• Assess
      Consult - Evaluate - Review  
    Review and document
    requirements or
    existing solutions

  • Advise
    Strategy - Recommend - Inform
    Produce a strategy,
    migration or implementation
    plan


  • Project Manage
    and Implement
    services and solutions
    Action
    Implement - Commission - Maintain

How to Prepare for the GDPR


Share this story

Your first priority for preparation in terms of GDPR should be to educate yourself and ensure others in your organisation who has responsibility for data. It doesn’t matter about the size or legal entity of a business – we must all follow the same rules when it comes to handling data.

Don’t hesitate, assess, take action now and be ready.

Here are 10 considerations to help you prepare for the GDPR:

The GDPR is a law about Data Protection, based on a set of common-sense principles:

  • A “right to be forgotten”: When an individual no longer wants her/his data to be processed, and provided that there are no legitimate grounds for retaining it, the data will be deleted. This is about protecting the privacy of individuals, not about erasing past events or restricting freedom of the press
  • Easier access to your data: Individuals will have more information on how their data is processed and this information should be available in a clear and understandable way. A right to data portabilitywill make it easier for individuals to transmit personal data between service providers
  • The right to know when your data has been hacked: Companies and organisations must notify the national supervisory authority of data breaches which put individuals at risk and communicate to the data subject all high risk breaches as soon as possible so that users can take appropriate measures
  • Data protection by design and by default: ‘Data protection by design’ and ‘Data protection by default’ is now essential elements in EU data protection rules. Data protection safeguards will be built into products and services from the earliest stage of development, and privacy-friendly default settings will be the norm – for example on social networks or mobile apps
  • Stronger enforcement of the rules: Data protection authorities will be able to fine companies who do not comply with EU rules up to 4% of their global annual turnover or £17,000,000 – whichever is more

Understand the definition of ‘personal data’.

Personal Data means any information relating to an identified or identifiable natural person (a “data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular, by reference to an identifier such as a name, an identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. ~Article 4(1) of the EU GDPR 2016/679.

Read the New Data Protection Bill.

You can find the ‘The New Data Protection Bill: Our Planned Reforms’, on the government website. Insert the link that you already have, into the above title.

The New Data Protection Bill covers the following 4 topics:

  • The Digital Economy
  • Our Data Protection Reforms
  • Implementing the Reforms
  • Looking ahead

Seek legal advice if you are unsure.

This article offers insights and guidance about the GDPR. It is highly recommended that you seek your own legal advice in preparation for the big change.

If you have a Website

Data on a website can be anything from a simple enquiry form, an ecommerce/online sales website to online user accounts that have details saved. Make sure that your website is encrypted with an SSL certificate and that any data gathered is stored in a safe and secure environment once it reaches you.

Identify where your company is storing data, for example:

  • Your website
  • Telesales – do you store names and numbers for your agents to call?
  • Direct mail – do you have completed order forms stored away with contact details?
  • Customer service departments – calls taken from potential customers and those recorded details
  • Personal contact with people – the exchange of business cards from a tradeshow or exhibition

Prepare your staff and make them well aware of the changes that are coming. Make sure that they understand the principles of good data protection and that they don’t write down details of people on a piece of paper that could go astray, end up in the bin or taken home on computers or memory sticks where information could get stolen.

Evaluate your environment and how you document personal data – where did it come from, who have you shared it with? How will you audit the data? Review current policy notices and put a plan in place – procedures and timescales.

Be compliant, review your practices and make sure that, to the best of your ability, you look after the data as if it were your own. Make sure your organisation’s privacy policy of how you handle data is compliant with the new rules and is up to date.

Decide how you will be able to prove that your data is secured safely and how to seek consent moving forwards.

The General Data Protection Regulation will apply to all companies based in the EU and those with EU citizens as customers. It has an extraterritorial effect, so non-EU countries will also be affected. Even though the UK is planning to leave the EU, the UK will still need to comply with the GDPR.

Do you need to employ a Data Officer?

A data protection officer (DPO) is an enterprise security leadership role required by the General Data Protection Regulation (GDPR). Data protection officers are responsible for overseeing data protection strategy and implementation to ensure compliance with GDPR requirements. A DPO would be recommended for any organisation that processes or stores large amounts of personal data, whether for employees, individuals outside the organisation, or both. Seek advice as to whether your company should employ a DPO or make sure someone in the business has responsibility for Data Protection.

What have you done so far to prepare for the GDPR?

If you need help, support or just have a GDPR question you can call us 0203 319 3930 or drop me an email.

Last week….

GDPR and your Business

Next week…

Cyber security and data protection.


