Wondering where DPA and GDPR overlap? The Yahoo! ruling by ICO can provide some clarity
A recent investigation by the Information Commissioner’s Office (ICO) highlights an interesting aspect of the current system. Although the ruling against Yahoo! was announced on 12th June 2018, three weeks after the enactment of the General Data Protection Regulation (GDPR), the incident was considered under the Data Protection Act 1998. This is because the breach actually occurred in November 2014, although it was not publicly disclosed until September 2016, almost two years after the attack compromising 515,121 accounts had taken place. Investigated under the DPA, the fine was a modest £250,000. Naturally this would have been significantly larger had it been judged under GDPR.
However, this does mean that today’s organisations can take their foot off the gas. At the time of the investigation taking place, although it was considered under the DPA, the ICO still expects to see adherence to GDPR going forward.
This isn’t ‘new’ news to the SRM team. We had anticipated the issue and had submitted this question to the ICO months ago:
If a breach occurred before 25th May but is not discovered until after GDPR becomes effective, will the breach be considered under the DPA 1998 (when it occurred) or under GDPR (when it was discovered)?
We received this reply from the ICO:
It is likely in this instance that the breach would be assessed under the DPA, the legislation in force at the time of the breach. However, we would expect the processing of information at the time the breach was discovered to be GDPR compliant. Therefore any lessons learned or actions taken as a result of the breach would need to be in line with the GDPR.
So what does this mean in simpler terms? It means that from 25th May 2018 every aspect of an organisation’s networks and infrastructure is required to be managed in line with the requirements of GDPR. This applies even if the actual breach is judged under the rules of the old Data Protection Act (1998).
The most important point is that a notifiable breach must be reported to the ICO without undue delay, but no later than 72 hours after becoming aware of it. So even if a breach actually occurred prior to 25th May, as soon as the breach is discovered, the new 3 day reporting timescale must be adhered to. The organisation’s systems will then be scrutinised through the prism of GDPR.
Should it not be possible to obtain all of the necessary information within 72 hours, the required information can be provided in phases, as long as the investigation is conducted as a priority. The breach still needs to be reported to the ICO when the organisation becomes aware of it, and they must submit any further information at their earliest convenience.
Having a Retained Forensics engagement in place makes the whole process significantly more efficient. Not only will they have a detailed knowledge of an organisation’s systems and networks, they will have helped to set up breach notification protocols and mitigation strategies; all of which will already be in line with the requirements of GDPR.
For more information on GDPR see our website.
To find out more about Retained Forensics, register for SRM’s free webinar: Incident Response & Forensic Expertise: would your business survive a cyber-attack or security breach?
Or read our blog:
The GDPR compliance fallacy
The key to GDPR is common sense
The A to E of cyber maturity
In a recent report, the Philippine government’s Department of Information and Communications Technology (created in 2016) outlined a scale of cyber resilience based on an A to E grading system. With ‘A’ being the most robust in terms of cyber security maturity and ‘E’ being the weakest, it put the Philippines in class D. The reasoning behind this grade stems from the fact that they are reactive to attack using only the available tools and technologies. They do not proactively seek out vulnerabilities and exploit them to ascertain the extent of a weakness. Nor do they deploy cutting edge strategies or prepare for the process of remediation to address the issues ahead of time.
This reactive approach is not limited to the Philippines. Far from it. In fact, these same principles can be applied to a frightening number of organisations across the globe. Those who simply react are always behind the curve, attempting to patch and mediate the impact of attacks on an ad hoc basis. An immature organisation focuses simply on prevention and regulatory compliance but with limited co-ordination, using basic technology and simple configurations.
In contrast, those with cyber maturity demonstrate their vigilance by employing a proactive strategy rather than simply waiting for a breach to occur. So what are the characteristics of cyber maturity?
- To begin with, in a mature organisation, cyber security is not seen as something that should be done, but is already embedded within the fabric and culture.
- Information and cyber security is not the responsibility of an overstretched CISO, who reports only to the head of the IT department. It is in the hands of a CISO who is well resourced, supported and who exerts confident influence at board level.
