{"id":1671,"date":"2018-06-12T11:22:00","date_gmt":"2018-06-12T11:22:00","guid":{"rendered":"https:\/\/digiterrebestg.wpengine.com\/?p=1671"},"modified":"2024-05-30T13:35:54","modified_gmt":"2024-05-30T13:35:54","slug":"dont-rest-on-your-laurels-compliance-with-gdpr-is-just-the-start-in-avoiding-the-cost-of-data-breaches","status":"publish","type":"post","link":"https:\/\/www.digiterre.com\/us\/2018\/06\/12\/dont-rest-on-your-laurels-compliance-with-gdpr-is-just-the-start-in-avoiding-the-cost-of-data-breaches\/","title":{"rendered":"Don\u2019t rest on your laurels: compliance with GDPR is just the start in avoiding the cost of data breaches"},"content":{"rendered":"
\n
\n

Don\u2019t rest on your laurels: compliance with GDPR is just the start in avoiding the cost of data breaches<\/h1>\n\n

The new General Data Protection Regulation (GDPR) came into force on 25 May and is now impacting on every single business and government department who deals with personal data in the European Union.<\/p>\n \n <\/div>\n<\/section>\n\n\n

\n
\n

The maximum financial penalty that can be imposed under the GDPR is \u20ac20m or 4% of turnover, whichever is the higher. Much has been written about the Tesco breach in November 2016, when 9,000 of its banking customers had their accounts compromised, and the fact that, had the GDPR fine been imposed on the group, it would have amounted to \u00a31.9bn.<\/p>\n\n\n\n

Not surprisingly, businesses have been focusing intently on understanding the terms of the GDPR and making sure they are fully compliant. But there is a danger here. The terms of the GDPR were set out in May 2016, since when the tactics and techniques of hackers have grown increasingly sophisticated. Adhering to a set of regulations is not an adequate strategy for data protection.<\/p>\n\n\n\n

The real cost of a data breach<\/strong><\/h4>\n\n\n\n

When a serious data breach occurs, everyone loses. Customers may find their accounts drained, as in the case of Tesco, or their personal information leaked, as in the case of the Uber breach in 2017. This leaves them feeling insecure and their confidence in the targeted organization is hit hard.<\/p>\n\n\n\n

When hackers stole the personal records of 57 million riders and drivers from Uber, the company agreed to pay a ransom of $100,000 dollars and tried to cover the whole thing up. This dishonesty backfired when Bloomberg broke the story, and Uber has been trying to rebuild its reputation ever since.<\/p>\n\n\n\n

A loss of customer confidence can be fatal, especially in the financial services industry. Customers trust their bank to take good care of their financial assets and the data that can unlock them. The cost of rebuilding trust after an incident like the attacks on Tesco and Uber, coupled with the costs of paying compensation, fighting off the attack and rebuilding a more robust data security infrastructure, should be the real focus when putting together your data protection strategy.<\/p>\n\n\n\n

Build some realism into your data security<\/strong><\/h4>\n\n\n\n

The fact is that data breaches are inevitable. The cyber attack surface is growing all the time and the incidence of attacks, particularly against the financial services industry, is growing exponentially. In 2016 the Financial Conduct Authority received 38 reports of material cyber incidents; in 2017 that figure rose by more than 80% to 69. It\u2019s how you prepare for the inevitable breaches that matters most to your business.<\/p>\n\n\n\n

Traditionally it has been a case of protecting your system perimeters, detecting attempts to break in and reacting quickly to stamp them out, but now we know that this is not the most effective approach. While protecting your perimeters is still important as one line of defense, it\u2019s how you contain an attack once it\u2019s inside your network that really matters.<\/p>\n\n\n\n

Containment is key<\/strong><\/h4>\n\n\n\n

The hackers that attacked Uber got in with relative ease through a third party, then had a field day as they moved around finding valuable data that was not properly segmented and protected. Had they not been able to move around with such ease, the scandal could have been avoided.<\/p>\n\n\n\n

