The GDPR is coming soon and its a game changer. One of the areas it looks at is how you store your data and it will be under scrutiny. Its important that your business knows and fully understands the regulations in their entirety.
Data Retention, in terms of a business, by definition is:
The continued storage of an organisation’s data for compliance or business reasons. In most cases, a business is retaining an individuals personal data.
“Personal Data means any information relating to an identified or identifiable natural person (data subject). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.”
The retention of data has the following concerns:
If you are a business that handles personal data, you need to be able to answer the following questions:
Article 5 of the GDPR, states:
In conclusion, from the above, it is not totally clear about the period of time you can retain data, but you need to have a Data Retention Policy, ensure the relevant people in your business know about it, and also have the relevant processes and documentation in place to show destruction of data.
You will also need to consider the purpose of the information that you hold. Securely delete information that is no longer needed and update, archive or securely delete information that goes out of date.
Find out more information about data retention from the ICO:
Take a look at the below. Can you see a potential data breach?
Hopefully, you can see quite a few, from the paper in the waste bin, the open files on the desk, through to the person on the telephone who may be taking client notes and leaving them exposed.
When I talk to my clients and prospects, I am still amazed at how many of them don’t know anything about the upcoming daata protection changes with the GDPR – the new data regulations that come into force on the 25th May and I explain to them that it is essential they know about the big changes in data protection.
People are aware of the DPA (Data Protection Act) but the GDPR is bigger and better to help protect a person’s digital existence online. If you don’t comply with the new regulations, the fines will be a lot more. Customers are trusting you with their data, and you need to make sure you look after it properly.
Currently, the maximum fine the ICO can charge is £500,000. When the GDPR comes into force the maximum fine is £17M or up to 4% of global company turnover,
As business owners, we should be aware of potential data breaches. Not just in the working environment but for employees that work remotely.
How many of your employees are aware of the data protection changes ahead? If you were to ask them what would they say?
You should try it. It could prove to be a valuable exercise.
Do they know that they can’t put a piece of paper in the bin that contains the name and address of a person? Do they leave files containing personal information sitting on their desk? Do you write people’s contact details in your diary or share other people’s business cards?
It’s simple things like that…
After the 25th May 2018, those actions could result in a potential data breach.
The key thing to remember is:
Know your data, know where it is and know what to do if there is a data breach.
How can you assure that your organisation is compliant with the new data protection regulations?
You can employ a Data Protection Officer (DPO) and for companies over 250 employees or companies that handle specific information, having a DPO is compulsory.
You and your employees can undertake a training program to further your understanding of what you, your organisation and your stakeholders should be doing to prepare to make sure you are compliant with the GDPR.
Seeking professional advice and using a structured training programme can give you total reassurance. You need to make sure you and the leadership understands the following:
Protecting your customer, client, beneficiaries or employee’s information is crucial to all organisations.
Here are some typical examples of how your staff could cause a data breach without realising:
Next time you are in an airport, in a café, on the train or in other public places – look out for some data breach hazards. Has someone left their laptop unattended, have they dropped a USB stick or left their mobile phone on the seat?
It is vital for me as a business owner to be completely up to date with all the GDPR developments. As experts in our industry, we are very aware, and have seen real life examples, of the catastrophic effect of a cyber crime or a data breach.
We can help you reduce the risk. Let me know if we can help, always happy to have a chat even just to advise.
Some interesting facts and statistics on the ICO for the last couple of years. Leading up to the GDPR implementation in the next few months time, the fines are going to increase and every business should be aware of whats upcoming.
The Information Commissioner’s Office (ICO) is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
During 2016/2017 the ICO issued fines topping £3.5 million under the Data Protection Act and Privacy of Electronic Communication Regulations. (1)
The ICO dealt with a record 20,919 data-protection complaints and self-reported incidents across all sectors in that time span to 31st March, a rise of 14% on the previous 12 months. (2)
Data published by the ICO in May 2017 for 2016/17 revealed:
The ICO also published statistics about the number of issues it had dealt with in relation to marketing and nuisance calls across all sectors. It received 167,018 complaints about marketing that broke the Privacy and Electronic Communications Regulations 2003 and handed out a record 23 fines, totalling more than £1.92m, for what it called “a range of unlawful marketing activities”. (3)
Since January 2017 the ICO have kept us informed of the developments leading up to the new General Data Protection Regulation (GDPR) enforcement which is due on 25th May 2018.
Find out the full details on the ICO’s ‘What’s new?’
