recent.

The breach was likely to be from a vulnerability that had been publicised and known for months and not mitigated.

The fallout from this incident is yet to settle. There are likely to be class action law suits in the USA and Canada. The respective regulators are likely to be sifting through the post mortem reports and deciding on what punitive measures to take.

Further reading and references