Several PCI DSS requirements from version 3.2 come into effect at the end of January, 2018 (that’s just five months from now!).
Here is a list of some of the changes that will come into effect:-
3.5.1: Full documentation of all cryptographic architecture (service providers only)
6.4.6: Change management processes that include verification of any PCI DSS impact for changes to systems or networks
8.3.x: MFA for all non-console access to CDE. This requirement has been the subject of much discussion, and we expect many entities to require remediation.
10.8: Detection and reporting of all critical security control system failures (service providers only)
18.104.22.168: Penetration testing must now be performed every 6 months, as well as after any segmentation changes. (service providers only)
12.4.1: Executive management must establish PCI responsibilities and compliance program management (service providers only)
12.11.x: Quarterly personnel reviews P&P’s (service providers only)
Small and medium sized businesses are being warned to take note as a company which suffered a cyber attack is fined £60,000 by the UK Information Commissioner’s Office.
An investigation by the ICO found Berkshire-based Boomerang Video Ltd failed to take basic steps to stop its website being attacked.
Sally Anne Poole, ICO enforcement manager, said:
“Regardless of your size, if you are a business that handles personal information then data protection laws apply to you.
“If a company is subject to a cyber attack and we find they haven’t taken steps to protect people’s personal information in line with the law, they could face a fine from the ICO. And under the new General Data Protection Legislation (GDPR) coming into force next year, those fines could be a lot higher.”
“Boomerang Video failed to take basic steps to protect its customers’ information from cyber attackers. Had it done so, it could have prevented this attack and protected the personal details of more than 26,000 of its customers.”
The video game rental firm’s website was subject to a cyber attack in 2014 in which 26,331 customer details could be accessed. The attacker used a common technique known as SQL injection to access the data.
The ICO’s investigation found:
- Boomerang Video failed to carry out regular penetration testing on its website that should have detected errors
- The firm failed to ensure the password for the account on the WordPress section of its website was sufficiently complex
- Boomerang Video had some information stored unencrypted and that which was encrypted could be accessed because it failed to keep the decryption key secure
- Encrypted cardholder details and CVV numbers were held on the web server for longer than necessary
Ms Poole said:
“For no good reason Boomerang Video appears to have overlooked the need to ensure it had robust measures in place to prevent this from happening.
“I hope businesses learn from today’s fine and check that they are doing all they can to look after the customer information in their care.”
In the last few months it appears that the North West of England has become a hub of nuisance calls after three raids undertaken on behalf of the Information Commissioners Office.
The ICO executed two search warrants this week, one in Gatley, Greater Manchester, on Wednesday and the other in Wilmslow, Cheshire, on Thursday.
Computers and phones were seized during the searches as the ICO continues to investigate nuisance calls prompted by the theft of people’s details from car repair centres throughout the UK. The items will now be subject to forensic examination and investigation.
Mike Shaw, ICO Criminal Investigations Group Manager, said:
“This illegal trade has multiple negative effects – both on the car repair businesses targeted for their customer data and the subsequent nuisance calls made to customers. These can be extremely unsettling and distressing.
“Our searches this week are the latest step in us tracking down the unscrupulous individuals involved in this industry. These people won’t get away with it – any person or business involved in the theft and illegal trade of personal data may find themselves subject to ICO action.”
ICO investigators are looking at how the data was stolen, who stole it and which companies have subsequently made calls to the public encouraging them to make compensation claims about to accidents they may have been involved in.
The ongoing investigation, named Operation Pelham, started in May 2016 and has so far involved:
December 2016. A business and two homes in Macclesfield and Heald Green were searched by ICO officers. The business was linked to the making of telephone calls to numbers originating from some of the car repair centres. Computers, telephones and documents were among items seized from the residential properties.
April 2017. Homes in Macclesfield and Droylsden.
The global insurance industry’s ability to confront structural and technological changes is now the greatest risk it faces, according to a new survey of insurers and close observers of the sector.
The CSFI’s latest Insurance Banana Skins 2017 survey, conducted with support from PwC, surveyed 836 insurance practitioners and industry observers in 52 countries, to find out where they saw the greatest risks over the next 2-3 years.
|Insurance Banana Skins 2017
(2015 ranking in brackets)
|1||Change management (6)|
|2||Cyber risk (4)|
|4||Interest rates (3)|
|5||Investment performance (5)|
|9||Human talent (15)|
|10||Guaranteed products (7)|
|11||Political interference (16)|
|12||Business practices (11)|
|13||Cost reduction (-)|
|14||Quality of management (12)|
|15||Quality of risk management (10)|
|16||Social change (20)|
|18||Product development (17)|
|19||Corporate governance (21)|
|20||Capital availability (22)|
|21||Complex instruments (25)|
Change management is at the head of a cluster of operating risks which have jumped to the top of the rankings. The report raises concerns about the industry’s ability to address the formidable agenda of digitisation, new competition, consolidation and cost reduction it faces, especially because of rapidly emerging technologies which could transform insurance markets, such as driverless cars, the ‘internet of things’ and artificial intelligence.
Cyber risk follows close behind, with anxiety rising about attacks on insurers themselves as well as the costs of underwriting cyber-crime. Other major concerns include the adequacy of insurer’s internal technology systems and new competition, particularly from the ‘InsurTech’ sector.
The next cluster of high-ranking risks, interest rates, investment performance and macro-economic risk, shows that concern about economic instability remains high. Although respondents acknowledged signs of growth, confidence in the recovery is not strong for reasons as widely dispersed as the slowdown in China, the risk of Trump-era protectionism, and populism in Europe. The risk of political interference was seen to have risen sharply. However, Britain’s exit from the EU was seen to be a minimal source of risk for insurers, particularly those without operations in the UK.
Regulatory risk, which has topped the last three editions of this survey, has fallen out of the top five this year. This is largely because recent regulatory changes are settling in to business as usual (e.g. Solvency 2), though the cost and complication of regulation continue to be a concern.