As the countdown continues to the implementation of the GDPR taking effect in May this year, the ICO are notifying businesses about the change in fees. Under the current Data Protection Act (DPA), organisations that process personal information are required to notify with the ICO as data controllers (unless an exemption applies). This involves explaining what personal data they collect and what they do with it. They are also required to pay a notification fee, based on their size, of either £35 or £500.
Find out more about the new ICO fee changes here.
If we were to ask you to define cyber security, what would you say? You understand the concept but need to know more?
The definition of Cyberspace is an electronic medium of digital networks used to store, modify and communicate information. Cyberspace influences and makes a big impact on our lives, our businesses and services. You would assume that your personal information in cyberspace would be secure and protected. We are all aware that isn’t the case in reality.
The UK government are making on-going transformations to protect UK citizens and businesses. They have a mission to protect people from threat actors that use data for inappropriate, malicious and illegal purposes.
Cyber Security plays a massive part in the private and public sector. From national security, the fight against terrorism, crime or industrial devastation for example. Cybercrime is an everyday occurrence. The risks of storing data in Cyberspace are huge but necessary and protective security measures should be taken.
Being Secure Online in Business
Security threats build and the government need to step up their game. They are attacking the problem but is it enough? It’s not solely just up to the government to sort the problem. It is the responsibility of companies and us as a country.
Cyber Security is a topic that we should educate ourselves about. Who and what are we dealing with when it comes to cyber security and data protection?
Businesses have a responsibility to their customers to keep their data safe, as well as to shareholders and investors to remain competitive in a global marketplace.
The new GDPR due to come into force in May 2018 will help tackle the data protection issues. **Insert a link to your GDPR articles. You could make reference to some key points. The government are trying to build a country where people know that there data is protected and they can move forward with confidence to use the internet.
How are the government going to deal with cyber security and data protection?
Your first priority for preparation in terms of GDPR should be to educate yourself and ensure others in your organisation who has responsibility for data. It doesn’t matter about the size or legal entity of a business – we must all follow the same rules when it comes to handling data.
Don’t hesitate, assess, take action now and be ready.
Here are 10 considerations to help you prepare for the GDPR:
The GDPR is a law about Data Protection, based on a set of common-sense principles:
Understand the definition of ‘personal data’.
Personal Data means any information relating to an identified or identifiable natural person (a “data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular, by reference to an identifier such as a name, an identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person. ~Article 4(1) of the EU GDPR 2016/679.
Read the New Data Protection Bill.
You can find the ‘The New Data Protection Bill: Our Planned Reforms’, on the government website. Insert the link that you already have, into the above title.
The New Data Protection Bill covers the following 4 topics:
Seek legal advice if you are unsure.
This article offers insights and guidance about the GDPR. It is highly recommended that you seek your own legal advice in preparation for the big change.
If you have a Website
Data on a website can be anything from a simple enquiry form, an ecommerce/online sales website to online user accounts that have details saved. Make sure that your website is encrypted with an SSL certificate and that any data gathered is stored in a safe and secure environment once it reaches you.
Identify where your company is storing data, for example:
Prepare your staff and make them well aware of the changes that are coming. Make sure that they understand the principles of good data protection and that they don’t write down details of people on a piece of paper that could go astray, end up in the bin or taken home on computers or memory sticks where information could get stolen.
Evaluate your environment and how you document personal data – where did it come from, who have you shared it with? How will you audit the data? Review current policy notices and put a plan in place – procedures and timescales.
Decide how you will be able to prove that your data is secured safely and how to seek consent moving forwards.
The General Data Protection Regulation will apply to all companies based in the EU and those with EU citizens as customers. It has an extraterritorial effect, so non-EU countries will also be affected. Even though the UK is planning to leave the EU, the UK will still need to comply with the GDPR.
Do you need to employ a Data Officer?
A data protection officer (DPO) is an enterprise security leadership role required by the General Data Protection Regulation (GDPR). Data protection officers are responsible for overseeing data protection strategy and implementation to ensure compliance with GDPR requirements. A DPO would be recommended for any organisation that processes or stores large amounts of personal data, whether for employees, individuals outside the organisation, or both. Seek advice as to whether your company should employ a DPO or make sure someone in the business has responsibility for Data Protection.
What have you done so far to prepare for the GDPR?
If you need help, support or just have a GDPR question you can call us 0203 319 3930 or drop me an email.
Cyber security and data protection.
If you are a business that handles data, either as a processor or a controller, make sure you put the 25th May 2018 in your diary. Most businesses are.
