NC1707

OPINION
THE RISK OF LIBERATED DATA
AS ORGANISATIONS ADVANCE THEIR DIGITAL
TRANSFORMATION NEW SECURITY GAPS WILL APPEAR, AND AS
JON FIELDING, MANAGING DIRECTOR AT APRICORN EMEA
POINTS OUT, THIS INCREASES THE RISK OF A HIGHLY
DAMAGING AND COSTLY BREACH
With reports that nearly half of all
UK businesses suffered at least
one cybersecurity breach or
attack in the past 12 months, what should
be done to reduce this? The answer lies in
a multi-layered approach that combines
people, process and technology.
UBIQUITOUS THREATS
Digital transformation creates many new
risks. Cloud and mobile platforms extend
the traditional network perimeter, but all
too often the safeguards for data stored in
these environments either don't exist or
are inadequate.
Because smartphones, tablets, USB drives
and laptops provide huge storage capacity, it
is easy for remote workers to carry immense
volumes of corporate data with them - but is it
secure? The most recent Home Office figures
say that there were 538,000 victims of mobile
phone theft in the UK, and Apricorn research
has revealed that 29 per cent of organisations
suffered a data breach as a direct
consequence of employee mobility.
This employee risk is amplified for many
organisations by the often complex networks
of partners and suppliers they interact with.
These relationships carry their own risk,
especially if these partners are not audited or
covered by a robust cybersecurity policy.
COST OF BREACH
The need to get data security under control
has become even more urgent with the
planned introduction of the European General
Data Protection Regulatoin (GDPR), which
comes into force in May 2018. This sweeping
new EU legislation mandates that firms must
notify regulators within 72 hours of a breach.
Additionally, those found not to have taken
adequate steps to secure customer data could
face a maximum fine of 4 per cent of global
annual turnover or 20m euros (£17m),
whichever is higher. Even post-Brexit, UK firms
will be forced to comply with these rules.
NCC Group research revealed that ICO
fines last year would have risen 79 times to
roughly £69m if the GDPR had applied.
MOVING FORWARD
There is no silver bullet but best practice will
help. Start with a comprehensive data audit,
mapping what your organisation stores and
processes, where it flows, who has access to
it and how it's controlled. It would be a
good idea to minimise your risk exposure by
ceasing to collect, and securely deleting,
any data that the audit determines not
relevant to the business.
Next, create, document and enforce a
watertight data security policy covering every
aspect of the business. Don't forget BYOD
devices and home offices, because some
Government reports claim that only 25 per
cent of firms currently cover this vulnerable
area with policy. This must change by
consistently enforcing security policies across
all mobile devices, including removable media.
Strong encryption is also essential and it is
mentioned explicitly in Article 32 of the
GDPR. IT should approve specific
encryption-protected storage devices and
then enforce their use through whitelists at
the endpoint, blocking those not approved.
It's important not to forget the people
aspect in all of this. A well thought out
education and awareness programme will
ensure that employees form a strong first
line of defence against cyber risk and
understand why certain policies are
necessary. Ensure temporary employees
are also included and provide refresher
courses annually.
What's much harder to change is
organisational culture. This really needs to
come from the top down and certainly the
prospect of huge fines that can be levied
because of GDPR should begin to make
data security a board-level issue. The
appointment of Data Protection Officers - a
GDPR requirement for most mid-to-large
sized firms - will also help by creating a
semi-autonomous champion for data
protection inside the organisation. Creating
this new function should be a priority.
Breaches may be inevitable, but a few
simple measures can make your
organisation more secure, more compliant
and ultimately, more competitive. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards
JULY/AUGUST 2017 NETWORKcomputing 21