The report shows that the industry’s ability to attract and retain human talent is a fast-rising concern, particularly to handle the digital challenge. Conversely, an area of declining risk is the governance and management of insurance companies. These were seen as high-level risks during the financial crisis but have fallen sharply since, because of both initiatives from the industry itself and regulatory pressure.
Overall, the climate for insurers is becoming more challenging, according to respondents. The 2017 Banana Skins Index, which measures the level of anxiety in the industry, is at a record high, while the industry’s preparedness to handle these risks has fallen from 2015.
David Lascelles, survey editor, said: “For the first time in six editions of this survey, operating risks pose the greatest threat to insurers. Structural and technological changes to the industry could upend traditional business models. At the same time, insurers are grappling with a very difficult economic climate, which helps explain why anxiety is at an all-time high.”
Mark Train, PwC Global Insurance Risk Leader, comments: “Both the challenges and opportunities presented by change underline the vital importance of being clear about where you’re best able to add value, and then being ruthless in targeting investment and management time at these priorities. A key part of this ‘fit for growth’ strategy is differentiating the capabilities needed to fuel growth, ‘good costs’ targeted for investment, from low-performing business and inefficient operations, ‘bad costs’ targeted for overhaul or elimination.”
Rob Luke’s keynote speech ‘Will GDPR Change the World?’.
Let me take a moment to thank TechUK for putting together this event and for offering me the platform to speak with you this morning.
Our Commissioner, Elizabeth Denham, has been clear that the ICO’s vision – of increasing data trust and confidence among the UK public – can only be achieved by working in partnership with the private, public and third sectors.
An important part of that is developing key relationships with representative or umbrella organisations as multipliers and amplifiers for our engagement with different constituencies. Helping us reach new or hard-to-reach audiences.
Our strong relationship with Tech UK is a great example of that partnership approach.
We appreciate the role you play in bringing together representatives from across the sector and your ongoing constructive dialogue with us around issues of importance to your members and the sector as a whole.
I’m glad to have the opportunity to continue that dialogue this morning.
Will GDPR change the world?
Will the General Data Protection Regulation change the world?
Wow, what a question. On the face of it, even the most ardent data protection advocate would struggle to make a case that a blandly titled piece of European legislation deserves that billing.
So despite my professional obligation to emphasise the importance of data protection in the digital age, I am not going to make the argument for the world revolving around GDPR.
What I will try to do is highlight some of the opportunities and challenges GDPR brings for organisations.
Ultimately, of course, GDPR is an indicator of change as much as it is an instigator. And no sector is more relevant to that rapidly changing landscape than yours.
GDPR is part of the response to the challenge of upholding information rights in the digital age. Of protecting the rights and interests of the individual in the context of an explosion in the quantity and use of data and in an environment of extremely rapid technological change.
So I feel it is particularly relevant to mark One Year To Go in dialogue with the tech sector in particular.
I should be clear early on that this is not a speech about Brexit or an exploration of the UK’s possible post-Brexit data protection framework.
In a pre-election period, and with the need to adhere to the guidance on purdah, I hope you will understand that I am not in a position to speculate about the post-Brexit environment, nor indeed to comment on proposals in political party manifestos.
I apologise in advance if there are questions, or elements of the panel discussion, where I am limited by the caution that purdah requires.
What we can safely say however, is that one way or another, GDPR is going to be an important part of the global data protection landscape over the years ahead, with great relevance to UK organisations, the public and their data.
Fit for the digital age
The moment at which GDPR takes effect in the UK on 25 May 2018 will of course mark a change. In delivering legislation fit for the digital age GDPR confers new rights and responsibilities and organisations need to be working now to prepare for them.
I assume that this audience has a familiarity with the core features of GDPR and the key requirements it places on organisations. I hope you have already deployed our ’12 steps to take now’ guidance and our ‘Overview to GDPR’ and that you are drawing on our wider resources.
One consistent feature of our outreach with organisations is a high demand for granular guidance – often people will say to us: “tell us what we need to do”.
We are working at pace to produce detailed guidance, both at national level but also European level guidance produced by the Article 29 EU Working Party to which we are making a major contribution.
I will flag up some particular pieces of guidance in a minute, and the pipeline of guidance will continue to flow.
But I urge you not to wait, nor to take a reactive approach to your GDPR preparations, motivated solely by a mindset of compliance or risk management.
Those organisations which thrive under GDPR will be those who recognise that the key feature of GDPR is to put the individual at the heart of data protection law.
Thinking first about how people want their data handled and then using those principles to underpin how you go about preparing for GDPR means you won’t go far wrong.
Transparency and accountability
It can be boiled down to two words: “transparency” and “accountability”.
Being clear with individuals how their personal data is being used.
And placing the highest standards of data protection at the heart of how you do business.
An issue for the boardroom
That means this is an issue for board level, whatever the size of your business.
Not least because under GDPR the regulator wields a bigger stick. For the most serious violations of the law, the ICO will have the power to fine companies up to twenty million Euros or four per cent of a company’s total annual worldwide turnover for the preceding year.
And as we’ve seen in well-publicised examples the cost to business of poor practice in this area goes above and beyond any fine we can impose. Losing your consumers’ trust could be terminal for your reputation and for your organisation.
We would all prefer a win-win outcome. A model where organisations take an approach to data protection which earns the trust of consumers in a more systematic way. And where that trust translates into competitive advantage for those who lead the charge.
Nowhere does that feel more relevant than for your sector.
GDPR and the tech sector
The UK tech industry is at the forefront of our vibrant digital economy, changing how we live our lives and offering huge potential for positive change and wide social benefit.
Data is the fuel that powers that economy and tech companies are involved at every level.
GDPR is a response to this evolving landscape, building on previous legislation but bringing a 21st century approach and delivering stronger rights in response to the heightened risks.
