Brexit and cyber security: what to expect
It's been a wild ride over the past few weeks with a great deal of changes now on the horizon - not to mention a fair deal of uncertainty. In spite of this, and regardless of our new relationship with the EU, the impact on UK companies of the pending General Data Protection Regulation (GDPR) remains unchanged. That’s right - you’re not off the hook, and in order to understand why, we need to understand why the GDPR is being implemented in the first place.
What is the GDPR?
The past ten years have been a rough roller-coaster ride for any company with any form of personal user data, or other sensitive information. From the Heartland data breaches in 2008 and 2009, through to the latest set of data breaches this week which will have affected any number of organisations across multiple industry sectors, breaches are now a part of business life - and that won’t change.
Over the past decade the manner in which these breaches were reported across the EU has been complex, ever since the inception of the 1995 Data Protection Directive. This complexity led companies to confusion around how to report data breaches, as well as how to protect the sensitive information stored on their systems. After years of wrangling, the EU finally implemented a standard set of rules and a one-stop shop that will apply to all member states, and which will allow all companies processing data from EU citizens to understand how they can best protect this information.
The commission define personal data as "any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address.", which means it's wide-ranging and will have an impact on any organisation in or outside the EU.
As the EU intend this regulation to apply to any and all data held on EU citizens, it has a wide-ranging impact on those who hold data. So if you operate outside the EU and want to process or store EU citizen data you’ll need to comply with the new regulations.
Brexit: what's changing?
One of the new changes to the legislation is the right of the citizen to be notified if their data has been breached or compromised. Included in the new regulation is a requirement for an organisation to contact their Data Protection Authority (DPA) within 72 hours of learning about a breach. No exceptions - with failure to comply resulting in potentially crippling fines.
What does this mean for my Auditing and Reporting Capabilities?
One of the big changes relates to the need to respond to any data breach within 72 hours of detecting it. This is a big ask considering it currently takes around 200 days at present to detect a breach. You can see this as a burden - or view it as the opportunity it is. Achieving the 72 hour turnaround for breach visibility means we're all going to have to improve our game when it comes to the visibility and auditing of our security controls, processes and policies. This is a good thing - for our company and for those that work with and for us.
Continuous monitoring requires a set of capabilities that gives you insights into what's going on in your organisation every second of the day. However, there are supporting factors that contribute to this successful approach, which are;
- Responsibilities - Data protection doesn't just lie with the IT department. There appears to be growing tension within certain organizations around where this responsibility lies. Our opinion is that it's everyone's responsibility, with the board responsible for leading and implementing a security culture from the top. IT security teams are increasingly stretched, and often do not know where the Crown Jewels of the organization are as they are not tasked with working in the business. Which leads us to Assets.
- Assets Assets Assets - Your logical and physical assets are your crown jewels. You need to know where these are. This is a challenge, but there are some good tools on the market that will allow you to discover and classify where you critical information is held. Once you know where it is, you need to understand why you have and how it's being accessed by both internal and external actors.
- Risk Assessment - In order to monitoring effectively, and therefore know if you're winning, you will need to have deployed policies, processes and technologies. To derive these, you'll need to perform a risk assessment. This will inform you of where you need to focus your limited resources on mitigating the top risks to your organisation.
- Education - We can't say this enough, and this relates to the need to ensure everyone knows their responsibilities and the reasons why certain policies and processes are in place. Without everyone on-watch, your task is going to be a lot harder.
What should I do with IT security post Brexit?
At time of writing this article you have just under 2 years to implement your own GDPR processes and systems. Take a look at the handy downloadable timeline which will give you insights into what needs to happen, when you should start doing it, and how long it should take you. The main takeaway? Don’t panic! There’s still time - if you start preparing now.
Jamie Graves is CEO of IT security software provider ZoneFox
GfK and VMware: Innovating together on hybrid cloud
GfK has been the global leader in data and analytics for more than 85 years, supplying its clients with optimised decision inputs.
In its capacity as a strategic and technical partner, VMware has been walking GfK along its digital transformation path for over a decade.
“We are a demanding and singularly dynamic customer, which is why a close partnership with VMware is integral to the success of everyone involved,” said Joerg Hesselink, Global Head of Infrastructure, GfK IT Services.
Four years ago, the Nuremberg-based researcher expanded its on-premises infrastructure by introducing VMware vRealize Automation. In doing so, it laid a solid foundation, resulting in a self-service hybrid-cloud environment.
By expanding on the basis of VMware Cloud on AWS and VMware Cloud Foundation with vRealize Cloud Management, GfK has given itself a secure infrastructure and reliable operations by efficiently operating processes, policies, people and tools in both private and public cloud environments.
One important step for GfK involved migrating from multiple cloud providers to just a single one. The team chose VMware.
“VMware is the market leader for on-premises virtualisation and hybrid-cloud solutions, so it was only logical to tackle the next project for the future together,” says Hesselink.
Migration to the VMware-based environment was integrated into existing hardware simply and smoothly in April 2020. Going forward, GfK’s new hybrid cloud model will establish a harmonised core system complete with VMware Cloud on AWS, VMware Cloud Foundation with vRealize Cloud Management and a volume rising from an initial 500 VMs to a total of 4,000 VMs.
“We are modernising, protecting and scaling our applications with the world’s leading hybrid cloud solution: VMware Cloud on AWS, following VMware on Google Cloud Platform,” adds Hesselink.
The hybrid cloud-based infrastructure also empowers GfK to respond to new and future projects with astonishing agility: Resources can now be shifted quickly and easily from the private to the public cloud – without modifying the nature of interaction with the environment.
The gfknewron project is a good example – the company’s latest AI-powered product is based exclusively on public cloud technology. The consistency guaranteed by VMware Cloud on AWS eases the burden on both regular staff and the IT team. Better still, since the teams are already familiar with the VMware environment, the learning curve for upskilling is short.
One very important factor for the GfK was that VMware Cloud on AWS constituted an investment in future-proof technology that will stay relevant.
“The new cloud-based infrastructure comprising VMware Cloud on AWS and VMware Cloud Foundation forges a successful link between on-premises and cloud-based solutions,” says Hesselink. “That in turn enables GfK to efficiently develop its own modern applications and solutions.
“In market research, everything is data-driven. So, we need the best technological basis to efficiently process large volumes of data and consistently distill them into logical insights that genuinely benefit the client.
“We transform data and information into actionable knowledge that serves as a sustainable driver of business growth. VMware Cloud on AWS is an investment in a platform that helps us be well prepared for whatever the future may hold.”