- Information security policy and testing is documented and has a formal structure, using automated tools, regularly scanning systems and web applications to identify any vulnerabilities in a proactive way.
- A mature organisation has built-in enterprise security technology architecture and strict focus on incident prevention, detection and response; regularly undertaking advanced and manual penetration testing to uncover weaknesses in the ever-changing scope.
- Business Continuity and Disaster Recovery Planning are integral to a mature organisation, together with the associated training across all staff, not just those within an IT or infosec department.
Our recent blog post on the topic of the NHS’ response to WannaCry highlights a ‘work in progress’ but certainly an admirable move towards cyber security maturity. Their plans centre around Test and Exercise methods, and are inclusive of annual Red Team Engagements to push their plans to the limits and ensure complete peace of mind.
SRM’s Test and Exercise (T & E) team works with all sizes and types of organisation to achieve cyber maturity. With wide experience in other areas of information security consultancy the T & E programme is not conducted in isolation but within the wider context of a client’s business activity. Every project is bespoke and our team includes consultants who are CREST ethical security testers as well as those with the Offensive Security Certified Professional (OSCP) qualification. Additionally, we often work with CISOs and organisations to develop and implement proactive robust and innovative T & E plans.
For more information on our T & E team, visit our website.
See a recording of our webinar: Incident Response & Forensic Expertise – would your business survive a cyber attack or security breach?
Or see our blog:
What we can all learn from the NHS response to WannaCry
Three stages to building a robust defence against external threats
Cyber resilience: it’s a board level issue
Webinar Wednesday 30th May 3pm: Incident Response & Forensic Expertise – would your business survive a cyber attack or security breach?
Register for the free SRM webinar here.
As organisations endeavour to be as proactive as possible to protect themselves from a cyber attack or security incident, it is time to question if you have access to the correct expertise to respond efficiently, limit the impact and minimise disruption if you were to suffer a breach.
Join us for this informative free webinar where Alan Batey, Head of the SRM forensic team, will take you through:
- What is a retained Incident and Forensic response service?
- Why do organisations need it?
- What is the impact of not having it?
- Why is there such a market appetite for this service in the current climate?
- Followed by a Q&A.
Register for the free webinar here.
What we can all learn from the NHS response to WannaCry
To be truly resilient against potential attacks, it is not enough to simply look at patching the last one, but to anticipate the next. When commenting on the news that the NHS had not fared well in the recent round of cyber security checks, Matt Hancock, Secretary of State for Digital, Culture, Media and Sport summed up the issue.
He said on BBC Radio 4 last month that ‘The NHS has made improvements since the WannaCry attack last year, but one of the challenges in cyber security is that the criminals and the malicious actors who are trying to harm our space are moving fast, and you have to run to stay still. You can’t just make one update, you’ve got to constantly be updating’. NHS cyber security chiefs described their existing practices as ‘relatively unsophisticated’, and admitted that 88 of the 236 trusts that were assessed by NHS Digital failed to pass the required cyber security standards.
In spite of the negative publicity surrounding the event, the report did state that WannaCry’s lasting effect would have been significantly more widespread, had it not been so quickly disabled. With this issue front of mind, the Former Chairman of NHS Digital still blamed ‘a lack of focus and a lack of taking it seriously’.
So what actions are in the pipeline in order to safeguard the UK’s health service? Of course, every hospital authority will be ensuring that all software update patches are installed, after this proved to be the crippling weakness of the 80 trusts affected in last year’s cryptoworm attack. The majority of trusts had acted on this but the hesitation came from the potential implications and disruption to other IT and medical equipment.
Along with praising the initial response, it should be said that the robust plans going forward are setting the bar for others to follow. A cyber security ‘handbook’ is being issued to all employees, along with ongoing staff training and development; bringing the issue to the forefront and ensuring that everyone has their part to play.
Robust Incident Response, Business Continuity and Disaster Recovery plans are soon to be in place, reducing disruption to the operations even further in the event of an attack. This is to be reviewed and changed annually, in line with industry best-practice. It will work in tandem with both an annual ‘cyber incident rehearsal’ and Red Team-style engagements using ethical hacking teams that will consistently carry out both manual and automated penetration testing to the NHS networks. Finally, this links to their plans to appoint a CISO, after recognising that cyber security is indeed a board level issue and should be dealt with as such, as soon as possible.