The right of an individual to be informed about use of their data; their right to access their information and move that information around; the right of rectification and erasure of data where appropriate; the right to remove consent; and the right to enable automated decisions to be challenged.
Good practice tools that the ICO has championed for a long time – such as privacy impact assessments and ensuring privacy by design – are now legally required in certain circumstances.
The ICO covers privacy impact assessments in its existing Privacy by Design guidance and the European Article 29 Working Party has also issued draft guidelines.
Being transparent and providing accessible information to individuals about how you will use their personal data is another key element of the new law and our privacy notices code of practice is GDPR-ready.
Increased responsibilities for data processors are another feature. Data processors, companies using personal data on behalf of others, will have specific legal obligations to maintain records of personal data and processing activities.
Data breach reporting will also change under the GDPR. You’ll be obliged to notify the ICO, within 72 hours, of a breach where it is likely to result in a risk to the rights and freedoms of individuals.
The widespread availability of personal data on the internet and advances in technology, coupled with the capabilities of big data analytics mean that profiling is becoming a much wider issue.
People have legitimate concerns about surveillance, discrimination and the use of their data without consent.
Data protection can be challenging in a big data context and some types of big data analytics, such as profiling, can be intrusive.
We explore many of these issues in detail in our recently updated paper on big data, artificial intelligence, machine learning and data protection.
We’ve also recently published a consultation paper on profiling under GDPR to which TechUK has responded. We’ll be using this to feed into the European Article 29 Working Party guidelines.
Harnessing the benefits of big data, AI and machine learning, as it relates to healthcare for example, will be sustained by upholding the key data protection principles and safeguards set out in GDPR.
Whilst the means by which personal data is processed are changing, the underlying issues remain the same. Are people being treated fairly? Are decisions accurate and free from bias? Is there a legal basis for the processing? These will remain key questions for us as a regulator under GDPR as they have been under the DPA.
The GDPR is a principles based law well equipped to take on the challenges of 21st century technology.
It aims to be flexible – protecting individuals from harm while enabling you to innovate and develop services that consumers and businesses want.
As data becomes the fuel powering the modern economy, so it becomes a key element of many of the debates in modern society.
Take the announcement last week by Elizabeth Denham of her opening of a formal investigation into the use of data analytics for political purposes.
Given the big data revolution I have mentioned it is understandable that political campaigns are exploring the potential of advanced data analysis tools to help win votes. The public have the right to expect that this takes place in accordance with the law as it relates to data protection and electronic marketing.
This is a complex and rapidly evolving area of activity and the level of awareness among the public about how data analytics works, and how their personal data is collected, shared and used through such tools, is low.
What is clear is that these tools have a significant potential impact on individuals’ privacy. It is important that there is greater and genuine transparency about the use of such techniques to ensure that people have control over their own data and the law is upheld.
We will provide an update on that investigation later in the year.
Rising to the challenge
I’ve talked about some of the challenges and opportunities GDPR brings for organisations. Likewise it is a moment for us at the ICO to reflect on how we do our work.
Clearly there are practical aspects such as preparing for a higher volume of activity given enhanced breach notification requirements.
But we are thinking more widely than that.
One example, again with particular relevance for the tech sector, is how we might be able to engage more deeply with companies as they seek to implement privacy by design.
How we can contribute to a “safe space” where companies can test their ideas. How we can better recognise the circular rather than linear nature of the design process.
Separate but related we need to become more comfortable about recognising good practice and drawing on exemplars.
We should be able to find ways to give credit where credit is due without that translating into a free pass for an individual organisation or practice. GDPR explicitly foresees wider use of tools such as codes of conduct and certification schemes, which potentially have an important role to play.
To deliver on the above and more broadly we also need to build our own tech know-how and capability. We are working on a new Technology Strategy which will outline our means of adapting to rapid technological change as it impacts information rights.
We are also committed to exploring innovative and technologically agile ways of protecting privacy.
And of course we need to exercise global reach and influence. Effective protection of the UK public’s personal information becomes increasingly complex as data flows across borders.
The ICO will continue to develop and deepen effective relationships with our international partners, reacting to changes in the global regulatory environment.
These goals among others feature in our new Information Rights Strategic Plan, being launched today by Elizabeth Denham, which sets out the ICO’s plan for the coming four years.
The tech sector will be a priority for our engagement as we look to seize these opportunities set out in the strategy.
With 12 months to go until GDPR takes effect in the UK, I hope I have offered a brief insight into some of the implications and impacts of GDPR on UK businesses.
I hope I have also signposted key actions you should be taking and key tools on which you can draw to rise to the challenge.
GDPR brings big changes, important changes. But GDPR is an evolution of the existing rules, not a revolution.
And as I said at the outset it is also a mirror of the changes in the practices and environment it seeks to regulate.
It is not GDPR which is pushing data protection up the public, political and media agenda. It is the changing nature of the world in which we live, and the ubiquity of data, which is causing society to reflect on the consequences for our personal information and for privacy itself.
You are at the heart of that change. Your response to the challenges and opportunities of GDPR will set a marker for other sectors.
You have a major stake in the enterprise of increasing data trust and confidence among the UK public. By putting the individual in genuine control of their own data you can help achieve that goal, delivering benefits for your consumers, your business and society as a whole.
The ICO has released the following statement concerning the recent cyber attacks on the NHS:
“All organisations are required under the Data Protection Act to keep people’s personal data safe and secure.
“Following the news on Friday afternoon that many organisations had been the subject of a cyber attack, the ICO made contact with both NHS Digital and the National Cyber Security Centre (NCSC).
“Our enquiries will continue this week and we note that NHS England have said they have no evidence that patient data has been accessed.
“Any appropriate next steps for the ICO will decided once these initial enquiries are complete.
“The ICO has published a useful blog on how to prevent ransomware attacks.”