The GDPR and Your Business


Share this story

If you are a business that handles data, either as a processor or a controller, make sure you put the 25th May 2018 in your diary. Most businesses are.

Why?

A new data law coming, consider it to be the existing Data Protection Act… but on steroids. If you breach the new rules, or show that you haven’t got sufficient policies, procedures, training or protection in place, your business could be facing a significant fine.

Currently, the maximum fine the ICO (Information Commissioner’s Office) can issue is £0.5m. Larger fines of up to £17m (€20m) or 4% of global turnover will be allowed, enabling the ICO to respond in a proportionate manner to the most serious of data breaches.

What is the GDPR?

Just in case you weren’t aware, the EU General Data Protection Regulation (GDPR) is a new law about data protection. ‘information age’ revealed that 55% of small businesses are unfamiliar with the GDPR. If you have a business that handles data, take action now and be prepared.

The GDPR is a law about Data Protection, based on a set of common-sense principles:

  • The Right to be Informed
  • The Right of Access
  • The Right to Rectification and Right to Be Forgotten
  • The Right to Restrict processing
  • The Right to Object
  • The Right to Data Portability

We are doing it, you should be too.

Network & Security are registered with the ICO as a Data Processor for its clients. With out experience, Network & Security are ready to be compliant with upcoming changes in policy, procedures or any data protection regulations or laws. We understand the importance of these laws (and processes/procedures that come with it) and appreciate it’s not just how they affect the business but those that work within the company too.

Where can you find out more about the GDPR?

The UK government’s Department for Digital, Culture, Media & Sport has created a New Data Protection Bill: Our Planned Reforms.

In the Bill’s foreward, the RT Hon Matt Hancock MP, Minister of State for Digital explained the following:

  • A generation ago Parliament passed the Data Protection Act, since then, digital technology has transformed almost every aspect of people’s lives
  • It has brought huge advantages: social advantage, bringing the world closer together, and economic advantage, transforming our economy
  • For all its many benefits, there are also concerns. Parents worry that their children may be vulnerable online in ways they don’t understand
  • Customers worry what companies are doing with their data. Citizens worry that others might intrude on their privacy online
  • To protect people’s privacy, while allowing and encouraging the innovation that digital technology allows, they must balance freedom and responsibility online
  • The Data Protection Act has done that well, providing people with more control over how their personal information is used and limiting processing to the purpose for which it was collected, subject to various public interest exemptions
  • There are stronger protections in the UK than most, and the regulatory arrangements are often seen as the gold standard
  • While people should all be assured that data is well protected in the UK, change is needed. The technology, and society has changed
  • The Data Protection Bill, promised in the manifesto and announced in the Queen’s speech, will bring our data protection laws up to date
  • It will both support innovation by ensuring that scientists and businesses can continue to process data safely
  • It will ensure that people remain assured that their data is safe as they move into a future digital world based on a system with more accountability, but less bureaucracy
  • The Bill includes tougher rules on consent, rights to access, rights to move and rights to delete data
  • Enforcement will be enhanced, and the Information Commissioner given the right powers to ensure consumers are appropriately safeguarded
  • The Bill will also bring EU law into our domestic law. On 23 June 2016, the EU referendum took place and the people of the United Kingdom voted to leave the European Union
  • Until exit negotiations are concluded, the UK remains a full member of the European Union and all the rights and obligations of EU membership remain in force
  • During that period the government will continue to negotiate, implement and apply EU legislation. The outcome of these negotiations will determine what arrangements apply in relation to EU legislation in future once the UK has left the EU
  • Bringing EU law into our domestic law will ensure that the government help to prepare the UK for the future after they have left the EU
  • The EU General Data Protection Regulation (GDPR) and the Data Protection Law Enforcement Directive (DPLED) have been developed to allow people to be sure they are in control of their personal information while continuing to allow businesses to develop innovative digital services without the chilling effect of over-regulation
  • Implementation will be done in a way that as far as possible preserves the concepts of the Data Protection Act to ensure that the transition for all is as smooth as possible, while complying with the GDPR and DPLED in full
  • When it comes to law enforcement, the Bill will ensure that the data of victims, witnesses and suspects of crimes, are protected in the context of criminal investigations and law enforcement action
  • It will ensure that criminal justice agencies can continue to tackle crime and terrorism whilst protecting the data rights of those involved in criminal investigations or proceedings. Criminals and terrorists show no respect for international borders so the Bill will ensure that UK criminal justice agencies work effectively with counterparts in other countries
  • The Data Protection Bill will allow the UK to continue to set the gold standard on data protection. The UK already has the largest internet economy in the G20. This Bill will help maintain that position by giving consumers confidence that Britain’s data rules are fit for the digital age in which we live

The New Data Protection Bill: Our Planned Reforms covers the following 4 topics:

  1. The Digital Economy.
  2. Our Data Protection Reforms.
  3. Implementing the Reforms.
  4. Looking ahead.

Find out more about the New Data Protection Bill: Our Planned Reforms.

