GDPR Report – GDPR Summit London: Should you be worried about a data breach?

gdprreport-logogReports of business data breaches have unfortunately become commonplace. This week, the corporate finance giant Deloitte has suffered a cyber-attack that compromised confidential data, including the private emails of some of its clients.

More than ever, businesses need to ensure their data is protected from outside threats. Jason Hart, CTO of Data Protection at Gemalto said about the news of the Deloitte breach:

“Today’s announcement that Deloitte was hacked is not a surprise. Breaches will – and ARE continuing to happen—to expect otherwise would be unrealistic. As an industry, we need to truly know our surroundings, meaning knowing exactly where data resides, who has access to it, how it is transferred, when it is encrypted/decrypted – really the entire supply change of digital users and the data. Of the 1.9 billion data records compromised worldwide in the first half of 2017, less than 1% used encryption to render the information useless.

“We need a data-centric view of threats means using better identity and access control techniques, multi-factor authentication and encryption and key management to secure sensitive data. This is, even more, pressing with new and updated government mandates like the 2015 Digital Privacy Act in Canada, the GDPR in Europe, as well as U.S state-based and APAC country-based breach disclosure laws.”

To read the full article click here. 

Oct. 4th 2017 – IPEXPO Europe – GDPR Blueprint; Tackling Confidentially, Integrity and Availability of Data

ipe17-logo-pngThe new EU regulation of the Privacy world (the GDPR) is rapidly approaching.  Jason Hart will reveal a back to basics approach in relation to GDPR. Specifically, we will identify a GDPR blueprint that tackles the privacy concerns around confidentiality, integrity and availability of sensitive data.

October 4th, 2017. Session time: 14:30-14:50

 

For more info. and to access to the seminar planner, click here.

CyberSecurity Insiders – 6 steps to prepare for post Brexit GDPR compliance

cyber-insider-logo[ This article was originally published here ]

With new data protection laws on the way, UK businesses have run out of excuses, writes Jason Hart, CTO, Gemalto

Ever since the vote to leave the EU last year, it’s been unclear how much, if any, of the incoming GDPR legislation would be applied in the UK. Thankfully, the government has taken this on board, and today revealed plans to improve our current data protection legislation.

This updated law aims to:

  1. Transfer the European Union’s current General Data Protection Regulation into UK law
  2. Grant the UK’s data protection watchdog new powers to levy bigger fines on firms that break laws
  3. Give UK citizens more control over what happens to their personal information, such as asking for personal data posted when they were children to be deleted

This overhaul of UK data protection law is a big step towards updating the country’s approach to cybersecurity. By putting control of their personal data back in the hands of consumers, the pressure is on for businesses to ensure they are adhering to data protection laws. Those that don’t risk losing consumer trust.

Incorporating the incoming GDPR legislation into UK law is an important step, as it will dispel any uncertainty businesses had around its fate post-Brexit. With the deadline for compliance fast approaching, there is now no reason for UK businesses not to be moving towards meeting these data protection laws.

Six steps every business should undertake ahead of GDPR
While it’s all well and good talking about compliance, it’s another thing entirely to understand the steps a business must take to work towards it. So, what does a business need to do, to ensure it’s protecting the data it holds? Below are six steps every business should undertake on its journey towards GDPR compliance.

Step one – Get to grips with GDPR’s legal framework
The first step that any business needs to take is to understand how each aspect of the legislation apply to them. By conducting a full audit against the GDPR legal framework, a business will need to understand what it needs to do and what the consequences for failing to do so are. As part of this compliance audit, a business should hire a Data Protection Officer (DPO), who will be responsible for ensuring the company adheres to the regulations. Ideally, a DPO would have a background in both law and technology, so they’re able to understand both the technical specifications and the regulatory framework needed to meet this. Every organisation is different, and so no GDPR journey will look the same – correct guidance from business leaders to employees is needed ensure the whole company understands how to be compliant.

Step two – Create a Data Register
Once a business understands the steps they need to take, it’s important that they keep a record of the process. This is best done with a Data Register – essentially a GDPR diary. The Data Protection Association (DPA) of each country will enforce GDPR, and be responsible for judging if a business is compliant when determining any penalties for being breached. In this event, the Data Register will be a crucial tool for demonstrating the progress the affected business has made in becoming compliant. If they have no proof, the DPA would be able to fine between 2% and 4% of the company’s turnover. The amount and speed of the DPA’s decision would depend on the sensitivity of the data.