This is a contributed piece by Brian Pennington, regional sales director, EMEA for Coalfire
From financial institutions such as Tesco Bank to tenured technology giants like Yahoo, it seems that no one is impervious to the mounting sophistications of cyber attacks. And in the case of the latter, these attacks pose more of a threat than just the compromising of user data. As a result, businesses need to seriously think about the hidden issues that a cyber-security breach can cause to a merger and acquisition (M&A) deal.
2016 was a big year for cybersecurity. From discussions pertaining to foreign infiltration in the US election to some of the largest scale cyber attacks ever witnessed, questions around the global state of cybersecurity dominated the media. As a result, there are increasing needs, demands and pressures for purchasing companies in M&A deals to calculate and identify cybersecurity weaknesses and breaches in the companies they intend to buy.
With so many moving parts involved in a large scale M&A; it is easy to overlook the cyber security element. With contracts, staffing, and a lot of legal frameworks to be worked through, cyber security can quickly fall down the list of priorities. This though can be a big flaw, as once a data breach is found – even if it took place years before an acquisition was even planned – the purchasing company can be held responsible and consequently suffer the penalties and charges that come from this.
These ticking time bombs can then go off, wiping millions or even billions off the value of an acquisition. For those that have spent time engineering the deal, it can turn a career defining moment into a nightmare. Having completed the deal, the people that should have been held accountable can, in fact, head off into the sunset, without needing to worry about what might happen next.
The modern-day M&A
One recent example of how a good deal can turn sour very quickly can be seen in Verizon’s deal to buy Yahoo. Having agreed to buy Yahoo for $4.8 billion, Verizon soon found out that all was not what it may have seemed as two large, successful and separate cyber attacks were announced to the public. With one billion accounts having been compromised in the largest of the attacks, Yahoo now has the unenviable title of suffering the largest cyber-attack ever recorded. Following this news, it was widely reported that Verizon may seek to have $1 billion removed from the sale price for Yahoo.
With large hacks such as these making headline news across the global, PR and marketing teams at Yahoo will be springing into action to save as much of the company’s reputation as possible. Having established itself as a world-renowned, and recognised internet brand, Yahoo is in serious danger of becoming synonymous with cyber hacks and data breaches.
The price you pay
Brand reputations are not the only area that can take a blow following a cyber-attack. The financial impact of a data breach can easily spiral into large sums of money, with some estimates placing the average cost to a company at $221 per stolen record in the US. If this applied to the smallest of Yahoo’s reported attacks the total would still be over $100 billion or close to the market capital of MasterCard! To make matters even worse, a company’s share price often nosedives after a breach, with the likes of TalkTalk taking a hit of 20% off its share price in the months after its widely broadcast cyber-attack. It is quite clear that forgoing cybersecurity checks can cost businesses billions financially and make a once priceless brand name, completely worthless.
So how can businesses empower and protect themselves from a cyber-attack when considering a potential M&A? Well there are three steps that can help protect the investment:
- Audit potential breaches: Carrying out a risk audit of potential breaches, assessing both the societal and financial factors that might increase the likelihood of becoming a cyber-target will help M&A analysts calculate whether the eventual acquisition is cost effective.
- Regulatory industry standards: Companies within certain industries are obliged to maintain a secure environment that will mitigate risk of cyber-attacks and protect user data. For instance, Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information do so in a secure fashion. Ensuring that potential purchases are compliant with these standards is essential in M&A deals.
- Seek expert help: Cyber security systems are complex and require in-depth knowledge and understanding of how to navigate them safely and effectively; without compromising existing structures. It is therefore highly recommended that M&A analysts enlist the help of cybersecurity consultants to advise them on the suitability of a potential purchase.
Cyberpolitics and societal security
As cyber criminals and their crimes become ever more complex and dangerous, it is in the best interests of the purchasing company during an M&A to calculate and identify cyber security weaknesses and breaches in the business they intend to buy. Furthermore, brands need to start planning earlier in the M&A process to carry out a full cyber security due diligence investigation and report to assess the dangers of a hack. Carrying out a full cyber risk assessment as part of an M&A not only lessens the financial impact on a deal but also ensures that a business’s reputation remains intact too.
Next time you are planning an M&A it is vital to get the experts in to ensure there are no hidden surprises from large cyber attacks. Working with cybersecurity experts to assist the M&A department could truly be the difference between disaster and prosperity in years to come.
Originally published by IDG Connect here.
6th march Manchester, UK.
Good morning, and welcome to Manchester. It’s cold and it’s grey, but for those of us who live around here, we kind of like it, and we’re proud it’s where the biggest data protection conference of the year takes place.
We’ve got a busy schedule today. Lots on GDPR, of course. Trevor Hughes from IAPP talking about the role of the data protection officer internationally. Practical workshops on everything from breach notification to consent. And a very engaging information market – the speakers’ corner looks sure to be a conversation starter, and don’t miss our experts talking about the law enforcement directive too.
So lots to engage you. Let’s get started by getting your grey matter warmed up: a quick general knowledge quiz. One question:
What links the following:
- the Labour Party;
- international weightlifting;
- the music you heard when I entered the room; and
- the ICO?
The answer is right before your eyes: all have performed right here at this venue. I’m not sure which of the four had the rowdiest audience…!
Manchester Central has been the home of the Data Protection Practitioners Conference for the best part of a decade, and I’m sure you’ll agree it’s an excellent venue. It was converted from a railway station built more than 125 years ago by Sir John Fowler, the architect famed for his work on the Forth Railway Bridge.
Sir John once said: “Engineers are not mere technicians and should not approve or lend their name to any project that does not promise to be beneficent to man and the advancement of civilization.”
DPOs in the mainstream
I think there’s something in that comment for us here today. About not merely being technicians. About looking to see how the projects we contribute to can be beneficial to citizens. How we can put the customer first.
I don’t think that’s too grand an aim. This is an exciting time to be in data protection. Like many of you, I’ve worked in this sector a long time. I remember when we were a back office function. When we often were seen as “mere technicians”. That seems a very long time ago.
