Category Archives: Data policy

GDPR Compliance is Not Mission Impossible

by Bharat Mistry

With one month to go until the GDPR compliance deadline, there are many organisations still struggling to get the right security processes and controls in place. A new global poll of senior legal officers from KPMG found that over half of (54%) feel their businesses is not prepared for the new privacy laws. Yet it doesn’t have to be this way. The biggest challenge with regulations like GDPR has been interpretation not only for the organisation but also for the certifying body. In the case of GDPR these are written in legal terms as opposed to technological ones, making it challenging to know what exactly needs to be done in order to be compliant. Proven frameworks such as NIST 800-53 can support a solid information security programme to help appease regulators. Continue reading

CNI Firms: Layer Up Security to Help Meet NIS Directive Obligations

by Bharat Mistry

There’s a major new piece of EU cybersecurity-related legislation landing in May, but it might not be the one you’re thinking of. Most UK organisations have their eyes firmly focused on the General Data Protection Regulation (GDPR). But arguably just as important for companies operating in critical infrastructure sectors is the new Security of Network and Information Systems (NIS) Directive. It introduces a range of best practice security steps which organisations must follow: fail to do so and you could face a GDPR-sized fine of up to £17m.

The government has already committed to transposing the directive into UK law irrespective of Brexit. With a 10 May deadline looming, the clock is ticking. Continue reading

Equifax Breach Drives Home the Importance of Prompt Patching as GDPR Approaches

by Bharat Mistry

No organisation is breach-proof: we all know that the odds are stacked too high in the attackers’ favour. However, by following industry best practices we can make it as difficult as possible for hackers, and discourage all but the most determined and well resourced. That’s why it will dismay many in the industry to learn that Equifax knew about the vulnerability that it claims led to a massive breach at the firm this year, all the way back in March. However, it was apparently only fully patched months later once the damage had been done.

Given the scale of the breach, and the fact the firm could have been hit with fines of over $60m under the forthcoming GDPR regime, this should serve as yet another cautionary tale to IT leaders. Best practice security, including effective patch management, is called “best practice” for a reason. Continue reading

CLOUDSEC 2017: Game of Thrones Hack Tells Us IP Theft is Still a Major Risk

by Ross Dyer

It’s difficult to even discuss data breaches today without referencing the European General Data Protection Regulation (GDPR). With less than a year to go, it is a major area of focus for UK IT leaders keen to avoid mandatory breach notifications and potentially astronomical fines. Yet breaches aren’t all about the customer data governed by the GDPR, as HBO found out this week. Hackers have reportedly made off with 1.5TB of data from the US TV network, uploading a script from an upcoming Game of Thrones episode and two full episodes.

It’s a good example of why IP theft-related risk should be just as big a driver of improving cybersecurity as attacks targeting customer data. Fortunately, attendees at this year’s much anticipated CLOUDSEC event will have some great learning opportunities designed to help them bolster defences against just such attacks. Continue reading