It is these key practises that businesses across the globe should be looking to adopt into their next information security strategies. If your organisation is looking to mirror the proactive efforts of the NHS, SRM’s specialist solutions encompass the full scope of the governance, risk and compliance agenda. The trusted partner of government agencies, high street brands and SMEs alike, our bespoke and consultative approach enables our clients to achieve peace of mind.
To discuss how our services can help you stay safe in cyberspace, contact Mark Nordstrom on firstname.lastname@example.org or 03450 21 21 51. Or visit our website.
Three stages to building a robust defence against external threats
How attack is the best form of defence when it comes to protecting against the rising trend in phishing and social engineering attacks
Cyber resilience: it’s a board level issue
The problem with cyber resilience is in the name. When it comes to managing the risk posed by potential hackers and the requirement for robust testing and defence protocols, it is often frequently parked under the responsibility of the IT department. But cyber resilience is not simply something for the IT department to worry about: it should be a cause for concern for the whole board. It is a business consideration, not simply an IT one, affecting business continuity and the bottom line as well as having the potential to damage an organisation’s reputation and the very core of its business operation.
Yet recent research by management consultancy Deloitte reveals that only one in five FTSE 100 companies share detail of their testing and online business protection plans with their boards on a regular basis. In fact, the research shows that only 21 per cent of UK Blue Chip businesses regularly share security updates with their boards.
There may be good reason for this. At first glance, providing details of their penetration testing strategy, which identifies vulnerabilities within their IT systems, may be thought to provide potential hackers with valuable information. But this outlook is simplistic. Boards and investors require the reassurance that a meticulous and robust cyber resilience strategy is in place, even though they do not, and should not, require precise detail.
A more likely reason for the low profile of cyber resilience planning is the much-publicised skills shortage of cyber expertise within organisations. Deloitte found that only 8 per cent of companies had a member of the board with specialist technology or cybersecurity experience. A similar figure applies to the number of companies that also disclose having a Chief Information Security Officer (CISO) within their executive team. But if the IT department is not equipped or does not have C-Suite influence, then there is a huge potential problem. Boards should therefore look to supplementing their resource with skilled professional expertise with the required skillset and the capability of engaging board level involvement.
This is simply applying the same resource to the IT department which other departments already have. The financial department has board level representation and external expertise in the form of professional accountancy firms. No one expects the legal department to handle all the organisation’s legal requirements; professional and specialist expertise is required. A similar level of resource should be provided when it comes to cyber security. Not only should the CISO have board-level influence, but they should be supported by experienced professionals. Cyber resilience specialists have a much wider range of knowledge and experience than just one organisation, and are able to add significant value. This is not only because they can direct expenditure to meet precise requirements, but also because they can anticipate future threats.
While IT departments may currently be adequately resourced to manage on a day-to-day basis, it is not enough to simply protect against known threats. Penetration testing must go several steps further because organisations are vulnerable to a vast range of threats which are unknown and unforeseen. Experienced professionals will use a combination of automated testing, to identify the threat areas, and manual testing to develop, explore and investigate these vulnerabilities. Only in this way can organisations have any level of defence against unknown threats.
Every member of the board has an invested interest in the development and delivery of a robust cyber resilience strategy. If in doubt, each and every member of the board should ensure that it is on the agenda at every board meeting.
SRM has an unrivalled reputation in the delivery of all types of information security, including cyber resilience. With a keen awareness of how organisations operate, our team works with minimal disruption and maximum effect, providing an outstanding level of defence. However, no one can (or should) provide total guarantees; but be assured that having a retained expert with a detailed working knowledge of an organisation’s systems, means that meticulous mitigation plans will be in place and swift remedial action taken in the event of an attack, reducing its impact and minimising its disruption.
For more information on our consultancy services see our website.
Our see our blog:
Shipping news: how to manage a ransomware attack
It’s not a question of if, but when
What is Red Team engagement?
For a no obligation discussion about how SRM can support your business, contact Mark Nordstrom on email@example.com or phone 03450 21 2151.