The French data protection authority, the Commission Nationale de l’Informatique et des Libertés (CNIL) has taken a very active role in clarifying what French businesses’ responsibilities will be under the EU’s General Data Protection Regulation (GDPR), coming into force on 25 May 2018. Issuing everything from guidelines for processors and SMEs to toolkits and templates, CNIL has taken a hands-on approach to demystifying the GDPR and providing clear steps towards achieving compliance.
The French DPA sees the GDPR as having a strong focus on accountability and transparency which are reflected in the regulation’s emphasis on creating products and services that take into consideration data protection by design and by default as well as the establishment of internal policies, procedures and tools that guarantee an optimal protection of individuals’ personal…
Read more
Data has become ubiquitous: from business processes and applications to smart phones, tablets and printers, the places data is stored and processed have moved beyond the confines of traditional network infrastructure and, implicitly, outside its protection mechanisms.
As a consequence, data breaches have become increasingly common, leading to a global movement towards the adoption of stricter regulations for the protection of users’ personal data. Notably, the EU’s General Data Protection Regulation (GDPR) is seen as a trailblazing legislation that enforces individuals’ rights and makes companies accountable for the security of the data they process.
But while compliance is important to avoid fines, the threat of data breaches should be a wake-up call to all companies, no matter which country they operate from or where their customers are located. As seen daily in…
Read more
Time is ticking: the implementation of the EU’s General Data Protection Regulation (GDPR) is less than 7 weeks away and companies are still struggling to come to terms with compliance. While some have already passed their audits and feel confident as we draw nearer to finding out the full extent of the GDPR’s enforcement, others are just now taking the first precautionary steps towards compliance.
Among the many requirements organizations must comply with, the right to erasure is one of the thorniest. A recent survey by big data application provider Solix found that 65% of respondents were unsure whether their companies can fully and permanently purge personal information from their systems. But what does the right to erasure imply, who does it apply to and, more importantly, what must companies do to comply with it? Let’s find out!
The right to be forgotten and the right to erasure…Read more
With the GDPR implementation around the corner, companies processing EU data subjects’ personal information need to step up their data protection policies and take decisive action to reach compliance. Under the new legislation, organizations will no longer have the luxury of putting data security low on their priorities list or feign ignorance about their data processing practices. They will be held accountable in the eyes of the law and will have to demonstrate their compliance with GDPR requirements to data protection authorities.
One of the first steps companies must take in this direction is to become aware of the way data is handled within their organizations. This implies a deep understanding of EU data subjects’ rights as well as the principles enshrined in the GDPR that relate to the processing of personal data.
Under the GDPR, sensitive information must be processed…
Read more
Earlier this week, the Center for Internet Security (CIS) released the latest version of their Top 20 Critical Security Controls, a ground-breaking set of globally recognized best practice guidelines for securing IT systems and data. The Critical Security Controls were first developed by the SANS Institute in 2008 and were later transferred to CIS in 2015. The guidelines are continuously being revised and refined by a volunteer global community of experienced IT professionals.
The Six Basic ControlsMost major security incidents occur when even basic controls are lacking or are poorly implemented. A study of the previous version of the controls showed that 85% of cyberattacks can be prevented by the adoption of the then first five Critical Security Controls alone. Applying all twenty can prevent as much as 97% of attacks.
The first six controls were therefore developed…
Read more
With the implementation of the EU’s General Data Protection Regulation (GDPR) 10 weeks away, organizations are struggling to reach compliance before the deadline passes. The new legislation is meant to unify and standardize data protection regulations across the EU, simplifying compliance procedures across borders and giving EU data subjects an unprecedented level of control over their personal data.
For the first time, privacy, in its digital context, will be legally enforced by design and by default. Companies will be held responsible for any breach of privacy and hefty fines will be applied to data controllers and processors found to not have taken adequate measures to protect EU data subjects’ personal information.
The GDPR brings one additional significant change to its predecessor: certain companies will have to appoint a Data Protection Officer (DPO). But what …
Read more
In what has now become a yearly tradition, the Endpoint Protector team will be heading out to San Francisco next month for the RSA Conference 2018. One of the best places in the world to talk security, full of inspiring speakers and valuable content, the RSA Conference has become a must-attend event for all cybersecurity professionals.
Since 1995, the RSA Conference has adopted a theme for every event and this year’s is no different. 2017 was a worry filled year for the cybersecurity industry as high-profile hacks and mass ransomware attacks flooded the mainstream, sparking debates and anxiety about data security.
Highlighting the growing attention towards the cybersecurity sector as massive cyberthreats become commonplace news, the RSA conference’s theme focuses on the urgency of addressing this wave of incidents and opening up a cross-disciplinary dialogue to come up with…
Read more
A recent study released by the American Journal of Managed Care (AJMC) revealed that one third of healthcare data breaches in the US occur in hospitals. The researchers analysed breaches reported to the Office of Civil Rights (OCR). Under federal legislation, if a healthcare privacy breach affects 500 or more patients, institutions are obligated to inform the OCR about it. The details of the breach are then made publicly available on the OCR’s data breach portal.
The study looked at what type of breaches occur most often in hospitals, the kind of data that they target and how vulnerable healthcare institutions are to them. Covering breaches that occurred between October 2009 and July 2016, they discovered that 215 hospitals were hit by breaches affecting over 6.5 million individuals.
The most common type of data breach, which occurred 112 times, was physical theft which compromised…
Read more
The entertainment industry has seen its fare share of leaks and hacks in recent years, with giants such as Sony, Netflix and HBO falling victims to attacks and having their private records and upcoming releases made public online. Movie studios in particular make for tempting targets as any cyberattacks they suffer will instantly make its perpetrators notorious and internet pirates rejoice. They are often not targets for profit as they are for fun. After all, even hackers can’t wait to see the latest season of Game of Thrones.
It is therefore no surprise that an organization such as the Motion Picture Association of America (MPAA) has issued comprehensive guidelines to secure digital film assets and ensure industry best practices are being met by third party vendors. While abiding by these guidelines is strictly voluntary, the MPAA performs content security assessments of vendors…
Read more
Since the cloud went mainstream, a proliferation of online services and tools have led to the rise of so-called shadow IT, the use of unauthorized third-party services by employees in the workplace. Examples include the use of personal email and cloud storage services, file transfer sites, format conversion websites or popular collaboration platforms such as Wrike or Asana.
Mostly used without ill-intent, through either negligence or for the sake of convenience, these services pose a serious threat to data security because companies are unaware of their use and thus do not know where their data is being processed or whether they are secure channels.
With the EU’s General Data Protection Regulation (GDPR) coming into force on 25 May 2018, companies must now, more than ever, put an end to shadow IT or risk the consequences of being financially penalized under the new regulation.
Why…Read more