Gdpr and Cyber Security: The Elephant Herd in the Room

By-lined to: Keith Bedell-Pearce, Chairman, 4D

As the UK will still be part of the European Union (EU), General Data Protection Regulation (GDPR) will become UK law in May next year and whether we have hard or soft Brexit, GDPR is likely to remain on the statute books. With this in mind, Keith Bedell-Pearce, chairman of 4D, urges businesses to focus on putting a practical cyber security strategy in place now.

There are two reasons why GDPR is here to stay. The first is that it is the cornerstone of the current Government’s longer term cyber policy. The second is, according to the Information Commissioner’s Office (ICO),“if the UK wants to trade with the single market on equal terms, we would have to prove ‘adequacy’”. This could include a requirement to implement data localisation involving the physical relocation of customer information.

In an age where every business is becoming ever more reliant on the storage and processing of data, businesses need to address data localisation and ensure that their data systems are robust enough to prevent a breach. Organisations need to consider where their cloud provider owns and operates their data centres and whether their data could inadvertently be transferred or stored in locations outside the UK or EU.

Companies have until May 2018 to ensure their data systems are robust enough to prevent a breach or face a hefty fine from the ICO of up to 4% of turnover if they become victims of data loss.

In addition to any fines for data breaches, the commercial cost of loss of confidential information, sales and marketing data or the results of costly and valuable research can be immense. Add to this the reputational damage of adverse publicity, a major data breach could turn out to be the single greatest risk in terms of both cost and probability of occurrence that an organisation faces. Yet in many companies, data breaches barely get a mention in their risk register, if at all, and expertise in cyber security at a board level is still a rarity apart from in technology companies.

The seriousness of cyber risks is further underlined by the assertion in the 8th April 2017 edition of The Economist that “Computers will never be secure… computer security is a contradiction in terms”. The article goes on to say that the scale and complexity of modern software is the root cause of the inherent vulnerability of modern business. The Economist argues that errors are inevitable and these errors create vulnerabilities that can be exploited by hackers. The generally accepted error rate for source code programmers is 10 to 50 per 1,000 lines. The average phone app has a round 14 vulnerabilities and in the Internet of Things (IOT), the vulnerability exposure is such that it is now open season for the hackers with the six billion plus connected devices on the IOT.

So the need to take seriously the threat of a data breach, along with the prospect of hefty fines by the ICO, has never been more important.

How can senior stakeholders ensure that their businesses have the appropriate technical and organisational measures in place to protect its data in all of its forms?

There is a lot that an organisation can do by way of self-help using relatively straightforward and low (or nil) cost measures. Cyber security should be embedded into the very core of any business, no matter the size. This won’t necessarily stop the business from falling prey to a breach but it will at least reduce the chances of a catastrophic data breach with all the resultant reputational damage and financial loss.In addition, the ICO is likely to look more favourably on organisations that can demonstrate that they have at least prepared for such an incident rather than just hope for the best.

A good starting point is the practical advice “10 steps to Cyber Security” provided by the National Cyber Security Centre (NCSC) which is part of GCHQ. The core element is setting up a risk management regime in the same way as you would for legal, regulatory, financial or operational risks. In addition, using the Government’s Cyber Essentials scheme gives Cyber Essentials accreditation that allows organisations to advertise that it meets a Government-endorsed standard.

While the assertion that computer security is a contradiction in terms is unfortunately always likely to hold true, implementing your own cyber security regime now could put in place a vital layer of protection when the reality of the GDPR legislation bites.

By-lined to: Keith Bedell-Pearce, Chairman, 4D

As the UK will still be part of the European Union (EU), General Data Protection Regulation (GDPR) will become UK law in May next year and whether we have hard or soft Brexit, GDPR is likely to remain on the statute books. With this in mind, Keith Bedell-Pearce, chairman of 4D, urges businesses to focus on putting a practical cyber security strategy in place now.

There are two reasons why GDPR is here to stay. The first is that it is the cornerstone of the current Government’s longer term cyber policy. The second is, according to the Information Commissioner’s Office (ICO),“if the UK wants to trade with the single market on equal terms, we would have to prove ‘adequacy’”. This could include a requirement to implement data localisation involving the physical relocation of customer information.

In an age where every business is becoming ever more reliant on the storage and processing of data, businesses need to address data localisation and ensure that their data systems are robust enough to prevent a breach. Organisations need to consider where their cloud provider owns and operates their data centres and whether their data could inadvertently be transferred or stored in locations outside the UK or EU.

Companies have until May 2018 to ensure their data systems are robust enough to prevent a breach or face a hefty fine from the ICO of up to 4% of turnover if they become victims of data loss.

In addition to any fines for data breaches, the commercial cost of loss of confidential information, sales and marketing data or the results of costly and valuable research can be immense. Add to this the reputational damage of adverse publicity, a major data breach could turn out to be the single greatest risk in terms of both cost and probability of occurrence that an organisation faces. Yet in many companies, data breaches barely get a mention in their risk register, if at all, and expertise in cyber security at a board level is still a rarity apart from in technology companies.

The seriousness of cyber risks is further underlined by the assertion in the 8th April 2017 edition of The Economist that “Computers will never be secure… computer security is a contradiction in terms”. The article goes on to say that the scale and complexity of modern software is the root cause of the inherent vulnerability of modern business. The Economist argues that errors are inevitable and these errors create vulnerabilities that can be exploited by hackers. The generally accepted error rate for source code programmers is 10 to 50 per 1,000 lines. The average phone app has a round 14 vulnerabilities and in the Internet of Things (IOT), the vulnerability exposure is such that it is now open season for the hackers with the six billion plus connected devices on the IOT.

So the need to take seriously the threat of a data breach, along with the prospect of hefty fines by the ICO, has never been more important.

How can senior stakeholders ensure that their businesses have the appropriate technical and organisational measures in place to protect its data in all of its forms?

There is a lot that an organisation can do by way of self-help using relatively straightforward and low (or nil) cost measures. Cyber security should be embedded into the very core of any business, no matter the size. This won’t necessarily stop the business from falling prey to a breach but it will at least reduce the chances of a catastrophic data breach with all the resultant reputational damage and financial loss.In addition, the ICO is likely to look more favourably on organisations that can demonstrate that they have at least prepared for such an incident rather than just hope for the best.

A good starting point is the practical advice “10 steps to Cyber Security” provided by the National Cyber Security Centre (NCSC) which is part of GCHQ. The core element is setting up a risk management regime in the same way as you would for legal, regulatory, financial or operational risks. In addition, using the Government’s Cyber Essentials scheme gives Cyber Essentials accreditation that allows organisations to advertise that it meets a Government-endorsed standard.

While the assertion that computer security is a contradiction in terms is unfortunately always likely to hold true, implementing your own cyber security regime now could put in place a vital layer of protection when the reality of the GDPR legislation bites.