Businesses pressed to act on data privacy

At the Marking Data Privacy Day on 28 January, businesses have been urged to re-evaluate their data privacy programmes in the face of growing regulation. Experts have warned that many businesses are failing to do enough to safeguard consumers’ details, despite imminent legislative changes. The European General Data Protection Regulation (GDPR), which is scheduled to come into effect in 2018, provides for fines of up to 4% of annual global revenue or €20m, whichever is greater, if a company is found to have failed to protect data of EU citizens and residents. Similarly, in the US, 16 states have already introduced data privacy legislation. Alongside this, is the issue of reputational risk. The rising number of breaches involving consumer data means that people are increasingly aware that their information is at risk, and far less willing to forgive businesses that fail to sufficiently protect it.

Global businesses are re-evaluating their data privacy programmes this year as new privacy regulations targeted at businesses start to gather.

The European General Data Protection Regulation (GDPR), which is expected to come into force in 2018, provides for fines of up to 4% of annual global revenue or €20m, whichever is greater, for failure to safeguard data of EU citizens and residents.

In the US, 16 states recently introduced data privacy legislation supported by the American Civil Liberties Union (ACLU) and designed to enable citizens to take control of their personal privacy in the digital age.

However, despite the introduction of this legislation, many enterprises are still not doing enough to protect consumer data, according to security and privacy industry experts.

Businesses are being urged to take action on data privacy to mark European Data Protection Day, known as Data Privacy Day outside of Europe.

“Data privacy day is a great opportunity for organisations to re-evaluate their privacy programme,” said Tim Erlin, director of IT risk and security strategy for security firm Tripwire. “Privacy is often treated as part of larger security initiatives. While this approach addresses some key privacy issues, others may not get the attention they deserve.”

According to Erlin, the top five data privacy mistakes businesses make are:

Failure to keep only essential consumer data

Failure to encrypt customer data

Failure to secure access to data at all times

Failure to patch known vulnerabilities

Failure to monitor and control simple misconfigurations

Many organisations keep a lot of customer data in case they need it, he said, but it can easily become a major target for cyber attackers, and may not receive the same level of protection as business-critical data.

Erlin said companies need to establish internal processes to keep data encrypted. “Leaving customer data unencrypted makes it much easier for attackers to grab.”

And while encrypting customer data is important, it must be decrypted for use in an application at some point, with attackers trying to compromise those applications so they can get to that data, Erlin warned.

Successful attacks are more likely to exploit vulnerabilities that are several years old if that gets them access to high-value data, he said. “Patching systems isn’t glamorous but it’s essential to protecting data.”

More than one of the security breaches that have been in the headlines recently has been the result of a misconfigured database or server, said Erlin. “If you’re not monitoring server configurations for change, you have a blind spot in your security that attackers can exploit.”

Reputational damage And it is not only the new privacy legislation in Europe and the US that is a factor. Lawrence Munro, European director at security firm Trustwave for Europe and Asia-Pacific, said the mounting number of breaches involving consumers’ financial and private data means that people are increasingly aware that their information is at risk, and much less willing to forgive businesses that betray their trust. The Information Commissioner’s Office (ICO) has also highlighted the potentially devastating effect of reputational damage as a result of a personal data breach. Munro said security professionals see “Password1” as the most common password year after year. “Such abysmal security presents an open door to hackers. Likewise, phishing scams over email and phone continue to trick droves of workers,” he said. According to Munro, security in many organisations continues to be seen as a “box to be ticked” as cheaply as possible rather than an essential operation necessary for survival. “Practices such as regular intensive network testing using real experts rather than occasional automated scans are crucial if businesses are to avoid the reputational and financial fallout of a breach this year,” he said.

No place to hide Jason Hart, CTO data protection at Gemalto, said that when the GDPR is enforced, companies will no longer be able to hide breaches, which could have fatal effects on a business. “Businesses must act now to ensure they have the correct security processes in place before the regulation takes effect. Being a better steward of customer data is not just good PR, it makes good business sense too,” he said. Richard Anstey, European CTO at Intralinks said that while cyber attacks are becoming more common, human error is still a huge problem and causes a significant number of data leaks. “Many employees bring bad cyber-security practice from home into the workplace, and businesses don’t realise the implications that can have on an organisation. Educating the workforce is as critical as implementing technology solutions to manage data flows, especially when handling very sensitive information, such as intellectual property,” he said. Anstey said that businesses need to know the value of their data, where it flows across the world, where it is encrypted and how it is being used by its employees. “Only then can organisations make informed decisions about how to manage and secure data appropriately. For this reason, you’ll see more chief privacy officers on executive teams in the coming years.”