A new data law coming, consider it to be the existing Data Protection Act… but on steroids. If you breach the new rules, or show that you haven’t got sufficient policies, procedures, training or protection in place, your business could be facing a significant fine.
Currently, the maximum fine the ICO (Information Commissioner’s Office) can issue is £0.5m. Larger fines of up to £17m (€20m) or 4% of global turnover will be allowed, enabling the ICO to respond in a proportionate manner to the most serious of data breaches.
Just in case you weren’t aware, the EU General Data Protection Regulation (GDPR) is a new law about data protection. ‘information age’ revealed that 55% of small businesses are unfamiliar with the GDPR. If you have a business that handles data, take action now and be prepared.
The GDPR is a law about Data Protection, based on a set of common-sense principles:
Network & Security are registered with the ICO as a Data Processor for its clients. With out experience, Network & Security are ready to be compliant with upcoming changes in policy, procedures or any data protection regulations or laws. We understand the importance of these laws (and processes/procedures that come with it) and appreciate it’s not just how they affect the business but those that work within the company too.
The UK government’s Department for Digital, Culture, Media & Sport has created a New Data Protection Bill: Our Planned Reforms.
In the Bill’s foreward, the RT Hon Matt Hancock MP, Minister of State for Digital explained the following:
Find out more about the New Data Protection Bill: Our Planned Reforms.
Great Opportunity to get information from a Serial Entrepreneur with a great track record and experience !
Interesting new Send service being tested by Firefox.
Businesses we deal with dislike this type, due to the lack of auditability, of sending service, but the industry is screaming out for a standard file share/sending type of service.
There are vendors available, of course, but different businesses use different vendors – perhaps its time to look at TLS on email and increase the storage space the receiving capacity of email in general.
A short video from Mimecast showing, from their recent Security report, that they deem around 25% of emails to be unsafe. Not surprising, and I would have put this figure, personally, a lot higher than this, considering that, by a fair percentage, a popular attack vector for users is through email.
Even with education, anyone can make an error by clicking on a malicious link or file in an email.
Do you use a cloud filtering service ? There are clear benefits of doing so, even more so if your email is housed internal to your business.
“Petya” Ransomware goes Global
There is a new strain of Ransomware from its original called Petya. Some sites out there are calling it completely new, NotPetya, and others see it is a variant and calling it PetWrap.
Whatever the case, the advice is always the same, look at how this is reportedly spreading, and put measures in place to mitigate as much as you possibly can.
According to many reports, the Ukraine has been badly hit, and it has been seen in several high profile UK business organisations.
Its also been confirmed that this Ransomware uses the Eternal Blue exploit, which was originally thought to have been developed by the US NSA as a digital weapon, and then subsequently leaked online by the hacker group known as Shadow Brokers.
Businesses who have not put measures in place such as disabling the SMB version 1 protocol (deprecated) or implemented the MS17-010 Microsoft Patch should do so now or as soon as possible. We believe this wont be the last exploit of this nature, and although simple measures such as black-holing the domain name used for the original Wannacry outbreak, and blocking known C&C servers, wont be effective and you could be fighting a reactive battle.
Businesses need to be robust in their security measures, have a solid response plan and be reactive as they can be to these modern threats otherwise these strains will continue to develop and proliferate. Don’t delay security patching.
What can you do ? Read the full article below – or contact us today.
Intel have confirmed that a patch will be released that will fix a remote code execution vulnerability (discovered in March 2017) which has been in its processors since 2009. This vulnerability allows hackers exploiting the flaw to silently snoop on a vulnerable machine’s users, make changes to files and read them, install rootkits and other malware, and so on. This is possible across the network, or with local access. #ITSecurity
About 200 unique Android apps have been embedded with the MilkyDoor backdoor, which is built to attack an enterprise’s internal networks, private servers, and ultimately, corporate assets and data. #ITSecurity
Officers found 8800 C&C servers across eight countries, responsible for financial malware, ransomware, Distributed Denial of Service (DDoS) attacks and spam. #ITSecurity #Ransomware
Ransomware cybercriminals took in about $1 billion last year, based on money coming into Ransomware-related Bitcoin wallets. #Ransomware
The Top 5 Resources to Protect your Business Against the threat of Ransomware in 2017 #ITSecurity #Ransomware
Phishing for Homographs – fraudsters using Cyrillic characters to direct you to a site that doesn’t redirect – users beware. #ITSecurity – If you get an email from someone you don’t know, not expecting, or you are suspicious – simple answer is to type the URL in, don’t click !
