GDPR Compliance Means Transforming Your Data Governance

GDPR Compliance Means Transforming Your Data Governance

Data Governance Is at the Core of GDPR Compliance

Organizations have until May 25, 2018, to comply with the EU’s new General Data Protection Regulation (GDPR). Arguably the most comprehensive, far-reaching data privacy law passed to date, the GDPR grants European consumers numerous new data privacy rights and places new data governance responsibilities on organizations.

GDPR Compliance Means Transforming Your Data Governance

Similar to HIPAA, the GDPR is light on technical specifics and heavy on end results. Organizations are told what they have to achieve, but not how to make it happen. Because every organization’s risks, vulnerabilities, cyber ecosystem, and data environment are different, the specific technical processes and controls they use to achieve GDPR compliance will vary. However, one thing will be consistent: The way in which affected organizations process, store, and protect their customers’ personal data will be altered, perhaps fundamentally.

Here are some of the key elements of the GDPR that may force significant changes to your company’s data governance:

International Reach

Think that because your company has no locations in the EU, it doesn’t have to worry about GDPR compliance? Think again. The GDPR applies to all companies that sell goods or services to individuals or organizations located in the EU or that “monitor[s] the behaviour of EU data subjects,” regardless of where the company is located. If your company has even one customer located in the EU, you must handle that customer’s data according to the GDPR.

Impact Assessments

Organizations must conduct impact assessments to identify risks to EU citizens’ data and specify how they are addressing those risks.

Sweeping Consumer Data Privacy Rights

EU citizens are granted a number of data privacy rights under the GDPR, including:

  • Consent: Organizations must obtain EU citizens’ consent to use and store their data, and they must clearly explain how the data will be used. Further, the data must be necessary to the completion of a task or transaction that the individual initiated.
  • Right to Access: Upon request, organizations must tell EU citizens what personal data they are using and how they are using it.
  • Data Portability: Upon request, organizations must furnish EU citizens’ personal data in a “commonly used and machine readable format” so that it can be transferred from one company to another.
  • Right to Be Forgotten: EU citizens will have the right to have their personal data deleted upon request; further, the organization must stop sharing the data with third parties.

Strict Data Breach Reporting Requirements

To prevent situations like the Equifax breach and the Uber hack, where compromised consumers were left in the dark for some time, the GDPR requires companies to notify both the authorities and affected customers within 72 hours of detecting a breach.

Accountability for Third-Party Vendor Breaches

Under the GDPR, organizations whose third-party vendors get breached won’t be able to pass the buck; it will be up to your company to ensure that your contracts with those vendors comply with the GDPR.

Privacy By Design

The GDPR requires that companies bake data security into their products, policies, procedures, and systems from day one.

“Reasonable” Levels of Security & Privacy

Under the GDPR, organizations will have to provide “reasonable” levels of data privacy and protection to EU customers. However, what is considered “reasonable” is not defined.

Data Protection Officer (DPO) Requirement

Organizations that are public authorities, “engage in large scale systematic monitoring,” or “engage in large scale processing of sensitive personal data” will need to hire or appoint a DPO to oversee GDPR compliance and overall data security.

Complying with the GDPR

If you’re concerned about the costs involved with GDPR compliance, you’re not alone. The International Association of Privacy Professionals (IAPP) estimates that Fortune 500 companies will spend a combined $7.8 billion on GDPR compliance, and medium-sized firms will spend an average of $550,000. However, the costs of non-compliance are much higher; violators can be fined up to 4% of their annual global turnover, or 20 million euros (approximately USD $24 million).

The best way to mitigate initial GDPR compliance costs, and ensure continued compliance going forward, is to employ a GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM). The ITAM puts everything under one umbrella, giving you a centralized repository of all IT compliance requirements, with associated controls and automated information flow for audits, assessments, and testing.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Unencrypted Retail POS System Cited in Forever 21 Breach

PCI DSS Compliance Still Lacking; Automation Can Help

Forever 21 Breach Disclosed on the Cusp of the Holiday Shopping Season

Clothing retailer Forever 21 suffered a POS system breach in an undisclosed number of stores from March to October 2017, the company announced last week. The Forever 21 breach was discovered by a third party and involved hackers taking advantage of POS systems that were not encrypted.

There are two primary lessons to be learned from the Forever 21 breach. First, PCI DSS compliance is critical for anyone who accepts or processes payment cards, and second, no organization, retail or otherwise, can afford to let its guard down during the winter holiday season.

PCI DSS Compliance Still Lacking; Automation Can Help

PCI DSS Compliance Still Lacking; Automation Can Help

Compliance with PCI DSS is mandatory for any organization that accepts, processes, or stores payment cards from the major credit card brands. Penalties for violating PCI DSS are severe. The credit card companies that mandate PCI DSS could impose fines amounting to tens or even hundreds of thousands of dollars, and if a company is unable to pay the fines, they will no longer be able to accept those cards. Organizations that violate PCI DSS could also run afoul of state data privacy laws, many of which mirror PCI DSS requirements. Then, there are the direct and indirect costs of responding to the breach, including defending civil lawsuits brought by angry consumers.

Violating PCI DSS simply isn’t worth the risk. Yet, according to the Verizon 2017 Payment Security Report, only a little over half of assessed businesses (55.4%) were in full compliance with PCI DSS. While this has nudged up a bit from 2015, when only 48.4% were compliant, this means that nearly half of all organizations that take credit cards are violating PCI DSS. Further, Verizon reports that out of the nearly 300 payment card breaches it investigated between 2010 and 2016, not a single organization was in full compliance at the time of the breach.

