Tag Archives: Online security

Data Privacy Day: the 2020s can be the decade of privacy-by-design everywhere

By Ian Heritage

Internet trends come and go. But one concept that has steadily gathered momentum over the past decade is that of dataprotection and privacy. It’s now enshrined in EU law thanks to the GDPR, and today consumers and businesses are far more aware than they’ve ever been about their rights and responsibilities online. That’s why the coming decade offers a fantastic opportunity to embed privacy-by-design principles into every single organisation. But there’s still much to do, to raise awareness and change behaviours, especially among corporates.

That’s why Trend Micro is a proud sponsor and champion of the annual Data Privacy Day initiative, which is celebratedaround the world on 28 January.

Back to the beginning
It was on this day way back in 1981 that the Council of Europe opened for signature Convention 108, the first legally binding international treaty dealing with privacy and data protection. The first European Data Protection Day was held in January 2007 to drive greater engagement with online privacy issues, and the rest is history. 

Over the past 13 years, countless organisations have come unstuck in a very public manner. From a now-infamous HMRC blunder in 2007 to 2018’s Cambridge Analytica scandal, each incident has highlighted the potentially catastrophic impact of negligent data protection programmes. Yet these incidents have also raised public awareness and galvanised lawmakers. Thanks to the GDPR, European citizens are more in control of their personal data than they have ever been, while businesses must clear a high bar to prove they are responsible custodians of that data.  

Still work to do
But there’s still much to do. Highly sensitive personal browsing data is still shared across the adtech digital supply chain billions of times a day without any consent from consumers. Social media companies continue to harvest vast troves of customer data, IoT devices and smart assistants listen to our most intimate conversations, and the growing pervasiveness of digital technology continues to raise concerns among worried parents. 

There are also concerns for businesses. GDPR compliance is no easy thing: its vague references to “state of the art” technology and focus on broad principles rather than prescriptive controls, mean there’s no simple tick-box solution here. For many, there’ll be no 100% way of knowing whether they’re compliant until an incident occurs and the company waits for an official verdict.

There have already been over 160,000 breach notificationsacross Europe since the regulation landed nearly two years ago, leading to fines of €114m (£94m). These will certainly ramp up, as regulators across the region sharpen their knives. The ICO has already stated its intent to fine Marriott International and BA a combined £282m for serious breaches at the companies.

What happens next?
For now, this means that organisations must ensure their data protection policies are aligned with the GDPR, even in post-Brexit Britain. They must focus on best practice approaches and frameworks like those produced by NIST, Cyber Essentials and ISO. And they must look to partner with the right security experts: vendors that can offer multi-layered protection across all parts of the IT infrastructure, from endpoint to servers, networks to web and email gateways. The end goal is privacy-by-design: a commitment to embedding data protection into everything an organisation does.

At Trend Micro, we sit on both sides of the data privacy debate. Our Internet Safety for Kids and Families (ISKF) programme has offered vital resources for concerned parents for over a decade. But we also provide expert advice and support for organisations struggling to navigate a complex regulatory landscape while ensuring they do right by their customers. 

As a Data Privacy Day Champion, we’re working hard on both fronts — to ensure consumers know their rights, and have the tools and knowledge to stay safe online, and that businesses have the right controls and processes in place to meet their data protection responsibilities. As we travel through a new decade, there’s still plenty of work to do.

Radiohead Extortion Attempt Should Be a Warning to Firms

by Ian Heritage

Legendary UK band Radiohead is not technically a corporate entity. But it generates enough revenue to be considered one, with individual band members now worth tens of millions of pounds. Why should this matter? This week it was hit by an online extortion attack lifted straight from the corporate world — something Trend Micro has been warning organisations about for some time.

It should serve as another reminder that cyber-related risk may not just equate to stolen customer data or service interruptions. It could mean sensitive IP sold to the highest bidder, or used as a premise for extortion.

Continue reading

Safer Internet Day: working together for a better internet

by Ian Heritage

Last week Facebook and Google hit the headlines yet again for the wrong reasons after they were found to have bypassed Apple’s strict approvals process to distribute data harvesting apps to users. In Facebook’s case, the firm paid users as young as 13 in return for downloading the market research app. Critics claim it was less than open about the privacy-invading purposes of the app, and that its parental consent ‘checks’ could be easily faked.

It has all served as a timely reminder of the privacy and security risks families are exposed to on a regular basis today, as we celebrate Safer Internet Day (SID) around the world tomorrow, on the 5th February. Continue reading

With Government Missing, Here’s How CNI Firms Can Tackle Cyber Risk

by Bharat Mistry

The government is failing to address the cyber challenge facing the UK’s critical infrastructure (CNI) providers urgently enough, a new parliamentary report has claimed. In many ways the challenges facing CNI firms are broadly the same as for other organisations, just that the impact of successful attacks could go way beyond data loss and damaged brand reputation to devastating disruption of daily life and potentially even physical harm to citizens.

The good news is that, in lieu of government action, there are many things that organisations in the sector can do to mitigate risk and improve cyber resilience. They just need to remember to layer up security at all levels of the IT infrastructure, from DevOps up. Continue reading