Rough day for users running Windows and trying to use Facebook if you use Webroot…. #ITSecurity
Although we all realise it, how technology is advancing more than human nature, its an interesting article on how human nature is responsible for around 95% of Security Incidents #ITSecurity
SMSVova hides inside a bogus app called System Update and is sent commands by attackers via inbound SMS messages to carry out functions such as setting and changing passwords for the spyware and retrieving location data. #ITSecurity
Although its a network issue and users have been told to ignore SMS messages from unknown senders – is this to do with the recent data breach they suffered ? #ITSecurity
How Marketers Can Help Protect Their Firms From a Cybersecurity Attack #ITSecurity
With “Philadelphia,” a slick ransomware-as-a-service interface that enables almost anyone to launch a sophisticated ransomware campaign, suddenly, deploying ransomware is easy as ordering a pizza. The criminal developers behind Philadelphia even had the heart to offer a “mercy” feature should a victim plead for access to ransomed family photos of lost family and friends.
Welcome to the new world of commodity malware! #beRansomaware #ITSecurity
A large proportion of attacks by hackers are email borne. Users should be educated to, as much as they can do, determine if the email is legitimate. Ask simple questions, am I expecting it, is it asking me to open a link or download something. If in doubt – contact your #ITSecurity department.
There is a preconceived idea that malvertising mostly affects the Windows platform. This is a short article that shows an emerging scareware campaign that runs on Apple iOS which pushes a VPN APP. #ITSecurity
This is a great article detailing a number of different ways that hackers target your employees. Realistically its on all levels and there is no bar for an attacker #ITSecurity
There’s good and bad news on the phishing front #ITSecurity
Social media is a popular gateway for hackers to access corporate networks, and employee behavior is driving the trend.
The Information Commissioners Office is looking for active feedback on its draft guidance for GPDR Information Commissioner’s Office (ICO) #GPDR
Just in case you were wondering why #Teamviewer is no longer working.
Interesting read #ITSecurity
A simple Powershell script to assist in resetting local Computer account passwords remotely. #ITSecurity
A look at Feb 2017 and the Ransomware effect #ITSecurity #beRansomAware
Get ready to change your password soon ! #ITSecurity #DataBreach
OpenBSD and two of its SSL libraries need patches against a pair of denial-of-service bugs that can crash Web-facing servers.
Beckileaks……. #ITSecurity #beRansomaware
Worrying and puzzling, indeed. But here’s what’s got computer security experts scratching their heads: why did Donald postpone signing a new cybersecurity executive order. #ITSecurity
Top resources in the fight against Ransomware
Want to know the best practices to secure your business against Ransomware ? #Ransomware #ITSecurity
Want to make sure your Business is Prepared against the Ransomware threat in 2017 ? Download our Free Top 5 Guide for areas you should be reviewing. #ITSecurity #Ransomware
A few thoughts and musings on my thoughts on the direction of Ransomware in 2017, based on what I have read, learnt, tested etc etc.
According to a recent survey reported by Tripwire, only 34 percent of IT professionals claim that they are “confident” that their companies could recover from a ransomware attack. This is concerning for a number of reasons: chief among which are the facts that ransomware is an increasingly common form of theft, and ransomware is increasingly being used to target organisations rather than individuals.
Why have cyber criminals begun to target organisations in their ransomware attacks? This trend is really the result of a risk vs. benefit analysis: organisations are often willing and able to make much larger ransom payments, and they are often only slightly more prepared to defend against an attack than individual users.
According to estimates, as few as 3% of organisations actually end up paying ransomware fees when they are attacked. However, virtually are organisations suffer in some way or another when they are faced with a ransomware infections: this could mean paying an IT expert to disarm the attack, permanently losing valuable data, or, of course, paying the ransom.
Despite its recent rise to prominence, surveys also show that ransomware is not the number one cyber security concern for most businesses: that title belongs to phishing attacks. As has been pointed out by a number of experts, phishing attacks are, in many (but not all) cases, the weakness that is subsequently exploited in order to initiate a ransomware attack. However, malicious adware and compromised websites are other common ports of entry for ransomware software.
In order to protect your organisation from the potential threat of ransomware, a multifaceted security approach that encompasses both prevention and response is a necessity.
Is your organisation prepared for a ransomware attack? Do you have measures in place to minimise the threat? Do you know how you would respond if you were attacked? If you answered no to any of these questions, visit Network & Security online today to learn more about what you can do to stay safe.
Ransomware will impact your Business – ensure you are protected.
I think its well known that AV programs are generally worsening in their ability to detect known and new threats. #ITSecurity
Be prepared for Ransomware – download your Free Guide today.