My colleague Rob Luke, who you’ll hear from shortly, is speaking before an advertising conference later this week. Fifteen years ago, which advertiser would have invited the data protection regulator to their annual event? Who thought data protection when they booked a slot in the ad break during Coronation Street? But today, data protection is central to their work. Making the most of customer data. Combining big data sets. Finding new ways to better understand what consumers want, to track how they act or predict what they will do next.
Last week, we opened an inquiry into privacy risks arising from the use of data analytics for political purposes following public reports about the role of private firms in the Brexit referendum. We often find ourselves at the heart of many debates of modern society.
It’s an exciting time to work in data protection, whatever your sector, with real opportunities. We’ll talk a lot today about the practical aspects, from how GDPR will change things at your organisations, to the steps you can take to use the coming change in the law as an opportunity to inform your practices.
But let’s not lose sight of what good data protection can achieve. We have an opportunity to set out a culture of data confidence in the UK. We just need to keep in mind that when we lend our name to projects, we should think about how they can be of benefit to citizens.
Review of last 12 months
I think it’s fair to say that a recap of the files we’ve been involved in over the past twelve months can be characterised by organisations failing to put customers first.
Our work with WhatsApp and Facebook springs to mind. We all rely on digital services for important parts of our lives. But my office felt these apps were not taking enough responsibility for data protection. Companies have legal responsibilities to treat people’s data with proper care and transparency – to give them persistent control and choice.
Similarly the record fine we issued to TalkTalk. You could write an essay discussing the technical detail of the cyber-attack itself, but fundamentally, not enough respect – not enough care – was being given to the type of protection consumers would have expected of their personal information.
And without rehearsing the conversations we’ve had with parts of charity sector, there’s a similar theme: insufficient thought about the level of transparency donors would want, expect, or support.
They’re examples of organisations getting it wrong under the current Data Protection Act. GDPR is going to put even more of an onus on organisations to understand and respect the personal privacy rights of consumers.
Because while the General Data Protection Regulation builds on the previous legislation, it provides more protections for consumers, and more privacy considerations for organisations. It brings a more 21st century approach to the processing of personal data.
The GDPR gives specific new obligations for organisations, for example around reporting data breaches and transferring data across borders.
But the real change for organisations is understanding the new rights for consumers.
Consumers and citizens will have stronger rights to be informed about how organisations use their personal data. They’ll have the right to request that personal data be deleted or removed if there’s no compelling reason for an organisation to carry on processing it, and new rights around data portability and how they give consent.
On that subject, do take a look at the guidance on consent that is now out for consultation, and will be discussed at our workshop later today.
Accountability and breadth
At the centre of the GDPR is the concept of broader and deeper accountability for an organisation’s handling of personal data. The GDPR brings into UK law a trend that we’ve seen in other parts of the world – a demand that organisations understand, and mitigate – the risks that they create for others in exchange for using a person’s data. It’s about a framework that should be used to build a culture of privacy that pervades an entire organisation. It goes back to that idea of doing more than being a technician, and seeing the broader responsibility and impact of your work in your organisation on society.
Making it matter to the boardroom
I’ve already spoken to some of you this morning, and I hear what you’re saying. You understand why having your organisation accept more accountability for data protection matters. You want to change the culture of your organisation. But in many cases, you need to convince your senior management first. So, what can I give you today to help you make that case when you go back to your offices tomorrow?
The fines are the obvious headline. The GDPR gives regulators greater enforcement powers. If an organisation can’t demonstrate that good data protection is a cornerstone of their business policy and practices, they’re leaving themselves open to enforcement action that can damage their public reputation and possibly their bank balance. That makes data protection a boardroom issue.
But there’s a carrot here as well as a stick, and as regulators we actually prefer the carrot. Get data protection right, and you can see a real business benefit.
Accepting broad accountability for data protection encourages an upfront investment in privacy fundamentals, but it offers a payoff down the line, not just in better legal compliance, but a competitive edge. Whether that means attracting more customers or more efficiently meeting pressing public policy needs, I believe there is a real opportunity for organisations to present themselves on the basis of how they respect the privacy of individuals. Over time this can play a real role in consumer choice.
What the ICO is doing
Gandhi said the future depends on what we do in the present. So let me talk a little about what my office is doing now, to help you prepare for the future.
I’ve worked as a regulator in this field for more than twelve years and my focus has always been on making sure the regulator is relevant. On making sure we’re taking on that challenge of not being mere technicians but instead are making a difference to the organisations we regulate through education. Making a difference to the public, through giving them an avenue to file a complaint and by sanctioning the bad actors.
Each of us in the information rights field, on a daily basis, tries to make a difference to the public. Collectively, we do a good job: I think people have never been more aware of their rights, of what they can expect of the businesses and organisations they trust with their data. But consumer trust hasn’t followed that. An ICO survey last year showed only one in four UK adults trust businesses with their personal data. And I don’t believe the figure would be much higher for the public sector. As a regulator, it’s one of my jobs to give you the tools and the support to turn that around.
I want to see comprehensive data protection programs as the norm, organisations better protecting the data of citizens and consumers, and a change of culture that makes broader and deeper data protection accountability a focus for organisations across the UK. I think that’s achievable.
We’ll be shortly announcing work we’ll be doing to contribute to that. We want to support independent research that helps people better navigate the digital world. Our research and grants programme will dedicate funds over the next five years to engaging the research community in finding ways to help consumers. More details in due course.
And of course we need to be looking to the horizon, to what might exist beyond GDPR.
Fourteen months ago I was writing a speech for a different audience, in a different role. My appearance was at the Canadian annual privacy and security conference, as information and privacy commissioner for British Columbia. I was talking about the challenges of a digital economy that required data to flow across borders, where different legal systems and cultural norms about privacy make this a complicated undertaking. More specifically, I spoke about how changes within the EU affect those outside of it, particularly around adequacy.