We will be returning to this topic next week – ‘How to prepare for the GDPR’.


Front Page 2


Mobile Device Security



Front Page 1


FrontPage 1

Illustration of wordcloud tags of malware ransomware concept


Finish It! | ActionCOACH Events


Great Opportunity to get information from a Serial Entrepreneur with a great track record and experience !

record.http://ift.tt/2vEtLMd
http://ift.tt/2vEtLMd



Send mixed messages: Mozilla wants you to try its encrypted file sharing


Interesting new Send service being tested by Firefox.
Businesses we deal with dislike this type, due to the lack of auditability, of sending service, but the industry is screaming out for a standard file share/sending type of service.

There are vendors available, of course, but different businesses use different vendors – perhaps its time to look at TLS on email and increase the storage space the receiving capacity of email in general.

http://ift.tt/2udrr1k
http://ift.tt/2udrr1k



Twenty-five Percent of Emails Deemed Unsafe – Dark Reading


A short video from Mimecast showing, from their recent Security report, that they deem around 25% of emails to be unsafe. Not surprising, and I would have put this figure, personally, a lot higher than this, considering that, by a fair percentage, a popular attack vector for users is through email.

Even with education, anyone can make an error by clicking on a malicious link or file in an email.

Do you use a cloud filtering service ? There are clear benefits of doing so, even more so if your email is housed internal to your business.

http://ift.tt/2vv2XAK
http://ift.tt/2vv2XAK



“Petya” Ransomware Goes Global


“Petya” Ransomware goes Global

There is a new strain of Ransomware from its original called Petya. Some sites out there are calling it completely new, NotPetya, and others see it is a variant and calling it PetWrap.

Whatever the case, the advice is always the same, look at how this is reportedly spreading, and put measures in place to mitigate as much as you possibly can.

According to many reports, the Ukraine has been badly hit, and it has been seen in several high profile UK business organisations.

Its also been confirmed that this Ransomware uses the Eternal Blue exploit, which was originally thought to have been developed by the US NSA as a digital weapon, and then subsequently leaked online by the hacker group known as Shadow Brokers.

Businesses who have not put measures in place such as disabling the SMB version 1 protocol (deprecated) or implemented the MS17-010 Microsoft Patch should do so now or as soon as possible. We believe this wont be the last exploit of this nature, and although simple measures such as black-holing the domain name used for the original Wannacry outbreak, and blocking known C&C servers, wont be effective and you could be fighting a reactive battle.

Businesses need to be robust in their security measures, have a solid response plan and be reactive as they can be to these modern threats otherwise these strains will continue to develop and proliferate. Don’t delay security patching.

What can you do ? Read the full article below – or contact us today.
http://ift.tt/2sQzRJC



Confirmed: Intel patches remote execution hole that’s been hidden in its…


Intel have confirmed that a patch will be released that will fix a remote code execution vulnerability (discovered in March 2017) which has been in its processors since 2009. This vulnerability allows hackers exploiting the flaw to silently snoop on a vulnerable machine’s users, make changes to files and read them, install rootkits and other malware, and so on. This is possible across the network, or with local access. #ITSecurity
http://ift.tt/2qsGqPf



MilkyDoor Infests 200 Android Apps


About 200 unique Android apps have been embedded with the MilkyDoor backdoor, which is built to attack an enterprise’s internal networks, private servers, and ultimately, corporate assets and data. #ITSecurity
http://ift.tt/2oLT6yV



Interpol Spots Thousands of C&C Servers Across Asean


Officers found 8800 C&C servers across eight countries, responsible for financial malware, ransomware, Distributed Denial of Service (DDoS) attacks and spam. #ITSecurity #Ransomware
http://ift.tt/2plccQa



RansomAware


Ransomware cybercriminals took in about $1 billion last year, based on money coming into Ransomware-related Bitcoin wallets. #Ransomware
http://ift.tt/2p3DOZB



http://ift.tt/2q4nXbK…


The Top 5 Resources to Protect your Business Against the threat of Ransomware in 2017 #ITSecurity #Ransomware
http://ift.tt/2q65Jt7



