Yes, U.S. companies must worry about EU GDPR compliance, too. Is your company ready?

With just over three weeks to go until the May 25, 2018, deadline, many U.S. companies are woefully unprepared for the EU’s new General Data Protection Regulation, or GDPR. In fact, quite a few of them don’t yet realize they have to achieve EU GDPR compliance. A new survey by CompTIA found that “A full 52 percent of 400 U.S. companies surveyed are either still exploring the applicability of GDPR to their business; have determined that GDPR is not a requirement for their business; or are unsure.”

Additional findings from the CompTIA study include:

• Only 13% of U.S. companies surveyed reported having achieved full EU GDPR compliance, with 23% “mostly compliant” and 12% “somewhat compliant.”
• Only 25% of U.S. companies surveyed reported being “very” familiar with the EU GDPR.
• Only 22% of U.S. companies surveyed have developed a GDPR compliance plan, and only 21% have conducted data audits and readiness assessments
• Nearly one-third of U.S. companies surveyed mistakenly believe that the deadline for GDPR compliance is the end of 2018.
• 64% of U.S. companies surveyed are unaware of the [very stiff] penalties for not complying with the GDPR.

Respondents to the CompTIA survey listed accountability and allowing users to correct inaccuracies; data transparency and the rights of users to access their data; user consent; data portability; and the “right to be forgotten” as the most challenging aspects of EU GDPR compliance.

U.S. Companies and EU GDPR Compliance

The applicability of the GDPR to your business is not based on where your company is located, but on where your customers are located. If you conduct business with any individuals or organizations in the European Union, you must comply with the GDPR. Further, in addition to customer data; it also governs employee and human resources data.

How serious is the EU about enforcing GDPR compliance among U.S. companies? Last week, EU authorities flatly rejected a request from U.S.-based ICANN, which is in charge of the WHOIS “internet phonebook,” for more time to make WHOIS GDPR-compliant. Yes, that ICANN, and that WHOIS. This was not foisted on ICANN at the last moment; the organization had a two-year lead time to come up with a solution but dragged its feet. Because of the ICANN GDPR debacle, cybersecurity experts, law enforcement agencies, and IP attorneys fear that the WHOIS directory will become fragmented or go dark on May 25.

What Does the EU GDPR Mean for U.S. Companies?

The EU GDPR is arguably the most comprehensive, far-reaching data privacy law ever enacted. Among other things:

• It will require impacted companies to fundamentally alter their data governance and bake data security into their products, policies, procedures, and systems from day one.
• It will hold your organization responsible if one of your third-party vendors is breached.
• It grants EU “data subjects” sweeping data privacy rights, including data portability, the right to access their data, the right to withdraw consent, and the “right to be forgotten.”
• It mandates that organizations notify the authorities and affected customers within 72 hours of detecting a breach.

Much like HIPAA, the EU GDPR specifies what organizations must achieve, but it does not prescribe the specific technical controls to get there.

Is your organization ready for the GDPR compliance deadline on May 25? Lazarus Alliance has a free GDPR readiness tool. Click here to take your GDPR readiness assessment and download your free report today!

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

The Under Armour breach provides lessons in the do’s and don’ts of enterprise cybersecurity and compliance with the EU GDPR

Last week, athletic apparel manufacturer Under Armour announced that its popular MyFitnessPal weight loss and fitness tracking app had been hacked, compromising 150 million accounts. The Under Armour breach is the largest data breach so far this year and ranks among the top five to date. It also makes a good case study in the do’s and don’ts of enterprise cybersecurity. Let’s examine the lessons enterprises can take away from the Under Armour breach and its fallout, especially as the deadline for the EU GDPR approaches on May 25.

If a breach does happen, prompt disclosure is crucial.

The Under Armour breach was discovered on March 25 and disclosed only four days later; compare this to Equifax, which waited several weeks to notify users it had been hacked (and then chose to do so while the nation’s attention was focused on Hurricane Irma), and Uber, which waited more than a year (after attempting to cover the breach up). Prompt disclosure is going to be even more important under the GDPR, which will require organizations to report breaches within 72 hours.

Segment your data, and collect only the data you need.

The Under Armour breach involved only user names, email addresses, and encrypted passwords. The MyFitnessPal app does not collect Social Security numbers or other government identifiers, and payment information is stored separately, in a part of the system the hackers did not breach.

The GDPR requires organizations to bake data security into their products, policies, procedures, and systems from day one. While network segmentation alone does not constitute data security, it goes a long way towards demonstrating due diligence.

The GDPR will also require organizations to provide users with a plain-language explanation of what user data they are collecting and what they intend on doing with it. If you don’t absolutely need a particular piece of personal information to conduct your business, don’t collect it.