How familiar does that sound today? The UK EU referendum decision means we’re facing the same challenges. The UK’s digital economy needs data to flow across borders: how do we make sure that can happen? How can we foster economic growth while still respecting citizen’s rights?
When the government comes to answer those questions beyond the implementation of GDPR in 2018, we expect to be at the centre of many conversations, speaking up for continued protection and rights for consumers, and clear laws for organisations. And addressing the strong data protection laws we’d need if we want to keep the UK’s approach at an equivalent standard to the EU.
Which brings us back to today. The GDPR is a strong data protection law. It gives consumers more control over their data. And it includes new obligations for organisations.
Today is about learning more about those obligations, more about data protection best practice, more about how to get it right.
Today is about helping you make the best use of tomorrow.
By Andrew Barratt, QSA, PCIP. Managing Director, International/Managing Principal, Payments, Application Validation
Coalfire; Manchester, UK, http://www.coalfire.com
Phew, the title of this post alone sounds like it could be quite a lot to deal with!
So what is DevOps? DevOps is simply the blending of infrastructure operations processes and software development to enable faster changes to business applications/technology. These processes share a lot of ideology with the Agile & Lean camps but are more fundamentally trying to bridge the traditional divide between the development world and the IT operations/Service management teams.
In practice, DevOps can mean a lot of different things to different audiences and sometimes it can be difficult to apply compliance requirements without getting a good understanding of what DevOps is for your company.
Terms such as ‘treat your code as infrastructure’ can often scare the life out of traditional auditors along with the fear that with rapid release and change comes rapid loss of control. These shouldn’t be scary but should be embraced and understood. In audit parlance these processes can become embedded, configurable application controls that require less substantive audit testing and sampling when under scrutiny and allow the focus to be on how they are designed to be a security control.
DevOps environments typically make heavy(think obsessive!) use of automation tools to enable rapid change and release processes to be possible at large and frequent scale. This is typically where the confusion starts to begin when evaluating these environments for security and compliance purposes. Typical service management controls such as change management on the surface may appear to have been cast aside in the rush to ‘be DevOps’. This rush to implement tooling can often lead to the underlying processes being weak or ill conceived. However this is common in other disciplines too. Poor planning = poor performance.
DevOps done well can bring a great set of tools and capability for building secure, scalable and compliant environments. Building on modern source control, streamlining change control and building dependency on the tools authentication and access control can quickly be used to demonstrate the control requirements of many compliance frameworks including the PCI DSS. Just doing things faster or without lots of paper forms and signatures on doesn’t necessarily equate to non-compliance.
The implementation of PCI DSS requirements 2 and 6 can be rapidly transformed using a DevOps approach. If we look at requirement 2 as being primarily focused on hardened configuration management traditionally seen as an ‘Ops’ area, whilst Requirement 6 focuses on change management and software development.
There is nothing fundamentally in these requirements (or in other areas of the DSS) that prevents a DevOps environment being used to support and implement PCI compliance if done carefully. Whilst the security and compliance mandate might tweak certain implementation decisions most of the tools marketed for ‘DevOps’ support building workflows that can be used for approval / review decisions and capture/log the necessary approval processes to support compliance. As the level of automation increases so can the ease of which compliance requirements be met.
Recently I worked with a client that had invested heavily in building their dev-ops tooling but had built in PCI requirements as part of this process so also incorporated automation of documentation production too. Their focus was, and still is, to automate as much as possible into the release process to minimize the failure of an activity. Every time a new release was pushed all configuration documentation was also updated automatically (supporting requirement 2) .
This particular client used a software issue and tracking tool that could be used to demonstrate management approval for changes as well as to show that code review processes had been followed. As they continued to improve they were investigating automation of their code review processes so that static analysis tools were orchestrated immediately after changes were approved as part of the build process.
One of the biggest challenges they faced initially was the size of their team, they were small and specialist and in the past had struggled with creating segregation of duties between their test/production systems. Moving to DevOps helped with this significantly. No developers were required to have access to production systems in any manner as the build and release process was entirely orchestrated by tools with an approval workflow that the developers couldn’t authorize alone. The tools were the only thing with the ability to push to their production systems and the workflow done under management approval. These tools were treated the same way as other in-scope systems but the overhead from this was so minimal that it enabled them meet security requirements without complicated manual processes and multiple sets of access permissions.
2017 will be a year of action for many companies, as they address the realities of a fast-moving customer-led and digital-centric market,” said Cliff Condon, chief research and product officer at Forrester.
“Empowered customers are forcing the hand of virtually every industry. And so the question for most companies and business leaders is not if they will respond to these market dynamics, but when and how. Inaction presents immediate revenue risk or much worse a threat to a company’s existence
The top 15 dynamics that will shape 2017 are:
- The extent to which businesses will need to restructure to adapt to a customer-led market.
- How and how many CMOs can successfully evolve to meet new and expansive leadership demands.
- The likelihood that CIOs will rise to the challenge of leading digital business strategies.
- How CEOs will handle business unit and product leadership in a market dominated by empowered customers and disruptors.
- How transitional roles like chief data officer, chief digital office, and chief customer officer will fare.
- How businesses will react to acute cyber risk to maintain customer trust.
- Determining the scarce but critical talent required to lead in the age of the customer and how that will place significant pressure on both talent management and talent acquisition.
- Identifying new levels of revenue risk directly attributed to underperforming or even mediocre customer experiences.
- The extent to which companies are able to measure and operationalize emotion, which continues to be a primary driver of customer affinity and spend.
- How companies are designing signature moments to capture customers’ hearts, minds, and spend.
- The beginnings of a new technology revolution that will reshape how businesses operate and interact with customers.
- The role augmented reality and virtual reality will play in 2017 and where both are in their evolution.
- The implementation and impact of the internet of things in 2017.
- The impact and evolution of artificial intelligence to deliver contextually rich, personalized experiences.
- The next steps in cloud computing to change the architecture and economics of technology.
To gain more insights on the dynamics that will shape 2017, download Forrester’s predictions guide.
