Connect with us

Global Banking and Finance Review is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website. .

Top Stories

GDPR: DATA-PROTECTION SOUL-SEARCHING, NOT JUST COMPLIANCE

GDPR: DATA-PROTECTION SOUL-SEARCHING, NOT JUST COMPLIANCE

Tarek Jundi, Managing Director, Middle East & Turkey, McAfee

Tarek Jundi

Tarek Jundi

With just a couple of months to go, reports and surveys frequently indicate that CIOs and business owners are concerned about and unprepared for GDPR. And the race is on, with a Veritas study indicating that more than half of organisations are yet to start work on meeting the minimum requirements set by GDPR. Many organisations are looking to bring their cyber procedures and capabilities up to scratch ahead of its becoming enforceable, May 2018. But, with an evolving IT threat landscape, new technologies introducing new risk, and a cyber-skills deficit, it’s important that CIOs and IT directors not only focus on this critical deadline but also look beyond it.

Once-in-a-Generation Opportunity 

From large enterprises to SMEs, many organisations are shifting their traditional business model away from physical assets in favour of a data-driven business model. Cloud, mobility and the advent of Internet of Things are driving this digital transformation, introducing new challenges that organisations must navigate to ensure citizens’ and employees’ data is protected.

While the combination of new technologies and the new regulation may seem an insurmountable task to manage over the next 12 months, CIOs and IT directors should look at GDPR as an opportunity. Rather than approaching it separately and in isolation, the new regulation has put a price on cybersecurity and secure data management—bringing it to the attention of the C-Suite. CIOs and CISOs should harness this opportunity to get the budget and procedures in place that will enable them to transform their organisations’ approaches to cybersecurity and reposition IT as a function that enables business transformation and growth.

This will have a dramatic impact on a number of current security challenges many IT teams are facing, such as the massive growth in Shadow IT. According to a recent McAfee Labs Report, almost 40% of cloud services are now commissioned without the involvement of IT, and unfortunately, visibility of these Shadow IT services has dropped year on year. 65% of IT professionals think this phenomenon is interfering with their ability to keep the cloud safe and secure. This is not surprising given the amount of sensitive data now being stored in the public cloud and more than half (52%) of respondents report that they have definitively tracked malware from a cloud SaaS application.

For the first time, GDPR gives CIOs and IT leaders the authority to clamp down on shadow IT in their company, with the support of the rest of the board who fear the ramifications of GDPR.

Better Late Than Never – Getting Started on the GDPR Journey

There are specific requirements in the Regulation—reporting breaches, reviewing processing in advance, making sure vendor contracts have particular language. But GDPR makes a larger and more fundamental ask: That each company look carefully and studiously at its environment, evaluate the data it holds, and “implement … measures to ensure a level of security appropriate to the risk.” It’s a sort of data protection soul-searching designed to protect people and their data from harm. And this perspective challenges organizations to embrace the spirit of the law and be accountable for it, not just to tick a box.

“Appropriate” and “adequate”—tough words in a security context—are found repeatedly in the GDPR. The regulation suggests that “(i)n assessing the appropriate level of security, account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed.” That sounds like a basic risk assessment. But what should you consider in this high-stakes risk assessment, and how do you get to where you can say you have appropriate security?

Remember: This isn’t legal advice—each company has to decide for itself what it needs to do to comply with GDPR but I would suggest you consider these steps as ways to get started on the journey:

  1. Scope. Know what you have. We can’t protect what we don’t know we have. This is a good time for companies to figure out how and where they hold personal data—and not just of EU residents, and not just for its EU affiliates.
  2. Protect. Know how you are protecting those assets. Are you doing the basics? Could you do more? Are your peers doing more? Are you following your data classification policy in automated ways or just expecting employees to know it? Do you delete unnecessary data?
  3. Monitor and detect. Do you have technologies in place (such as encryption, data-loss prevention or anti-virus software) to protect those assets from malicious actors, loss, unwanted leaks? And do you know what to do if something goes wrong?
  4. Review. Do you have a process to make sure that all new applications or cloud services are reviewed and that you know how you are using them? Are you implementing data protection by design by thinking of privacy and security at the very beginning of any project?
  5. Then repeat. The regulation requires “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.”

Some of the specifics of what the regulation requires will take years to truly understand as regulators and courts issue rulings on what comes in front of them, and companies will have different paths to compliance with GDPR.  But at the core of the regulation is knowing what you do with the personal data of your employees and customers, and making sure you have stopped to consider the risks inherent to personal data in your business.

Thinking of GDPR as an opportunity to review the robustness of your data protection program and to make reforms that are good security, good business, and the right thing to do turns GDPR from a many-headed monster into healthy data-centric reform. After all, the GDPR tells us that “the processing of personal data should be designed to serve mankind.”

Global Banking & Finance Review

 

Why waste money on news and opinions when you can access them for free?

Take advantage of our newsletter subscription and stay informed on the go!


By submitting this form, you are consenting to receive marketing emails from: Global Banking & Finance Review │ Banking │ Finance │ Technology. You can revoke your consent to receive emails at any time by using the SafeUnsubscribe® link, found at the bottom of every email. Emails are serviced by Constant Contact

Recent Post