CS1705

IT asset management
"Organisations haven't taken privacy and cyber
security seriously enough until now."
be met, every organisation, regardless of
location, should create an asset register of
sensitive files, understand who has access and
who is accessing them, and determine when
data can and should be deleted."
ADAPTING PRACTICES
Clearly, companies must look to adapt their
practices ahead of schedule, given the
complexity and scope of the new regulation.
"While it is billed as European legislation, the
nature of networks and the digital economy
imply that it will be far more wide-reaching
than that," comments John Madelin, CEO at
Reliance acsn.
"Organisations must take a holistic approach
to privacy and security, with their most
sensitive information at the heart of it, in
order to adhere to the stringent guidelines
more easily, as well as manage its downfalls.
"Businesses haven't taken privacy and cyber
security seriously enough until now, and these
higher levels of 'parental controls' will help
security experts hold business leaders up to
board level more accountable. Perhaps the
most significant change is in notification.
"In the past, a company only had a problem,
if there was a breach," says Madelin. "The
new legislation will require companies to
demonstrate that they will detect and report
a breach. Companies will have to invest in
creating 24/7 alarming and reporting
capabilities, integrated with their security
infrastructure, which will allow them to
adequately understand where the data is and
protect it. At the moment, the majority of
systems deployed are not fit for purpose."
MASSIVE UNDERTAKING
Preparing for GDPR is likely to be a crossfunctional
exercise, as legal, risk and
compliance, IT and security all have a part to
play in its implementation. "As it is not a small
amount of regulation to comprehend, with
99 Articles and 173 Recitals to trawl through,
there will be numerous processes, procedures,
and training required, in addition to the need
for technology and services, in order to
demonstrate compliance," states Samantha
Humphries, international solutions marketing
manager at Rapid7.
"For some organisations, changes to roles
and responsibilities will be required, too, such
as appointing a data protection officer and
nominating representatives within the EU to
be necessary points of contact. Completing
Privacy Impact Assessments and
implementing processes for access control,
incident detection and response, and breach
notification will all be crucial in ensuring
compliance. By introducing such processes,
businesses can show that they understand
where personal data physically resides, the
categories of personal data they control
and/or process, how and by whom it is
accessed, and how it is secured," she adds.
Disaster recovery should also be high on any
organisation's list. "Being able to detect
attackers early can ease this process. User
Behaviour Analytics can provide businesses
with the capabilities to detect anomalous user
account activity within their environment, so
they can investigate and remediate quickly."
Recognising weak spots in systems and
networks can also help businesses find focus.
"By attacking their own systems through pen
tests to demonstrate real-world scenarios,
businesses can highlight potential failures and
weaknesses that can be rectified to avoid the
threat of a real attack," Humphries concludes.
"This will aid compliance with Article 32,
which states the need to have a process for
regularly testing, assessing and evaluating the
effectiveness of security measures."
Richard Brown, Arbor Networks:
documentation is often created, 'put on
the shelf' and then forgotten about.
Rob Norris, Fujitsu: now is the time to
stop being hunted and instead become
the hunter.
www.computingsecurity.co.uk @CSMagAndAwards May/June 2017 computing security
25