CS Mar-Apr 2020

expert insights
WHY CYBERSECURITY POLICY & GDPR
COMPLIANCE AREN'T SO DIFFERENT
THE COMBINED FORCES OF FURTHER REGULATION AND NEW
TECHNOLOGY WILL UNDERPIN DATA SECURITY IN THE YEARS AHEAD,
ARGUES ROBERT ALLEN - EUROPEAN DIRECTOR OF MARKETING
& TECHNICAL SERVICES AT KINGSTON TECHNOLOGY
Over the last decade, data has
become the world's most precious
commodity. The largest technology
organisations have grown into empires and,
following this shift, regulators and
governments have now awoken to the value
of data and begun to treat it accordingly.
New data security laws, such as GDPR,
affect companies and individuals across the
world. And as organisations adopt further
digital technology, the cybersecurity threat
has grown, as the rewards for gaining
unlawful access to data become more
lucrative. Historically, the emergence of new
technology in other industries has always
been followed by regulation, usually
because it quickly becomes obvious that
without clear standards, those industries can
create products that could cause serious
risks. But until only recently (arguably, still)
there has been a 'wild west' attitude to
digital technology. Risk is still tricky to
quantify, let alone manage, and many
companies still do not treat data security
seriously, even with the threat of regulatory
fines in place.
Cybersecurity threats are similarly not
taken seriously or even well understood in
companies. If they were, password reuse
wouldn't be prevalent, nor would reliance
on outdated software or the widespread use
of unencrypted devices. We all know there
are multiple threats to digital security that
require multiple solutions. But it's clear the
companies that consistently maintain a clear
approach to data management have been
able to meet regulatory compliance better
than those who had to scramble to meet
the 2018 regulation date. GDPR has
demonstrated that, by long-term prioritising
of data security and data protection,
a firm will be in a better shape to meet the
regulation that will surely follow further
down the line. Prioritising and investing
in both together is simply good business
practice.
A combination of further regulation and
new technology will drive data security
over the next decade. David Clarke, CTO
at GDPRUK.EU and founder of the GDPR
Technology Group on Linkedin, agrees.
"Cybersecurity technology will need to adapt
to the many global regulatory environments
to protect data and manage the appropriate
and fair use of personal data, protect the
vulnerable in our society, from managing
dataveillance and preventing online harms.
Data is already regulated; the next big
challenge is the regulation needed to
manage and monitor behaviours in a
world of zero-knowledge identification."
With a workforce as likely to be working
with sensitive company data when travelling
or at home as in the office, transporting
data to and from these locations is a key
security weak point. But when a business
deadline needs to be met, it's all too easy to
quickly transfer crucial documents to the
first USB stick you find in a drawer. Rather
than outright banning USB storage, there
are secure products, such as Kingston
Ironkey D300, that can mitigate this risk,
with on-device hardware encryption that
ensures that, if a device is lost or stolen,
the thief will not have access to any of the
data, which may be more valuable than the
hardware itself. Designed from the ground
up with security in mind, attack vectors
have been carefully considered, from
tamper-evident materials to a secure
password input method designed to foil
key loggers.
However, it seems that even our own
government isn't sending the right message
on security. Recently, it was revealed that
the UK government lost 2,004 mobiles
and laptops in 12 months 1 , from critical
government departments. Many were stolen
and 200 of these devices were unencrypted,
with potentially sensitive data accessible to
all. If security is best led by example, then
more joined-up thinking from above would
encourage better practices across the board.
1 https://www.bbc.com/news/technology-51572578
8
computing security Mar/Apr 2020 @CSMagAndAwards www.computingsecurity.co.uk