GDT Webinar Series – How to Fail at Security? Reserve Your Spot

Are You Ready for GDPR?

by Moe Janmohammad, GDT Cybersecurity Analyst

On May 25th, the new General Data Protection Regulation (GDPR) from the European Union (EU) will go into effect. The regulations are designed to protect the data of EU citizens, and penalties for non-compliance are steep (up to the greater of 20 million Euros or 4% of total gross revenue).  Even if your company isn’t based in the EU, the regulations could still affect your information security policies. To help you better prepare your IT Security teams, here are the questions you should be asking yourself these 4 questions:

  1.  What is defined as personal data?

The GDPR has definitions of what personal data consists of, which includes “an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” While IP addresses are not specifically included, they do include geolocation and provider information that could potentially be used to identify individuals. You’ll need to determine what data you’re currently holding.

  1. Where are we storing personal data?

Twenty years ago, personal data was stored in a corporate data center. Today, that data can be stored on edge devices, mobile devices, on-premise servers, or even the public cloud. Data in 2018 is extremely mobile and fragmented. Your IT team must have full visibility into where the generated data is being stored. If you don’t have this information, you might have a problem.

  1. Who can access the personal data?

GDPR restricts data usage strictly covered by the initial consent agreement. And if you share that data with a third party, it is your company’s responsibility to ensure they are only using the data for the purpose covered by the initial consent. You need to know who is accessing the data and what they’re doing with it, even if they are from outside your organization.

  1. How do we ensure it is protected?

This is the hardest question to ask, as solutions get expensive quickly. A large number of data breaches begin with stolen credentials. Monitoring end user behavior for anomalies can help identify risk and provide early warning signs for a potential data breach. Automated defenses can be set up to revoke read/write access for potentially compromised users, or for sinkholing their outbound traffic to prevent exfiltration.
Asking yourself the aforementioned questions is important, but being able to address and answer them is vital. If you can’t, you might be setting your company up for an expensive penalty.

Author

Share this article

You might also like:

NCAA basketball coaching legend Bobby Knight once said: “Good basketball always starts with a good defense.” Winning teams understand their opponents’ strengths and weaknesses, as well as their own. They study their opponents’ plays and anticipate their next moves. The same concept is true for cybersecurity, which is why, at

GDT is committed to supporting #WomenInTech. In this interview, Sr. Bid Manager Peggy Debrowski shares insights into her journey, challenges, and triumphs as a woman in the technology industry. From her role evolution to her passion for empowering women, Peggy’s narrative inspires and encourages aspiring professionals. Sydney: How long have

Welcome to our February edition of our GDT Employee Spotlight. Our Culture & Engagement Manager, Sydney Johnson, interviewed Anirudh Raghavan, Associate Solutions Architect, with our Professional Services team this month. SYDNEY: Hi, Anirudh! Thank you for taking the time to answer my questions for our February Employee Spotlight. You have