The phishing craze that’s blindsiding users – Health Security Solutions


Phishing for Homographs – fraudsters using Cyrillic characters to direct you to a site that doesn’t redirect – users beware. #ITSecurity – If you get an email from someone you don’t know, not expecting, or you are suspicious – simple answer is to type the URL in, don’t click !
http://ift.tt/2p0Okkh



Webroot antivirus mistakenly flags Windows as malware


Rough day for users running Windows and trying to use Facebook if you use Webroot…. #ITSecurity
http://ift.tt/2q0dj5Z



The Human Factor: Technology Changes Faster Than Humans


Although we all realise it, how technology is advancing more than human nature, its an interesting article on how human nature is responsible for around 95% of Security Incidents #ITSecurity
http://ift.tt/2oqMvyB



SMSVova Spyware Hiding in ‘System Update’ App Ejected From Google Play…


SMSVova hides inside a bogus app called System Update and is sent commands by attackers via inbound SMS messages to carry out functions such as setting and changing passwords for the spyware and retrieving location data. #ITSecurity
http://ift.tt/2p9GC5Q



Three apologises after network problems – BBC News


Although its a network issue and users have been told to ignore SMS messages from unknown senders – is this to do with the recent data breach they suffered ? #ITSecurity
http://ift.tt/2oDkPSo



How Marketers Can Help Protect Their Firms From a Cybersecurity Attack


How Marketers Can Help Protect Their Firms From a Cybersecurity Attack #ITSecurity
http://ift.tt/2pcbVPn



Commodity Ransomware Is Here


With “Philadelphia,” a slick ransomware-as-a-service interface that enables almost anyone to launch a sophisticated ransomware campaign, suddenly, deploying ransomware is easy as ordering a pizza. The criminal developers behind Philadelphia even had the heart to offer a “mercy” feature should a victim plead for access to ransomed family photos of lost family and friends.
Welcome to the new world of commodity malware! #beRansomaware #ITSecurity
http://ift.tt/2pjM19d



7 dangerous subject lines to watch for and ways to avoid email scams


A large proportion of attacks by hackers are email borne. Users should be educated to, as much as they can do, determine if the email is legitimate. Ask simple questions, am I expecting it, is it asking me to open a link or download something. If in doubt – contact your #ITSecurity department.
http://ift.tt/2nSGIxk



Malvertising on iOS pushes eyebrow-raising VPN app – Malwarebytes Labs


There is a preconceived idea that malvertising mostly affects the Windows platform. This is a short article that shows an emerging scareware campaign that runs on Apple iOS which pushes a VPN APP. #ITSecurity
http://ift.tt/2nKUb9s



7 Ways Hackers Target Your Employees


This is a great article detailing a number of different ways that hackers target your employees. Realistically its on all levels and there is no bar for an attacker #ITSecurity
http://ift.tt/2oHUBCn



Latest phishing tactics: infected PDFs, bogus friend requests, fake HR…


There’s good and bad news on the phishing front #ITSecurity
http://ift.tt/2n3iuml



The 6 Riskiest Social Media Habits to Avoid at Work


Social media is a popular gateway for hackers to access corporate networks, and employee behavior is driving the trend.
http://ift.tt/2nqZIXa



GDPR consent guidance


The Information Commissioners Office is looking for active feedback on its draft guidance for GPDR Information Commissioner’s Office (ICO) #GPDR
http://ift.tt/2lZpS2W



TeamViewer stopped working? Let me guess, your ISP is TalkTalk…


Just in case you were wondering why #Teamviewer is no longer working.
http://ift.tt/2mjsCUO



Virus Bulletin :: Why the SHA-1 collision means you should stop using…


Interesting read #ITSecurity
http://ift.tt/2miwVQx



Preinstalled Malware Targeting Mobile Users | Check Point Blog


http://ift.tt/2mhOIr3



Top 5 Free Intrusion Detection Tools for Enterprise Network


http://ift.tt/2mJS7Cg



Resetting Local Account Passwords


A simple Powershell script to assist in resetting local Computer account passwords remotely. #ITSecurity
http://ift.tt/2mFRkSR



February 2017: The Month in Ransomware


A look at Feb 2017 and the Ransomware effect #ITSecurity #beRansomAware
http://ift.tt/2lDBnwP



1.37bn records from somewhere to leak on Monday


Get ready to change your password soon ! #ITSecurity #DataBreach
http://ift.tt/2mNrahv



Got an OpenBSD Web server? Better patch it


OpenBSD and two of its SSL libraries need patches against a pair of denial-of-service bugs that can crash Web-facing servers.
http://ift.tt/2kOBiot



David Beckham calls in police over hacked emails


Beckileaks……. #ITSecurity #beRansomaware
http://ift.tt/2jXQI5G



Trump’s cybersecurity strategy kinda makes sense, so why delay?


