Cloud data security and GDPR compliance
- 1. How the right data storage provider solves your business’s GDPR security and breach compliance problems
- 2. Welcome https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Mark Gracey mark@digitalcompliance.co.uk Founder, Flavourfy Digital & Digital Compliance Hub Salim Benadel salim.benadel@storminternet.co.uk Founder & MD. Storm Internet Limited
- 3. What GDPR security issues? What do I need to worry about? How can I comply? GDPR Compliance
- 5. Key Data Protection Definitions https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Personal Data Processing Data Subject Data Controller Data Processor
- 6. The Principles of Data Protection https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Lawful, fair & transparent Specific purpose Relevant Accurate Retention Security Individuals' rights International transfer GDPR = Accountability
- 8. GDPR: What’s changing? https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk GDPR May 2018 Scope Accountability Children Consent Rights Processors By Design DPOs Breaches Fines
- 9. What’s changing? https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Accountability Demonstration of compliance Record processing activities
- 10. What’s changing? https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Third-party Processor s Are they compliant? Contractual terms Processor liabilities
- 11. What’s changing? https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Fines Up to 4% of global turnover or €20m
- 12. GDPR & Security
- 13. Security principle https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Processing must be secure Protection against unlawful processing, accidental loss or destruction Principle of “integrity and confidentiality”
- 14. Security principle https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Controller & Processor responsibilities Data protection by design & default / DPIA
- 15. Security principle https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Security of processing Anonymisation of data Encryption Integrity of processing systems Disaster recovery Technical effectiveness & testing Risk based assessment
- 16. When it goes wrong: Breach notification
- 17. Breach notification https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Breaches Breach notification to regulatory body within 72 hours Breach notification to data subjects when “high risk” without “undue delay” Documentation and recording of any breaches
- 18. GDPR & Security in Practice: Storm Internet
- 20. Salim Benadel, Founder & MD at Storm Internet • Working commercially in IT for past 20 years • Involved with the Internet since 1999 Storm Internet • Keeping servers and hosted data safe, secure and running fast since 2004 • 3500+ customers predominantly based in the UK • Hosting over 10,000 web sites • Use only UK data centres guaranteeing data sovereignty, giving you peace of mind that your data will never be transferred outside of UK borders.
- 21. Industry Awards & Recognitions 2017 - ISPA Award Winner - Best Cloud Product - ISPA Award Winner - Best Host - ISPA Finalist - Security award - SVC Awards Runner Up - UK Managed Services Provider of the Year 2016 - ISPA Award Winner - Best Cloud Product - ISPA Finalist - Best Host award - ISPA Finalist - Security award - ISPA Finalist - Best Business Customer Service award 2015 - ISPA Award Winner - Best Business Use of Cloud - ISPA Award Runner Up - Best Dedicated Hosting - SVC Awards Runner Up – Hosting Provider of the Year - SVC Awards Finalist – Cloud Company of the Year - SVC Awards Finalist – IaaS Solution of the year award - SVC Awards Finalist – Managed Service Provider of the year award 2014 - ISPA Award Winner - Best Dedicated Hosting 2013 - ISPA Award Winner - Best Business Hosting
- 22. Agenda • How your hosting provider can help you to meet your compliance requirements • How Storm can help to protect your business
- 23. How your hosting provider can help you to meet your compliance requirements Data Controllers (you) need to carry out due diligence to show they’re using GDPR compliant Data Processors. • Your Hosting provider (who is a Data Processor for you) can usually help you satisfy this criteria by providing you with a detailed “GDPR statement”. • A GDPR Statement specifies exactly how that company handles data they receive from you and will be in line with GDPR policy. • Other examples of Data Processors you may use and will need to check: - Card payment providers - Customer Relationship Management (CRM) systems - Mailing systems (MailChimp etc.) - Data Backup providers - In short, anyone who stores or receives personal data on individuals from you
- 24. How your hosting provider can help you to meet your compliance requirements • Storm will be fully GDPR compliant from February 2018 • Our GDPR Statement will be available from 05/02/18 Using Storm means you are able to demonstrate that you are using a GDPR compliant provider.
- 25. How Storm can help to protect your business The other risk… A Data Breach
- 26. The problem this causes • Lot of hassle & productive time lost needing to inform customers, the Information Commissioner and ensuring GDPR procedures are followed correctly. • Reputational damage to business due to your client data being breached. • Loss of trust from your clients. • Fines from Information Commissioner’s Office (ICO) if procedures not followed correctly. • Risk from other legal liabilities such as being sued. • Large fines if unable to demonstrate expected precautions were taken to ensure the risk of this happening was minimal.