The takeaway here is that while compliance with PCI DSS does not guarantee that a company’s POS systems will not be breached, compliance is the foundation of proactive cyber security. Without it, everything else crumbles. While the Forever 21 breach is still under investigation, the fact that some of the chain’s stores were not encrypting cardholder data hints at PCI DSS violations.

It should be noted that only some of Forever 21’s stores were impacted. Large retail chains often struggle with maintaining PCI DSS compliance at all locations, especially if they are not employing IRM IRM GRC software solutions to automate the process. Retail data environments are highly complex and involve multiple systems at dozens, hundreds, or even thousands of locations, from HR and payroll systems to in-store POS terminals to ecommerce sites.

IRM GRC software such as Continuum GRC’s IT Audit Machine (ITAM) automates the compliance process and integrates IT governance, policy management, risk management, compliance management, audit management, and incident management across the enterprise. This ties together all of a retailer’s networks and systems and prevents situations like the Forever 21 breach, where some stores’ POS systems were secured, but others got left behind.

Hackers Don’t Take Holidays

The Forever 21 breach was disclosed near the beginning of this year’s holiday shopping season, when consumers flood brick-and-mortar stores and ecommerce sites, and cyber criminals looking to steal payment card information tend to up their game. However, just because your company doesn’t operate in the retail industry doesn’t mean you can be lax about cyber security between Thanksgiving and the New Year.

The NotPetya attacks that struck Ukraine last summer were timed to take advantage of a national holiday in that country, when hackers knew that many businesses would be short-staffed and not paying as much attention as they should. Cyber criminals know that many businesses in the U.S., caught up in holiday celebrations, dealing with staff vacations, and possibly operating on limited hours, let down their guard during the winter holiday season. On New Year’s Eve last year, Los Angeles Valley College was hit by a massive ransomware attack that disabled all of its systems; the school ended up paying a ransom of more than $28,000 to get back in.

Not only could your company be hacked during the holidays, but hackers may be even more likely to attempt to strike right now, when they think you’re not looking. Enjoy the holidays, but don’t let cyber criminals spoil the eggnog; keep adhering to the same proactive cyber security measures you practice the rest of the year.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.

Social Media Security and the Trump Twitter Account Incident

Social Media Security Matters; Just Look at the Trump Twitter Account Debacle

Social Media Security Matters; Just Look at the Trump Twitter Account Debacle

The recent Trump Twitter account incident – where the president’s Twitter feed was deactivated for 11 minutes – was fodder for many late-night television jokes. All kidding aside, though, enterprise social media security is serious business.

A social media presence is an integral part of B2B and B2C digital marketing. From multinational corporations to home-based micro businesses, companies in all sectors use Facebook, Twitter, Instagram, and other social media channels for SEO and reputation management purposes, to establish credibility and thought leadership, to interact with current and potential customers, and, for many B2C companies, to drive sales directly, especially during the holiday shopping season.

Organizations should look at what happened to the Trump Twitter account as an example of why they should keep social media security at top of mind during the holiday season and throughout the year.

Proactive Tips for Social Media Security

Social media security shouldn’t be an afterthought. The first thing to keep in mind is that your company’s social media feeds are as important and sensitive as your email system, databases, employee PCs, cloud servers, and other enterprise systems. You may have laughed at what happened to the Trump Twitter account, but it wouldn’t be so funny if your company’s social media feeds were disabled or hijacked. Your social media feeds need security controls just as much as your databases and cloud servers do.

Tightly control access to your enterprise social media feeds. Your social media feeds should be treated just like your internal and cloud systems; if an employee doesn’t need access to them to perform their jobs, they shouldn’t have it. Twitter has found this out the hard way. For years prior to the Trump Twitter account incident, the company was warned about handing the keys to the kingdom to too many employees. Even worse, the Trump Twitter account wasn’t the first one that was breached.

Use social media management platforms to control access levels. Cloud-based social media management platforms, such as Hootsuite and Buffer, allow enterprises to control how much access each employee has to the company social media accounts. A particular employee may be allowed to compose messages, for example, but not have access to the actual account passwords, and their messages can be set to not go live until they are screened and approved by a manager.

Never give interns or temps unfettered access to your social media feeds. At first, Twitter thought that a rogue employee had deactivated Trump’s account. Now, it is believed that a rogue third-party contractor did so on the way out the door. It is not uncommon for companies to use unpaid interns to manage their social media accounts, and many other companies hire temps to tackle social media work during the holiday shopping season. From a social media security perspective, these are terrible ideas, especially if the intern or temp has complete and unsupervised access. At the very least, use a social media management platform to limit the temp’s access. Never give them account passwords or allow them to post directly; always have a permanent, trusted employee screen the messages.

 Be careful when outsourcing social media management. If your company chooses to hire a third-party social media management firm, vet them as carefully as you would any other service provider. Get references and check them, and never hire a third-party social media vendor based on price alone.

The cyber security experts at Continuum GRC have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting your organization from security breaches. Continuum GRC offers full-service and in-house risk assessment and risk management subscriptions, and we help companies all around the world sustain proactive cyber security programs.

Continuum GRC is proactive cyber security®. Call 1-888-896-6207 to discuss your organization’s cyber security needs and find out how we can help your organization protect its systems and ensure compliance.