Worrying and puzzling, indeed. But here’s what’s got computer security experts scratching their heads: why did Donald postpone signing a new cybersecurity executive order. #ITSecurity
http://ift.tt/2kIuUiG



http://ift.tt/2jZxuQN


Top resources in the fight against Ransomware
https://goo.gl/4YuBzL



http://ift.tt/2jZxuQN


Want to know the best practices to secure your business against Ransomware ? #Ransomware #ITSecurity
http://ift.tt/2kt3Zbb



http://ift.tt/2jZxuQN


Want to make sure your Business is Prepared against the Ransomware threat in 2017 ? Download our Free Top 5 Guide for areas you should be reviewing. #ITSecurity #Ransomware
http://ift.tt/2kiTsfa



2017, Year of the Business Ransomware ?


A few thoughts and musings on my thoughts on the direction of Ransomware in 2017, based on what I have read, learnt, tested etc etc.

  1. Ransomware will continue to evolve over 2017, but its reported that it will plateau. The threats are growing more complex in nature, but the delivery methods still remain, in the main, over email and web activity by the business users.
  2. The primary source of infection, at the moment, is through your users through Web and Email. Its important to continually educate users on safe browsing and, where appropriate, implement controls to mitigate attack vectors such as email delivery. Listen out for red flags from users, complaining that their systems are running slow etc.
  3. Its expected that Ransomware will make a shift towards the mobile platform in 2017. The mobile estate is huge, billions of devices, giving the Threat Actors a large base to attack and hold to ransom. This can particularly affect Businesses with poor or no BYOD or MDM platforms for management and control. Businesses that have a large reliance on their mobile estate, Ransomware could prove a significant risk for the Business.
  4. With the advent of GPDR, there could be a rise in naming and shaming of organisations that have been compromised by Malware or Ransomware. As an example the compromise on the San Francisco Public Transportation system. Although MUNI didn’t pay the ransom, everyone knew about it.
  5. More Businesses will be targeted in the coming year. Hackers will switch tactics and focus efforts on businesses. Once inside a Business, Ransomware can seek out larger value targets such as file stores, databases and eventually Sharepoint.
  6. Ransomware will be increasingly harder to detect. Its already designed to be silent, run as a background task and generally start and work under the radar.
  7. We have been reading reports of a shift in design of Ransomware, so that it can effectively operate offline, standalone. This has benefits for the criminals in that it does not require a command and control connection and can infect standalone machines not connected to the Internet.

According to a recent survey reported by Tripwire, only 34 percent of IT professionals claim that they are “confident” that their companies could recover from a ransomware attack. This is concerning for a number of reasons: chief among which are the facts that ransomware is an increasingly common form of theft, and ransomware is increasingly being used to target organisations rather than individuals.

Why have cyber criminals begun to target organisations in their ransomware attacks? This trend is really the result of a risk vs. benefit analysis: organisations are often willing and able to make much larger ransom payments, and they are often only slightly more prepared to defend against an attack than individual users.

According to estimates, as few as 3% of organisations actually end up paying ransomware fees when they are attacked. However, virtually are organisations suffer in some way or another when they are faced with a ransomware infections: this could mean paying an IT expert to disarm the attack, permanently losing valuable data, or, of course, paying the ransom.

Despite its recent rise to prominence, surveys also show that ransomware is not the number one cyber security concern for most businesses: that title belongs to phishing attacks. As has been pointed out by a number of experts, phishing attacks are, in many (but not all) cases, the weakness that is subsequently exploited in order to initiate a ransomware attack. However, malicious adware and compromised websites are other common ports of entry for ransomware software.

In order to protect your organisation from the potential threat of ransomware, a multifaceted security approach that encompasses both prevention and response is a necessity.

Is your organisation prepared for a ransomware attack? Do you have measures in place to minimise the threat? Do you know how you would respond if you were attacked? If you answered no to any of these questions, visit Network & Security online today to learn more about what you can do to stay safe.



The 5 Best Practices to Protect Your Business from the Ransomware…


Ransomware will impact your Business – ensure you are protected.
http://ift.tt/2jXVd4f



Is antivirus getting worse?


I think its well known that AV programs are generally worsening in their ability to detect known and new threats. #ITSecurity
http://ift.tt/2jhwoyU



be.Ransomaware


Be prepared for Ransomware – download your Free Guide today.
http://ift.tt/2khJjig