Technavio’s market research analysts expect the global BYOD security market to reach over $337 million between 2016 and 2020.
The increased use of mobile devices, triggered by the growing need for employee mobility, is the fundamental driving force behind growth in this market.
The increase in employee mobility and the rising adoption of the Bring-Your-Own-Device (BYOD) policy is leading to the increased use of mobile devices. Enterprises are increasingly adopting BYOD security solutions to secure their networks from growing security threats and to provide secure access to confidential information.
North America accounts for more than 36% of the market share to dominate the global BYOD security market. The growing awareness among enterprises about the benefits of using BYOD security solutions on mobile devices coupled with the rise in the number of cyber-attacks and malware are some of the key factors contributing to the growth in the BYOD security market in the Americas during the forecast period.
The growing popularity of cloud-based BYOD security is the latest trend in the global BYOD security market. Cloud-based BYOD security does not require any hardware or software and can be controlled remotely, making it cost-effective for the end-users. Also, it has a faster response rate to the new security threats and unauthorized activities as well as allows companies to use software products on a pay-per-use basis and are cost effective. Limited hardware infrastructure, less dependency on internal IT personnel, faster implementation of IT solutions, no licensing costs, and low maintenance costs are some of the advantages of a cloud-based BYOD security system,” says Amrita Choudhury, Lead Analyst, ICT, Technavio Research.
Currently, the Mobile Content Management (MCM) segment occupies almost 52% of the market share to dominate the global BYOD security market. MCM is gaining prominence among large enterprises, government organizations, and small and medium-sized business (SMBs) because of the increased acceptance of the BYOD policy.
Some vendors in the MCM market are even providing additional security features in the products that they are offering to gain consumer interest and market shares. For instance, AirWatch provides the Secure Content Locker that comprises of secure storage containers to safeguard data stored on mobile devices.
The key vendors in the global BYOD security market include Citrix Systems, Good Technology, IBM, MobileIron, and VMware. The global BYOD security market highly fragmented owing to the presence of many international, regional, and local vendors. Established BYOD security solution vendors are likely to acquire small vendors to expand their product portfolio and increase their market share.
During the forecast period, the level of vendor competition is likely to intensify with product and service extensions, technological innovations, and M&As.
An Imperva Infographic
According to BDO’s analysis of risk factors listed in the most recent 10-K filings of the 100 largest U.S. retailers, risk associated with a possible security breach was cited unanimously by retailers, claiming the top spot, up from the 18th spot in 2007.
Since major retail security breaches began making national headlines in 2013, retailers have become acutely aware of the growing cyber threat and cyber-related risks. Between new point-of-sale systems and evolving digital channels, the industry faces unique vulnerabilities: Retailers are responsible for safeguarding consumer data as well as their own, in addition to protecting against potential gaps in security related to third-party suppliers and vendors.
2016 marks the 10th anniversary of our retail risk factor analysis, and throughout the decade, we’ve seen the retail landscape undergo a dramatic evolution in response to the recession, new and maturing e-commerce channels and evolving consumer preferences,” said Doug Hart, partner in BDO’s Consumer Business practice. “Retailers over the years have proven to be in tune with the industry-wide issues and trends that could pose risks to their businesses, and they are clearly not tone deaf when it comes to reacting to the urgency of cybersecurity
The following chart ranks the top 25 risk factors cited by the 100 largest U.S. retailers:
|Top 20 Risks for Retailers||2016||2015||2014|
|General Economic Conditions||#1||100%||#1||100%||#1||100%|
|Privacy Concerns Related to Security Breach||#1t||100%||#4t||99%||#8||91%|
|Competition and Consolidation in Retail Sector||#3||98%||#1t||100%||#3||98%|
|Federal, State and/or Local Regulations||#4||96%||#1t||100%||#2||99%|
|Natural Disasters, Terrorism and Geo-Political Events||#5||94%||#7||96%||#13||87%|
|Implementation and Maintenance of IT Systems||#6||93%||#4||99%||#7||92%|
|U.S. and Foreign Supplier/Vendor Concerns||#6t||93%||#6||98%||#4||96%|
|Labor (health coverage, union concerns, staffing)||#9||91%||#7t||96%||#5||94%|
|Impediments to Further U.S. Expansion and Growth||#10||90%||#12t||92%||#17||78%|
|Dependency on Consumer Trends||#11||88%||#9||95%||#6||93%|
|Consumer Confidence and Spending||#12||87%||#15||89%||#8t||91%|
|Credit Markets/Availability of Financing and Company Indebtedness||#13||85%||#11||94%||#11||89%|
|Failure to Properly Execute Business Strategy||#14||82%||#12||92%||#11t||89%|
|Changes to Accounting Standards and Regulations||#15||76%||#14||90%||#13t||87%|
|Loss of Key Management/New Management||#16t||73%||#19||80%||#16||79%|
|Marketing, Advertising, Promotions and Public Relations||#18||66%||#25||68%||#24||64%|
|Consumer Credit and/or Debt Levels||#19||62%||#27||65%||#23||65%|
Additional findings from the 2016 BDO Retail Risk Factor Report:
Cyber Risks Include Compliance Measures
As the cyber threat looms larger, retailers are bracing for new and emerging cybersecurity and data privacy legislation. Risks associated with cyber and privacy regulations were cited by 76 percent of retailers this year. This is in line with the findings from the 2016 BDO Retail Compass Survey of CFOs, in which nearly 7 in 10 retail CFOs said they expected cyber regulation to grow in 2016. These concerns have been highlighted by President Obama’s recently unveiled Commission on Enhancing National Cybersecurity and continued debate in Congress over information sharing between the government and private industry.
Retailers have not escaped regulatory scrutiny. The industry is also subject to Europay, Mastercard and Visa (EMV) standards that bolster credit card authentication and authorization. Industry analysts estimate that just 40 percent of retailers are compliant with EMV standards despite the Oct. 1, 2015 deadline.