Step three – Classify data
While understanding what protections, if any, are already in place is important, this step focuses on helping businesses understand what data they need to protect and how that is being done. First, a business must locate any Personal Identifiable Information – information that can directly or indirectly identify someone – of EU citizens. It’s crucial to know where this is stored, who can access it, who it has been shared with etc. It can then determine which data is more vital to protect. In addition to this, it’s important to know who is responsible for controlling and processing the data, and making sure all the correct contracts are in place.

Step four – Identify the top priorities 
Next, a business needs to evaluate how that classified data is being produced and protected. Regardless of how data is collected, the first priority should always be to protect the user’s privacy. Businesses should ask themselves if they need the sensitive data they have collected – this data is worth a lot to a hacker, and has the greatest risk of being stolen. Businesses should complete a Privacy Impact Assessment and Data Protection Impact Assessment of all security policies. When doing this, it’s important to keep the rights of EU citizens in mind, including restrictions of processing and data portability. In particular, any data third parties use to identify someone must be deleted if requested by that individual and approved by the EU. It’s crucial that all this data is correctly and promptly destroyed and can’t be accessed. This process is known as the “right to be forgotten”.

Evaluating how the business protects this data comes next (for example, with encryption, tokenisation or psuedonymisation). The evaluation must explore: any historical data, the data being produced and any data that is backed up – either on-site or in the cloud. This data must be anonymised to protect the privacy and identities of the citizens it relates to. All data needs to be protected from the day it is generated to the day it is not needed.

Step five – Document and assess any additional risks and processes 
Of course, there’s more to compliance than just protecting the most sensitive data – the next stage of the process is to assess and document any other risks, to discover any other processes or areas that might be vulnerable. While doing this, the business should update its Data Register, to show the DPA how they are addressing any existing risks. Only by doing this can a business demonstrate to the DPA that it is treating compliance and data protection seriously and with respect.

Step six – Revisit and repeat
Finally, the last step on the compliance journey focuses on revisiting the outcome of the previous steps and remediating any potential consequences, tweaking and updating where necessary. Once this is complete, businesses should evaluate their next priorities and repeat the process from step four.

The basis of this new data protection bill and GDPR is to push businesses into action and start putting security at the top of the agenda. When next May comes around, businesses won’t be able to hide anymore. It’s vital to start making the preparations for compliance now, before it’s too late. It’s not a case of if, but when, a breach occurs and that revelation could cause serious damage to their reputation. Not only this, but businesses will also face severe fines. With just a year to go, there are no longer any excuses for businesses when it comes to protecting their customers data.

What can you do to prepare for the emerging GDPR requirements? Read Preparing for the General Data Protection Regulation.

6 steps to prepare for post Brexit GDPR compliance

Ever since the vote to leave Are you ready for GDPR? the EU last year, it’s been unclear how much, if any, of the incoming GDPR legislation would be applied in the UK. Thankfully, the government has taken this on board, and today revealed plans to improve our current data protection legislation.

This updated law aims to:

  1. Transfer the European Union’s current General Data Protection Regulation into UK law
  2. Grant the UK’s data protection watchdog new powers to levy bigger fines on firms that break laws
  3. Give UK citizens more control over what happens to their personal information, such as asking for personal data posted when they were children to be deleted

This overhaul of UK data protection law is a big step towards updating the country’s approach to cybersecurity. By putting control of their personal data back in the hands of consumers, the pressure is on for businesses to ensure they are adhering to data protection laws. Those that don’t risk losing consumer trust.

Incorporating the incoming GDPR legislation into UK law is an important step, as it will dispel any uncertainty businesses had around its fate post-Brexit. With the deadline for compliance fast approaching, there is now no reason for UK businesses not to be moving towards meeting these data protection laws.

Six steps every business should undertake ahead of GDPR
While it’s all well and good talking about compliance, it’s another thing entirely to understand the steps a business must take to work towards it. So, what does a business need to do, to ensure it’s protecting the data it holds? Below are six steps every business should undertake on its journey towards GDPR compliance.

Step one – Get to grips with GDPR’s legal framework
The first step that any business needs to take is to understand how each aspect of the legislation apply to them. By conducting a full audit against the GDPR legal framework, a business will need to understand what it needs to do and what the consequences for failing to do so are. As part of this compliance audit, a business should hire a Data Protection Officer (DPO), who will be responsible for ensuring the company adheres to the regulations. Ideally, a DPO would have a background in both law and technology, so they’re able to understand both the technical specifications and the regulatory framework needed to meet this. Every organisation is different, and so no GDPR journey will look the same – correct guidance from business leaders to employees is needed ensure the whole company understands how to be compliant.

