GDPR

The Industrial Revolution v4.1: with increased opportunity comes increased vulnerability

If history teaches us one thing it is that there is no going back. It started with the First Industrial Revolution which used water and steam power to mechanise production. This was followed by the Second which used electricity and the Third which used electronics and information technology. With the Fourth Industrial Revolution we have seen a fusion of digital technologies, the use of the Cloud and extensive data management. But arguably we are now entering an additional phase which includes the integration of physical devices, vehicles, home appliances embedded with electronics, software, sensors, actuators and connectivity, sometimes known as The Internet of Things. This is the Industrial Revolution v4.1.

This new era of technological revolution presents unprecedented opportunities for innovation, diversification, agility and cost optimisation. Yet with these increased opportunities also comes an increased level of vulnerability.

The latest report by Kapersky (2018) provides some statistics around the global cost of data breaches, revealing that the average business now spends 27 per cent of its IT budget on cyber defence. This investment is essential given the potential financial losses likely to be incurred in the event of a breach.

In addition to the cost of the breaches themselves in terms of fines and lost revenue, the report shows that for larger organisations the damage goes even deeper with an average loss of $144,000 due to damage to their credit rating and higher insurance premiums and an additional spend of $113,000 on Public Relations exposure to repair and rebuild brand damage following a breach.

We must therefore also ask ourselves how organisations can defend themselves and be resilient to the inevitable attacks. There are four key areas:

1. Testing: Penetration Testing using a synergy of automated and manual testing to investigate and explore vulnerabilities, identifying potential areas of weakness; Red Teaming: using the skills of highly qualified individuals to simulate a real-world attack, designed to assess the suitability of the current security programme and offer remediation advice where appropriate;

2. Disaster Recovery: taking a strategic approach to managing staff in the event of a successful attack, minimising damage to brand reputation and safeguarding the interests of key stakeholders;

3. Retained Forensic Remote Support: having access to a specialist team 24/7, 365 days of the year to provide professional, pragmatic and strategic support in the event of any type of incident, enabling organisations to focus on maintaining business as usual;

4. Business Continuity: developing a Business Continuity Management (BCM) plan which is applied consistently across the entire enterprise with senior management’s support to make a significant difference in the ability of the organisation to achieve high level cyber resilience, protecting financial and reputational assets.

SRM provides the full range of these services using the integrated specialisms of highly-qualified and experienced consultants. Working with organisations to enhance their data security and to demystify the threat landscape, our team brings market-leading knowledge with a first class service.

To receive regular blogs on topics relating to information security, follow us on Linkedin.

To find out more visit our website.

Or read more:

The flaw in the plan: business continuity management

Penetration testing: man vs machine

What is Red Team Engagement?

The A to E of cyber maturity

How phishing scams are getting schools into deep water

While many schools are concerned about the advent of the General Data Protection Regulation (GDPR) and what it means for the collection and holding of data, permissions and consent, they may be overlooking its key purpose: to keep data safe. This is particularly relevant at a time when schools are increasingly becoming targets for cyber criminals. According to recent research by specialist schools insurer Ecclesiastical Insurance 20 per cent of educational establishments have been targeted. While universities, on the whole, are better equipped to defend against attacks, schools are significantly more vulnerable; due largely to the ‘soft target’ presented by teachers and parents who are ill-equipped to deal with online fraudsters.

The report concludes that naivity is a key problem with many school communities still being largely unsuspecting of how cyber criminals operate. This presents very real implications for the safeguarding of data and children and, by default, adherence to GDPR. Security around social media is a particular problem, providing potential hackers with detailed information with which to bait their phishing hooks.

Common attacks include phishing scams where individuals are tricked into providing information which allows criminals access to the school system. Data theft is sometimes the goal and children’s medical records are, for example, reported to be lucratively traded on the Dark Web, providing details for fraudulent official documents. Sometimes the intention behind the attack is, however, purely financial with emails requesting payments providing links to rogue websites. A new type of scam has also developed called ‘whaling’ where finance directors or bursars are conned into transferring thousands of pounds into fake accounts.

Private schools are particular targets due to the high fees and in 2017 Insurance Times reported a scam where parents were sent fake emails which conned them into sending fee payments into the criminals’ account. In these instances, private schools are particularly at risk of damaging their reputations.

Yet, in institutions which trade in education, it is education regarding online safety that is the main problem. This is because, no matter how effective the online security strategy, it is the human element which most commonly leads to system breaches. Continuous and constant education – including awareness and training programmes – need to be in place to reduce the risk.