Where organizations fall down is not so much in failing to keep out bad actors but in allowing them to move around the whole system once they\u2019re in. It\u2019s like putting all your assets in the same vault \u2013 or all your eggs in one basket. Once the hacker\u2019s broken into the basket, there\u2019s no stopping them.<\/p>\n\n\n\n

In fact, they might not even have to break in. The most common threat to an organization\u2019s data security comes from its own employees, both through malicious intent and unwitting carelessness. Robust data security, therefore, should not only carry out the \u2018protect, detect, react\u2019 approach but should control the access permissions of\u00a0every<\/em>\u00a0single user, app and device connected to your system.<\/p>\n\n\n\n

This means effecting a change in the culture of data security, from one where everyone within the perimeter is assumed to be friendly unless proven hostile, to one where everyone is seen as a potential threat. This \u2018zero trust\u2019 approach means determining which users and devices require access to which data assets, then applying segmentation to create an encrypted barrier between assets. With this level of protection in place, any data breach remains localized and contained and the damage is limited.<\/p>\n\n\n\n

Restructuring can be good for business<\/strong><\/h4>\n\n\n\n

Changing the way you structure and organize your data security may seem like a costly burden, made necessary by the GDPR, but there are significant advantages to be gained. A Digiterre white paper on businesses\u2019 GDPR issues, published in January 2018, revealed concern over the time and cost involved in trying to comply with subject access requests, due to poorly organized records. By putting in place robust administrative processes, with easily searchable digital records, organizations can streamline their data processing to their own advantage, simultaneously refining their target market and communicating more effectively with customers.<\/p>\n\n\n\n

In enforcing change in the way businesses and organizations structure their data assets, the introduction of the new regulation has presented an opportunity to review your data security strategy and implement an approach that will not only keep you compliant with the GDPR but, more importantly, keep you out of the headlines as the latest beleaguered victim of cybercrime.<\/p>\n\n\n\n

Contact Sam Sindell, Agility Business Development Executive on SamuelS@digiterre.com<\/a> to discuss a free proof of concept.<\/p>\n<\/div>\n<\/div>\n\n\n\n

\n
\n

About the Author<\/h3>\n
\n \n \"\"
\n

Digiterre<\/h4>\n\n \n \n <\/div> \n <\/div>\n
\n Date: 12\/06\/18<\/strong><\/span>\n Category: Industry Insights<\/strong><\/span>\n <\/div>\n <\/div>\n<\/section>\n\n\n
\n
\n
\n \"\"<\/a>\n\n
\n \n

Digiterre Opens in D\u00fcsseldorf: Strengthening Our Presence in Germany\u2019s Energy Market<\/h4>\n <\/a>\n
\n

Date: 03\/06\/25<\/strong><\/p>\n

By: Laurence Pisani<\/strong><\/p>\n <\/div>\n <\/div>\n <\/article>\n\n

\n \"\"<\/a>\n\n
\n \n

Modernizing C++ in Tier 1 Banks: Balancing Performance and Progress<\/h4>\n <\/a>\n
\n

Date: 21\/05\/25<\/strong><\/p>\n

By: Digiterre<\/strong><\/p>\n <\/div>\n <\/div>\n <\/article>\n\n

\n \"\"<\/a>\n\n
\n \n

Legacy Threat: Cybersecurity Lessons from Retail Attacks\u00a0<\/h4>\n <\/a>\n
\n

Date: 07\/05\/25<\/strong><\/p>\n

By: Digiterre<\/strong><\/p>\n <\/div>\n <\/div>\n <\/article>\n\n

\n \"\"<\/a>\n\n
\n \n

Data Under Pressure: Rethinking Data Management in a Volatile, Tariff-Driven Market\u00a0<\/h4>\n <\/a>\n
\n

Date: 30\/04\/25<\/strong><\/p>\n

By: Laurence Pisani<\/strong><\/p>\n <\/div>\n <\/div>\n <\/article>\n\n \n <\/div>\n

\n

Follow Us<\/h3>\n

Get the latest news and stay up to date<\/p>\n