Step two – Create a Data Register
Once a business understands the steps they need to take, it’s important that they keep a record of the process. This is best done with a Data Register – essentially a GDPR diary. The Data Protection Association (DPA) of each country will enforce GDPR, and be responsible for judging if a business is compliant when determining any penalties for being breached. In this event, the Data Register will be a crucial tool for demonstrating the progress the affected business has made in becoming compliant. If they have no proof, the DPA would be able to fine between 2% and 4% of the company’s turnover. The amount and speed of the DPA’s decision would depend on the sensitivity of the data.

Step three – Classify data
While understanding what protections, if any, are already in place is important, this step focuses on helping businesses understand what data they need to protect and how that is being done. First, a business must locate any Personal Identifiable Information – information that can directly or indirectly identify someone – of EU citizens. It’s crucial to know where this is stored, who can access it, who it has been shared with etc. It can then determine which data is more vital to protect. In addition to this, it’s important to know who is responsible for controlling and processing the data, and making sure all the correct contracts are in place.

Step four – Identify the top priorities 
Next, a business needs to evaluate how that classified data is being produced and protected. Regardless of how data is collected, the first priority should always be to protect the user’s privacy. Businesses should ask themselves if they need the sensitive data they have collected – this data is worth a lot to a hacker, and has the greatest risk of being stolen. Businesses should complete a Privacy Impact Assessment and Data Protection Impact Assessment of all security policies. When doing this, it’s important to keep the rights of EU citizens in mind, including restrictions of processing and data portability. In particular, any data third parties use to identify someone must be deleted if requested by that individual and approved by the EU. It’s crucial that all this data is correctly and promptly destroyed and can’t be accessed. This process is known as the “right to be forgotten”.

Evaluating how the business protects this data comes next (for example, with encryption, tokenisation or psuedonymisation). The evaluation must explore: any historical data, the data being produced and any data that is backed up – either on-site or in the cloud. This data must be anonymised to protect the privacy and identities of the citizens it relates to. All data needs to be protected from the day it is generated to the day it is not needed.

Step five – Document and assess any additional risks and processes 
Of course, there’s more to compliance than just protecting the most sensitive data – the next stage of the process is to assess and document any other risks, to discover any other processes or areas that might be vulnerable. While doing this, the business should update its Data Register, to show the DPA how they are addressing any existing risks. Only by doing this can a business demonstrate to the DPA that it is treating compliance and data protection seriously and with respect.

Step six – Revisit and repeat
Finally, the last step on the compliance journey focuses on revisiting the outcome of the previous steps and remediating any potential consequences, tweaking and updating where necessary. Once this is complete, businesses should evaluate their next priorities and repeat the process from step four.

The basis of this new data protection bill and GDPR is to push businesses into action and start putting security at the top of the agenda. When next May comes around, businesses won’t be able to hide anymore. It’s vital to start making the preparations for compliance now, before it’s too late. It’s not a case of if, but when, a breach occurs and that revelation could cause serious damage to their reputation. Not only this, but businesses will also face severe fines. With just a year to go, there are no longer any excuses for businesses when it comes to protecting their customers data.

What can you do to prepare for the emerging GDPR requirements? Read Preparing for the General Data Protection Regulation.

eWEEK – Enterprises Overconfident About Perimeter Security, Gemalto Finds

logo_eweekThe 2017 Data Security Confidence Index Report reveals gaps between organizations’ perceptions of what keeps them secure and what actually works.

“One of the things that continues to show up every year, and I would have expected it to change, is the investment and perception of perimeter security versus the reality of its effectiveness,” Jason Hart, vice president and chief technology officer for data protection at Gemalto, told eWEEK. “As security professionals, I find it interesting we can know something doesn’t work but are willing to do it for the perceived security value.”

Hart added that sometimes a perceived sense of security is the motivation for unwarranted investments in perimeter security. He noted that Gemalto’s report found that only 8 percent of organizations encrypt data, which actually is a more effective security mechanism because it reduces the value of data if it’s stolen.

To read the full article click here.

SC Media – Research: businesses over confident about ability to fend off hackers

scmediaCombining the prioritisation of perimeter security and lack of knowledge in data security, according to Gemalto, is brewing an environment where businesses will soon lack the ability to fend off complex cyber-attacks.