Properly encrypt and salt user passwords.

This is where Under Armour dropped the ball. The company states that while “the majority” of the compromised passwords were hashed using the robust bcrypt hashing function, at least some of the passwords were hashed using the notoriously hackable SHA-1 function. Under Armour has not disclosed why only some of the passwords were encrypted with bcrypt. It also has not specified whether the bcrypt-hashed passwords were salted for extra protection, which involves appending random data that is unique to each user and saving it along with their password.

To properly protect user passwords and fulfill the security requirements of the GDPR, make sure you are using a robust hashing function and salting user passwords. As strong as bcrypt is, it is not unbreakable; the Ashley Madison hack involved 36 million passwords hashed using bcrypt.

Do not reuse passwords.

Although the Under Armour breach yielded “only” email addresses and login credentials, not payment data or sensitive personal data like Social Security Numbers, a lot of people use the same set of login credentials on multiple sites. Armed with these credentials, hackers could attempt to use them on banking, shopping, or social media sites and to access victims’ email accounts. This underscores the importance of using a different, strong password for every system, website, and app.

If you have a MyFitnessPal account, you should log in and change your password right now. If you reused your MyFitnessPal password on any other sites, make sure to change those, too.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.

Proactive Steps to Promote Employee Cybersecurity Compliance

Your organization’s people are your first line of defense against cyber criminals. Unfortunately, they’re also your weakest link. Insiders pose the biggest threat to cybersecurity in the healthcare industry, and only 13% of public sector employees “take personal responsibility for cybersecurity.” Here are 10 proactive ways to improve employee cybersecurity compliance.

Employee Cybersecurity Training Should be Mandatory & Continuous

The cyber threat environment is constantly changing, so employee cybersecurity training is not “one and done.” It is a continuous process that should begin during the onboarding process and continue throughout the employee’s tenure.

Employee Cybersecurity Training Is About More than Compliance

Many healthcare organizations make the mistake of focusing employee cybersecurity training exclusively on HIPAA compliance, and organizations in other industries can fall into similar traps. While compliance is important, it does not automatically equate to cybersecurity.

Keep Employee Cybersecurity Rules & Procedures Simple

Often, employee cybersecurity manuals are written by the IT department or security personnel, who may fill them with so much “tech-speak” that they require a degree in computer science to decipher. Make sure that your rules and procedures are written in plain language that non-IT employees can easily understand.

Everyone Needs to be Trained

Cyber security is everyone’s responsibility. This includes all levels of employees, from the C-suite down to the receptionist. Don’t forget about part-time employees, seasonal workers and other temps, even interns. Everyone in your organization who has access to a computer must be trained on cybersecurity best practices.

Have Clear Cyber Threat Reporting Procedures

If one of your employees receives a suspicious email or finds a flash drive on the floor, who should they report the incident to, and how? Make sure your employees know exactly what to do next.

Tie Workplace Cybersecurity to Personal Cybersecurity

Illustrating why cybersecurity hygiene is important both in and outside the office is a great way to reinforce training lessons and bolster employee buy-in. Use real-world examples that employees can relate to, such as phishing scams that seek to steal personal account credentials.

Employ User Behavior Analytics & Continuous Monitoring

User behavior analytics, paired with continuous monitoring of network activity, protect your organization on two fronts. First, they allow you to identify employees who are snooping around in areas of your system they don’t need to access to do their jobs. Second, they allow you to identify stolen credentials by flagging logins at odd hours and/or from unusual locations. In either case, you can set up the system to temporarily suspend access until you determine what’s going on.

Regularly Review Employee System Access

The best way to ensure that employees don’t misuse their credentials is to prevent them from doing so in the first place. Employees should be given the minimum amount of system access to perform their jobs, and no more. Access levels should be regularly reviewed for appropriateness.

Don’t Flog Employees for Making Mistakes

Even the most diligent employee can make a mistake. If employees fear being fired for inadvertently clicking on a phishing link, not only will they not report the incident; they may try to cover it up, which could make things even worse. Encourage employees to report missteps as soon as possible, and ensure them that they won’t be disciplined for doing so.

Reward Employees for Good Cyber Behavior

In addition to not beating your employees with sticks, offer some carrots. Recognize employees who flag phishing schemes and other attempted cyber attacks.

The cybersecurity experts at Lazarus Alliance have deep knowledge of the cybersecurity field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cybersecurity®. Call 1-888-896-7580 to discuss your organization’s cybersecurity needs and find out how we can help your organization adhere to cybersecurity regulations, maintain compliance, and secure your systems.