Data compliance - get it right the first time (Full color PDF)
0 likes1,127 views
This document summarizes a webinar on data compliance. It discusses: 1) Data is essential for businesses but also a target for criminals and needs proper management. 2) Proper data management involves knowing your data, processes, classifications, and lifecycles. It also requires understanding regulations and consequences of non-compliance. 3) Takeaways include keeping data categories simple, defining ownership, involving stakeholders, using standards, enforcing labeling, and considering support processes like incident response.
Data compliance - get it right the first time (Full color PDF)
- 1. GET IT RIGHT THE FIRST TIME Hosted by: Peter Geelen, Edwin Jerald 7 April 2022 12 PM CST D A T A C O M P L I A N C E : T H E S E R I E S
- 2. Introduction 1 Data is the new oil… 2 How to get started in practice 4 Data management essentials 3 Some take-aways 5 What we'll discuss today Hexnode and compliance 6
- 3. https://www.linkedin.com/in/pgeelen/ Sustainable secure & safe. Life hacker. Anything information security, data protection & privacy, cyber & cloud security. IAM, trainer & coach. About me Peter GEELEN ISMS/PIMS Master, cDPO, Accredited Lead Auditor ISMS/PIMS/BCMS/QMS
- 4. Data is the new oil
- 6. .. it won't run without data •Business data •Management data •HR data •Technical data •Network data •Personal data (PII) •Communications •Mail data •Financial data •Operational data •Intelligence •Intellectual Property (IP) •Ideas •…
- 7. Other businesses want your data as well
- 8. Also other businesses need your data…
- 9. Massive growth of digital business • Direct marketing • Data brokers • Data Intelligence • Data analytics • Big data • Artificial intelligence • Machine learning • Health care, research & development • …
- 10. But also … the dark side wants your DATA
- 11. Your data in the wrong hands
- 12. Current state of crime • Phishing • Ransomware – not only encryption – data leak extortion • Reconnaissance & Hacking • Data breaches • Biometric data • Digital & Economical war
- 13. Now the question is… How do YOU get in control?
- 14. You can't simply lock it up…
- 16. Data management essentials to get grip
- 17. How much €$ can you spend to protect your data?
- 18. You can only protect what you know you have
- 19. Without an owner there is no protection
- 20. Nothing is stable Everything has a lifecycle
- 22. The start of the cycle is mostly short, easy to manage low security risk.
- 23. The end of the cycle is mostly long, difficult to manage high security risk.
- 25. Assets have Vulnerabilities (weaknesses/properties) that can be exploited by Threats (activities) with impact ($$ cost)
- 26. You need to balance the protection against the impact
- 27. You don't want to over-spend or under-protect
- 28. Your boss (or insurance) needs a budget Spreading cost over a year Or 2..3..4..5.
- 29. Your boss (or insurance)e) needs a budget Spreading cost over a year Or 2..3..4..5.
- 30. How to get started
- 31. •International regulations (GDPR, …) •National regulations (SOC, …) •Sector regulations (PCI-DSS, ..) •Contractual obligations •Enterprise vs PII/personal data requirements Getting grip on your data Know the external context
- 32. Getting grip on your data Know the internal context •Know your business (what) •Know your organization (organigram) •Make an inventory of processes and interfaces •Assign business ownership –For each process –For each asset
- 33. Getting grip on your data Know the processes •Know the data flow •Know your sources (IN) •Know the data processing •Know your receivers (OUT)
- 34. Getting grip on your data Know the data in the processes •Categorize your data - data types – Enterprise data – PII / Personal data (GDPR !) – Other ?