“It is clear that there is a divide between organisations’ perceptions of the effectiveness of perimeter security and the reality,” said Jason Hart, vice president and chief technology officer for Data Protection at Gemalto.

“By believing that their data is already secure, businesses are failing to prioritise the measures necessary to protect their data. Businesses need to be aware that hackers are after a company’s most valuable asset – data. It’s important to focus on protecting this resource, otherwise, reality will inevitably bite those that fail to do so.”

To read the full article click here.

freshbusinessthinking.com – Businesses overly confident about keeping hackers at bay

fbt-new-logoDespite the increasing number of data breaches and nearly 1.4 billion data records being lost or stolen in 2016,  the vast majority of IT professionals still believe perimeter security is effective at keeping unauthorised users out of their networks.

“It is clear that there is a divide between organisations’ perceptions of the effectiveness of perimeter security and the reality,” said Jason Hart, Vice President and Chief Technology Officer for Data Protection at Gemalto. “By believing that their data is already secure, businesses are failing to prioritise the measures necessary to protect their data. Businesses need to be aware that hackers are after a company’s most valuable asset – data. It’s important to focus on protecting this resource, otherwise reality will inevitably bite those that fail to do so.”

Hart continues, “Investing in cybersecurity has clearly become more of a focus for businesses in the last 12 months. However, what is of concern is that so few are adequately securing the most vulnerable and crucial data they hold, or even understand where it is stored. This is standing in the way of GDPR compliance, and before long the businesses that don’t improve their cybersecurity will face severe legal, financial and reputational consequences.”

To read the full article click here.

LandMobile – Gemalto Research: Businesses Confident About Keeping Hackers Out, Less So On Data Security

landmobileCompanies are underinvesting in the technology needed to protect themselves from cyber security threats, according to Gemalto’s fourth annual Data Security Confidence Index, released today (11 July).

“It is clear that there is a divide between organizations’ perceptions of the effectiveness of perimeter security and the reality,” said Jason Hart, vice president and chief technology officer for data protection at Gemalto. “By believing that their data is already secure, businesses are failing to prioritize the measures necessary to protect their data. Businesses need to be aware that hackers are after a company’s most valuable asset – data. It’s important to focus on protecting this resource, otherwise reality will inevitably bite those that fail to do so.”

….

Hart continues, “Investing in cybersecurity has clearly become more of a focus for businesses in the last 12 months. However, what is of concern is that so few are adequately securing the most vulnerable and crucial data they hold, or even understand where it is stored. This is standing in the way of GDPR compliance, and before long the businesses that don’t improve their cybersecurity will face severe legal, financial and reputational consequences.”

To read the full article click here.

ITPro Portal – Perimeter security ineffective and a waste of money, research shows

itproportalGemalto says businesses are investing heavily in extra security solutions, but still feel they could be breached.

“It is clear that there is a divide between organisations’ perceptions of the effectiveness of perimeter security and the reality,” said Jason Hart, vice president and chief technology officer for data protection at Gemalto.

“By believing that their data is already secure, businesses are failing to prioritise the measures necessary to protect their data. Businesses need to be aware that hackers are after a company’s most valuable asset – data. It’s important to focus on protecting this resource, otherwise reality will inevitably bite those that fail to do so.”

To read the full article click here.

Help Net Security – Businesses overconfident about keeping attackers at bay

helpnetDespite the increasing number of data breaches and nearly 1.4 billion data records being lost or stolen in 2016, the vast majority of IT professionals still believe perimeter security is effective at keeping unauthorized users out of their networks. However, companies are under investing in technology that adequately protects their business, according to Gemalto.

“It is clear that there is a divide between organizations’ perceptions of the effectiveness of perimeter security and the reality,” said Jason Hart, VP and CTO for Data Protection at Gemalto. “By believing that their data is already secure, businesses are failing to prioritize the measures necessary to protect their data. Businesses need to be aware that hackers are after a company’s most valuable asset – data. It’s important to focus on protecting this resource, otherwise reality will inevitably bite those that fail to do so.”

Hart continues, “Investing in cybersecurity has clearly become more of a focus for businesses in the last 12 months. However, what is of concern is that so few are adequately securing the most vulnerable and crucial data they hold, or even understand where it is stored. This is standing in the way of GDPR compliance, and before long the businesses that don’t improve their cybersecurity will face severe legal, financial and reputational consequences.”

To read the full article click here.