“Mandating EMV chip-compliant payment systems is an important first step in shoring up the industry’s cyber defenses, but it’s just the tip of the iceberg,” said Shahryar Shaghaghi, National Leader of the Technology Advisory Services practice group and Head of International BDO Cybersecurity. “Online and mobile transactions remain vulnerable to credit card fraud and identity theft, and POS systems can still be hacked and provide an access point to retailers’ networks. New forms of malware can also compromise retailers’ IT infrastructure and disrupt business operations. Every retailer will experience a data breach at some juncture; the real question is what mechanisms have been put in place to mitigate the impact.”
E-Commerce Ubiquity Drives Brick & Mortar Concerns
Impediments to e-commerce initiatives also increased in ranking, noted by 57 percent of retailers in 2016, a significant contrast from 12 percent in 2007. In 2015, e-commerce accounted for 7.3 percent of total retail sales and is continuing to gain market share.
As e-commerce grows and businesses strive to meet consumers’ demand for seamless online and mobile experiences, retailers are feeling the effects in their physical locations. The recent wave of Chapter 11 bankruptcies and mass store closings among high-visibility retailers has raised concerns across the industry. Ninety percent of retailers are worried about impediments to growth and U.S. expansion this year. Meanwhile, risks associated with owning and leasing real estate jumped 14 percentage points to 54 percent this year.
Heightened worries over the impact of e-commerce on physical locations are far reaching, driving concerns over market competition for prime real estate and mall traffic to rise 19 percentage points to 46 percent. Meanwhile, consumer demand for fast shipping fueled an uptick in risks around the increased cost of mail, paper and printing, rising 10 percentage points from seven percent in 2015 to 17 percent this year.
General Economic Conditions Hold Weight
General economic risks have been consistently top of mind for retailers throughout all ten years of this survey. Even at its lowest percentage in 2008, this risk was still the second most cited, noted by 83 percent of companies.
Despite the fact that since 2013, general economic conditions have remained tied for the top risk, concerns about specific market indicators have receded.
For more information on the 2016 BDO Retail RiskFactor Report, view the full report here.
About the Consumer Business Practice at BDO USA, LLP
BDO has been a valued business advisor to consumer business companies for over 100 years. The firm works with a wide variety of retail and consumer business clients, ranging from multinational Fortune 500 corporations to more entrepreneurial businesses, on myriad accounting, tax and other financial issues.
This is designed to fraudulently obtain financial gain from either the affected user or third parties by emptying bank accounts, or trading confidential data, etc. Crimeware most often starts with advanced social engineering which results in disclosed info that leads to the crimeware being installed via programs that run on botnets which are zombie computers in distant places used to hide the fraudsters I.P (internet protocal) trail. Usually the victim does not know they have crimeware on their computer until they start to see weird bank charges or the like, or an I.T. professional points it out to them. Often times it masquerades as fake but real looking antivirus software demanding your credit card info in an effort to then commit fraud with that info.
The term generally refers to the deployment of viruses that clandestinely observe or destroy data in the computer systems of government agencies and…
View original post 1,143 more words
Beazley, a leading provider of data breach response insurance, today released its Beazley Breach Insights 2016 findings based on its response to over 2,000 breaches in the past two years. The specialized Beazley Breach Response (BBR) Services unit responded to 60% more data breaches in 2015 compared to 2014, with a concentration of incidents in the healthcare, financial services and higher education sectors.
- Breaches caused by either hacking or malware nearly doubled in relative frequency over the past year. In 2015, 32% of all incidents were caused by hacking or malware vs. 18% in 2014.
- Unintended disclosure of records – such as a misdirected email – accounted for 24% of all breaches in 2015, which is down from 32% in 2014.
- The loss of non-electronic physical records accounted for 16% of all breaches in 2015, which is unchanged from 2014.
- The proportion of breaches involving third party vendors more than tripled over the same period, rising from 6% of breaches in 2014 to 18% of breaches in 2015.
Beazley’s data breach statistics are based on 777 incidents in 2014 and 1,249 in 2015.
We saw a significant rise in incidents caused by hacking or malware in the past year,” said Katherine Keefe, global head of BBR Services. This was especially noticeable in healthcare where the percentage of data breaches caused by hacking or malware more than doubled
Ransomware on the rise in healthcare
Hackers are increasingly employing ransomware to lock up an organization’s data, holding it until a ransom is paid in nearly untraceable Bitcoin. Hollywood Presbyterian Hospital in Los Angeles reported suffering a ransomware attack in February 2016 and ultimately paid the hackers $17,000 in Bitcoin. A year earlier, the FBI had issued an alert warning that ransomware attacks were on the rise.
This trend is borne out by Beazley’s data. Breaches involving ransomware among Beazley clients more than doubled to 43 in 2015 and the trend appears to be accelerating in 2016. Based on figures for the first two months of the year, ransomware attacks are projected to increase by 250% in 2016.
Clearly, new malware programs, including ransomware, are having a big impact, said Paul Nikhinson, privacy breach response services manager for BBR Services. Hacking or malware was the leading cause of data breaches in the healthcare industry in 2015, representing 27% of all breaches, more than physical loss at 20%
Healthcare is a big target for hackers because of the richness of medical records for identity theft and other crimes. In fact, a medical record is worth over 16 times more than a credit card record.”
Higher education also experienced an increase in breaches due to hacking or malware with these accounting for 35% of incidents in 2015, up from 26% in 2015.
Colleges and universities are reporting increased “spear phishing” incidents in which hackers send personalized, legitimate-looking emails with harmful links or attachments. The relatively open nature of campus IT systems, widespread use of social media by students and a lack of the restrictive controls common in many corporate settings make higher education institutions particularly vulnerable to data breaches.
In the financial services sector, hacking or malware was up modestly to 27% of industry data breaches in 2015 versus 23% in 2014. Trojan programs continued to be a popular hacking device.