- 35. Getting grip on your data Categorization (define data classes) •Sensitivity = linked to business impact •Ask the owner : "What if data is …" – unavailable – changed – destroyed – leaked – accessed unauthorized, illegally, unlawfully,…
- 36. Getting grip on your data Categorization (define data classes) •Categorize your data sensitivity – Enterprise data, for example • Unclassified, Official, Restricted, Confidential, Secret, Top Secret (NATO) • Public, Company internal, Confidential, Strictly confidential • TLP RED, TLP Amber, TLB Green, TLP White (public)
- 37. Getting grip on your data Classification (apply the labels) •Responsibility of owner •Label all data •Label containers if you can't label the data – Folder or File share – Data base – mailbox – …
- 38. Getting grip on your data Mind the lifecycle • Get started • Keep going • Start over again • Think about security when – creating new processes – changing processes – removing processes – recheck on a regular schedule (even when nothing changes)
- 39. Getting grip on your data Mind the business and legal requirement •Accountability & Responsibility •Reporting & audit requirements (SOC I-II, …) •Incident management requirements •Data breach requirements (GDPR) •Subject rights
- 40. Getting grip on your data Mind the business and legal requirement Source https://www.icfiles.net/security/what-is-soc-2/
- 41. Consequences of data management failure •Financial loss •Business loss •Reputation loss •Contract SLA violation •Regulatory violations •Fines •Prosecution •Personal accountability
- 42. Consequences of data management failure Think about •Direct and indirect impact •Short term and long term impact •How long can you survive a total breakdown?
- 43. TAKEAWAYS
- 44. KISS (Keep it simple and stuff..) • Manage enterprise data like personal data • Keep the categories simple (<7) – 3 TLP (Red-Amber-Green) + 2 categories (public + highly critical) • Define and maintain ownership • Involve everyone • Evangelize internal & external stakeholders (incl. customers…) • Lead by example
- 45. Use business best practices •Use standards and frameworks •ISO (international) •NIST (US) •ENISA (EU) •COBIT (ISACA) •…
- 46. Classification and labeling •Force labeling •Aim to classify everything •Start with new data first •Update labels when you change documents •Set a default label for archived data that doesn't change •Don't set public as default
- 47. Think about the support processes • Incident management (ISO 27035 & NIST) •Data breach management (GDPR & other …) • Business continuity (ISO22301) •Disaster recovery
- 49. " From desktops to mobile devices to IoT, the device ecosystem is vast and heterogeneous. " Staying compliant with regulatory guidelines may be difficult, especially if devices are not within the confines of the organization.
- 50. Here's how Hexnode can help •Manage applications and ensure application security •Ensure network and device security •Enforce data security and compliance
- 51. RISK: UNAUTHORIZED ACCESS TO UNATTENDED DEVICES • Enforce strong password policies on devices. • Enable data encryption on managed devices. • Containerize and secure corporate data on personal devices. • Track device location and lock down devices when outside work zones. How Hexnode can HELP
- 52. RISK: DATA ACCESS THROUGH UNSECURE APPLICATIONS • Uninstall or blacklist unsecure applications. • Set up application permissions and configurations. • Monitor and control per-app data usage. • Disable file sharing options on managed devices. • Disable copy/paste options to control data flow. • Secure data by locking devices down in kiosk mode. How Hexnode can HELP
- 53. RISK: DEVICES DO NOT MEET SECURITY REQUIREMENTS • Patch any known vulnerabilities by updating device software and OS. • Enforce restrictions and security configurations on managed devices. • Prevent users from tampering with sensitive device features like USB debugging, factory reset, etc. How Hexnode can HELP
- 54. RISK: CHANCE OF COMPROMISE WHILE DATA IS IN- TRANSIT • Configure email and contacts and calendars • Push Wi-Fi and VPN configurations and prevent devices from connecting to unsecured networks. • Push web content filtering policies to keep corporate data safe from fraudulent websites. How Hexnode can HELP
- 55. RISK: UNMANAGED ACCESS TO SENSITIVE INFORMATION • Streamline access management using integrations with directory services (Azure AD, Okta, G-Suite). • Deploy certificates to manage user access to corporate tools and services. • Configure user and device groups on Hexnode to deploy resources based on roles and privileges. How Hexnode can HELP
- 56. RISK: LACK OF VISIBILITY ON POLICIES AND OPERATIONS • Monitor the security and compliant state of managed devices. • Identify non-compliant devices and perform corrective actions on them. • Remotely enable lost mode to protect corporate data on stolen or lost devices. • Generate reports on device status and health. How Hexnode can HELP
- 57. " Hexnode makes it easier for organizations to maintain compliance with regulatory requirements "
- 59. Q n A