A key element is education around social media. Schools and educational trusts should prioritise providing strict guidelines for social media postings and other forms of publishing. This is because phishing expeditions frequently start with social media. Hackers use the information posted online to send relevant-sounding emails which create the impression of being legitimate, encouraging people to open and act upon them.

Phishing scams also enable hackers to gain access to the internal school systems. While these may be well-defended on the perimeter with firewalls and access restrictions, a simple phishing exercise can con individuals with restricted access into divulging further information. Once inside the system, cyber criminals may encounter little in the way of additional defences.

Phishing scams and social media are just one element of the problem facing schools. There are many important aspects to adhering to GDPR and building a robust online defence and we will be posting further blogs on this topic. If you wish to receive these please follow us on Linkedin.

Wondering where DPA and GDPR overlap? The Yahoo! ruling by ICO can provide some clarity

A recent investigation by the Information Commissioner’s Office (ICO) highlights an interesting aspect of the current system. Although the ruling against Yahoo! was announced on 12th June 2018, three weeks after the enactment of the General Data Protection Regulation (GDPR), the incident was considered under the Data Protection Act 1998. This is because the breach actually occurred in November 2014, although it was not publicly disclosed until September 2016, almost two years after the attack compromising 515,121 accounts had taken place. Investigated under the DPA, the fine was a modest £250,000. Naturally this would have been significantly larger had it been judged under GDPR.

However, this does mean that today’s organisations can take their foot off the gas. At the time of the investigation taking place, although it was considered under the DPA, the ICO still expects to see adherence to GDPR going forward.

This isn’t ‘new’ news to the SRM team. We had anticipated the issue and had submitted this question to the ICO months ago:

If a breach occurred before 25th May but is not discovered until after GDPR becomes effective, will the breach be considered under the DPA 1998 (when it occurred) or under GDPR (when it was discovered)?

We received this reply from the ICO:

It is likely in this instance that the breach would be assessed under the DPA, the legislation in force at the time of the breach. However, we would expect the processing of information at the time the breach was discovered to be GDPR compliant. Therefore any lessons learned or actions taken as a result of the breach would need to be in line with the GDPR. 

So what does this mean in simpler terms? It means that from 25th May 2018 every aspect of an organisation’s networks and infrastructure is required to be managed in line with the requirements of GDPR. This applies even if the actual breach is judged under the rules of the old Data Protection Act (1998).

The most important point is that a notifiable breach must be reported to the ICO without undue delay, but no later than 72 hours after becoming aware of it. So even if a breach actually occurred prior to 25th May, as soon as the breach is discovered, the new 3 day reporting timescale must be adhered to. The organisation’s systems will then be scrutinised through the prism of GDPR.

Should it not be possible to obtain all of the necessary information within 72 hours, the required information can be provided in phases, as long as the investigation is conducted as a priority. The breach still needs to be reported to the ICO when the organisation becomes aware of it, and they must submit any further information at their earliest convenience.

Having a Retained Forensics engagement in place makes the whole process significantly more efficient. Not only will they have a detailed knowledge of an organisation’s systems and networks, they will have helped to set up breach notification protocols and mitigation strategies; all of which will already be in line with the requirements of GDPR.

For more information on GDPR see our website.

To find out more about Retained Forensics, register for SRM’s free webinar: Incident Response & Forensic Expertise: would your business survive a cyber-attack or security breach?

Or read our blog:

The GDPR compliance fallacy

The key to GDPR is common sense

 

The key to GDPR is common sense

by Tom Fairfax, Managing Director

It is not often that EU-wide legislation is likened to a children’s story. Consider, however, the story of Goldilocks and the three bears. When it comes to the General Data Protection Regulation there are three types of organisation. There are those who are running around in a state of panic, going completely over the top, deleting all their data and sending frenzied emails to their databases. There are others who are simply doing nothing. Then there is the third group which is following and communicating a measured plan and, in short, doing it just right. The key is common sense.

The fact is that most people probably need to be doing something. There is a clear obligation to act and doing nothing is simply not an option. The policy of ‘let’s wait and see’ or corporate procrastination will only lead to tears at bedtime. GDPR builds on existing Data Protection legislation, protecting the rights of individuals and their data and this means that every organisation from a small voluntary group to a large multinational must have an enacted plan or risk falling foul of the regulation.

