CS1907

GDPR
clearly means business." Interestingly, these
firms' attacks were by no means the largest, in
terms of numbers for 2018. "This could, in
fact, be the tip of the iceberg of what is to
come," he warns, "but let's hope others are
taking copious amounts of notes as to how to
handle a breach or, better still, evade the
attacks as best they can in the first place."
ENSURING CONSENT
As Rob Allen, director marketing & technical
services at Kingston Technology Europe, rightly
points out, the only noticeable effect of the
EU's General Data Protection Regulation
(GDPR) legislation for most people has been
having to click through tedious popups about
data sharing and cookies on just about every
website. "There's a good reason why they're
appearing," he says.
"One aspect of GDPR is that it compels
organisations to notify users about how their
personal data is handled, which very much
includes all the information that modern web
browsers hoover up. Consent is required for
that data to be shared externally, and all
possible technical measures must be otherwise
taken to safeguard personal information
stored on the organisation's network - or
there's the potential for extremely strong
financial penalties."
So, the news that British Airways was hit by
a potential £183 million fine by the ICO
comes as a sharp reminder that GDPR will be
enforced and failure to comply does have
consequences. "So far, this is the largest GDPR
fine that a UK company has faced. But
although the fine is bad news for BA,
the managers and bosses of other UK
organisations that have been scrambling to
meet the requirements of the legislation may
breathe a little easier, knowing that the time,
effort and cost they have invested into data
security has been done for a good reason," he
states. "And, let's face it, before the changes to
GDPR, many of us had acquired some dreadful
habits when it came to handling data, and
tightening things up wasn't exactly a priority
for many firms."
If you're not paying attention, it's all too easy
for data to end up in the wrong hands,
perhaps because a device is lost or a third
party gets unrestricted access to it, Allen
adds. "Any improvement requires both
organisational and technical changes to keep
data secure. Improving company mindset by
educating a workforce, better information
management and risk management play as
much of a part in secure handling of data as
technological solutions. Ultimately, though,
the use of strong encryption is the foundation
that ensures data is always protected, whether
it's stored on the firm's own devices or
otherwise. That applies to business networks,
company servers, removable devices, and all
internal storage on company laptops."
For an IT manager to sleep well at night,
suggests Allen, they need to be certain that
the next time a company laptop is inevitably
left in a hotel, or a USB stick is misplaced,
it's near impossible that mission-critical
information can be prised from it. "They need
to know that no passwords are stored
anywhere in plain text. They need to know
that employees understand not to email
company documents back home using
personal email accounts, store them on an
unencrypted laptop or rely on unsanctioned
third-party cloud services.
"These examples of changes to business
behaviour aren't necessarily complicated, so
complying with GDPR doesn't have to require
moving heaven and earth. Arguably, the
examples we've suggested are merely good
practice anyway and GDPR is rewarding
organisations that already had solid data
management measures in place, before it
became law to do so," he concludes.
BREACHES RACKING UP
"Hefty fines and reputational damage haunted
businesses in the build-up to the passing of
the General Data Protection Regulation,"
recalls Martin Warren, cloud solutions
manager, EMEA at NetApp. "We all know by
now that data security and privacy are, in fact,
two different, complementary issues and, with
the number of data breaches racking up this
year, we are facing the evolving reality of data
security in a world where we essentially live
digital-first lives.
"In a world in which our data and its privacy
are paramount, data security ensures the front
door is bolted shut; data privacy, meanwhile,
requires data management processes with
privacy-by-design at its core." While data
security is certainly important for businesses,
encryption and data masking will not help a
business become GDPR compliant, he adds.
CULTURE CHANGE
"GDPR has succeeded in increasing the profile of data protection within most organisations," says Robert O'Brien,
CEO MetaCompliance. "Changing the culture of privacy by design and privacy by default will take organisations
a significant time to deploy. There is still a long way to go for most companies.
"It's still early to comment on the impact of GDPR in delivering enforcement. There has not yet been the flurry of
financial sanctions that many people feared. The ability of the regulator to stop an organisation processing data might
become a more powerful and effective tool than fines in the future." However, he does see GDPR as the gold standard
for privacy worldwide. "This can be seen in the construction of the Brazilian and the Californian privacy directives."
12
computing security July/August 2019 @CSMagAndAwards www.computingsecurity.co.uk