- 27. Some examples of data breaches that have occurred recently… • TalkTalk Damage: Personal details of more than 156,959 individuals accessed Penalty: £400,000 fine issued Attack method: Exploited out-of-date database (gained from acquisition of Tiscali) via vulnerable web page • Nottinghamshire County Council Damage: Personal details of over 3000 individuals posted online Penalty: £70,000 fine issued Attack method: Poor web site security • Carphone Warehouse Damage: Details of more than 3m individuals accessed. 18,000 of which contained payment card info Penalty: £400,000 fine issued Attack method: Exploited out-of-date WordPress plug-in • Berkshire-based small business, Boomerang Video Ltd Damage: Personal details of over 26,331 customer details accessed Penalty: £60,000 fine issued Attack method: SQL Injection attack via web site • Many more examples can be viewed on the Information Commission’s office web site https://ico.org.uk under their News section
- 28. The ICO’s view… “Regardless of your size, if you are a business that handles personal information then data protection laws apply to you. If a company is subject to a cyber attack and we find they haven’t taken steps to protect people’s personal information in line with the law, they could face a fine from the ICO. And under the new General Data Protection Legislation (GDPR) coming into force next year, those fines could be a lot higher.” Sally Anne Poole, ICO enforcement manager 27 June 2017
- 29. So what are the steps expected to “protect people’s personal information in line with the law”?
- 30. If you suffer a data breach and are investigated by the ICO your data security is likely to be benchmarked against the 10 Steps to Cyber Security as published by GCHQ’s National Cyber Security Centre Storm offer services to cover ALL points related to satisfy compliance of server security. This focuses on the following 10 key areas: • Risk Management • Incident Management • Secure Configuration • Malware Prevention • Network Security • Monitoring • Managing User Privileges • Removable Media Controls • User Education & Awareness • Home and Mobile Working
- 31. Meaning… In the event of a data breach subsequently investigated by the ICO, you can demonstrate that you had done everything possible to secure your server and systems to the highest level possible.
- 32. Which means… • Significantly less chance of incurring fines from the Information Commissioner's Office (ICO) • Lower risk of reputational damage to business as security was as strong as was currently possible • No embarrassing stories published demonstrating company’s weak security policies • Significantly lower risk from other legal liabilities such as being sued
- 33. But more importantly… It means that your chance of ever suffering a data breach in the first place is as low as possible
- 34. We’d rather be proactive than reactive
- 35. So how do we help you achieve this? • Over 14 years experience and know-how securing commercial enterprise level servers & systems • We have strategic partnerships in place with a number of the best cyber security firms in the world. - Including Security Metrics, Cloudflare and shortly, Sucuri. • A range of services to effectively protect against malware, ransomware and viruses. • Firewall services to protect your web site from code injection style attacks such as SQL Injection and Cross- Site Scripting. • Managed PCI (Payment Card Industry) vulnerability scanning and certification services. • 24/7/365 Security and Uptime monitoring backed by an always available expert server support team. • Disaster Recover - Managed backup services ensuring your data can be restored in the event of a data corruption. • A flexible range of Managed Hosting support levels. • We are growing our services in this area all the time.
- 36. So how do we help you achieve this? 2018 will see… • More of this functionality added directly to your Storm Account Portal • Security scoring for all of your web sites and servers - Any areas we see as vulnerable or needing attention will be highlighted in real time. • Portal will be enhanced further with our “GDPR Security Centre”. - All the things you need to ensure you are covered into an interactive checklist style format
- 37. A couple of things you can do right now to improve security for free… • Ensure Operating System Auto-Updates are always enabled for all of your devices. - servers, desktops, laptops, tablets and smart-phones etc. • Ensure CMS software security updates are always enabled. E.g. for WordPress. • Use the Storm Portal to improve security on your web site by running it through Cloudflare for free. • Look at our Web Application Firewall service to filter out malicious Code Injection attacks to your web site. • Install an SSL Certificate on your web site. • Enable our PCI vulnerability scanning and certification service in order to secure your server or web site to PCI levels
- 38. And finally, if you need any advise, talk to us! We’re here for you 24/7/365
- 39. Thanks for listening!
- 40. GDPR & Security: How Digital Compliance Hub can help
- 41. Digital Compliance Hub – Managing your compliance https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Data Protection & GDPR Privacy & Marketing Web, Data & Cyber Security Info, guidance, toolkits, advice, support & training https://digitalcompliancehub.co.uk
- 42. Flavourfy Digital Consultancy https://flavourfydigital.co.uk - https://digitalcompliancehub.co.uk Compliance Audits Management Consultancy & Advice Training Digital Compliance Hub mark@flavourfy.co.uk https://flavourfydigital.co.uk