Organisations and individuals alike should already have a clear idea of what they need to do. If they haven’t they should step back and think about what personal data they hold and why.  Many of us may still be holding unnecessary levels of personal data; many of us will have failed to consider what data we actually need and many may have failed to get appropriate permissions.  For the majority of organisations it may be necessary (and possibly desirable) to have a robust data weeding project.  Some data, however, is likely to be held for legitimate operational purposes, and in some cases, its wanton destruction may disenfranchise stakeholders.

Common sense should prevail. Data collection, storage and processing should be driven by a business need and supported by appropriate permissions.  It is also necessary to think hard about when information actually becomes redundant and to have a sensible process to pick this up and delete it.  This is not new: we should really have been doing this anyway.  The ‘just right’ group will have worked out what they need to do and will have made a plan.

The important thing to remember is that whilst GDPR does not actually have an explicit compliance programme, its key intent is to ensure the safety of personal data.  For those wrestling with widespread compliance, those following the compliance guidelines of regulatory bodies such as the Payment Card Industry, Mifid II (for the financial industry) or the international standards such as ISO 27001 will have done much of the work already and will just need to understand the gaps that exist.

If a system is properly safeguarded with an inbuilt process of compliance, maintenance and development through these recognised compliance processes then many of the principles of GDPR will likely be adhered to. The job of the Data Protection Officer (DPO) or Chief Information Security Officer (CISO) is to complete due diligence to ensure this is the case. Professional expert guidance will provide these key individuals with the support they require in making these judgement calls.

It is not sufficient to simply draw up a policy, however, no matter how detailed, informed or expert it may be. Plans and policies simply demonstrate management intent. If the plan is not disseminated and implemented and if clear, understandable guidelines are not provided in a timely way, even those with a meticulous plan will simply be left with cold porridge.

 

How PCI compliance puts you on course for GDPR

For a long time the General Data Protection Regulation has been looming on the horizon but in just a few short days it will arrive; a permanent aspect of the data protection landscape. From 25th May 2018 this European-wide data protection will be a legal requirement for virtually every UK organisation. The task should not be overwhelming; particularly for those who are already PCI compliant, or working towards it. This is because the PCI compliance process means they are already well on course for GDPR. All that remains is an identification of gaps to bring systems and policies in line with GDPR.

The important thing to bear in mind at this stage is that the GDPR, although aimed at the entirety of an organisation and largely enforceable, is less prescriptive than the PCI DSS standard that already exists. GDPR provides detail about what needs protecting but very little in the way of a solid action plan.

PCI DSS on the other hand offers a detailed framework upon which to build, specifying what needs to be done and how, and even giving regular updates and guidance on reviews. The two complement each other and therefore the GDPR will be best enacted alongside the existing PCI DSS. A further aspect to note, is that a PCI breach will also be a GDPR breach, since the information on your cardholder data environment is subject to regulation by GDPR.

GDPR should not be seen in a negative way. It is a positive piece of legislation which will help to build trust. Similarly, PCI DSS compliance provides you and your customers with peace of mind that data is secure. This is the metaphorical carrot. There is also a stick: those who do not comply and suffer a breach will face loss of customer trust, enforced PFI investigations and fines.

For those that are already compliant with the PCI DSS, an annual review of the data being processed should form an integral part of the project. This ensures that any new technologies or processes are not excluded and ongoing compliance is maintained. Once you have identified the data that GDPR affects, applying the PCI approach to the implementation of the GDPR will assist greatly as the framework is already there. There will still be a few gaps to fully adhere to GDPR so professional advice will be of benefit.

And for those who aren’t PCI compliant? Seeking guidance from a qualified advisor and reviewing the gaps in their documentation, policies, training, IT systems and processes should be a pressing matter.

With one of the largest QSA teams in Europe, SRM provide unrivalled technical and compliance expertise within the PCI arena. Our GDPR team provide a business-focused service to organisations at all ends of the GDPR-readiness spectrum. For help and support, or to discuss any aspect of PCI DSS compliance or GDPR contact Mark Nordstrom at mark.nordstrom@srm-solutions.com or 03450 21 21 51.

To gauge your level of GDPR readiness, complete our free GDPR Self Assessment Questionnaire

For more information on our GDPR services, visit our GDPR page.

To view a recording of our webinar GDPR: the roles of manual and automated penetration testing, click here.

Read more on GDPR related blogs.

SRM Blog