Post on 15-Jul-2020
Vesselin Yankov
Regional Representative
September 28, 2017
GDPR – Are You Ready?
• Prepare for GDPR and the upcoming campaign
• Overview of GDPR
• Familiarize yourself with the regulation and timelines
• Details and differences
• Data breaches and fines
• How to achieve compliancy
• Role of IAM
• Обхват на решението
• Questions you can ask
Objectives
GDPR – Some Facts
What is GDPR, anyway?
• GDPR (Regulation (EU) 2016/679)
replaces the current EU data protection
directive (95/46/EC), and intends to
strengthen and unify data protection for
individuals within the EU, and to give
citizens back control of their personal data.
• Adopted on 27th April 2016, and becomes
legally effective on 25th May 2018.
Why should customers care?
• The GDPR is a game-changer for organizations holding,
and protecting, personal, identifiable information on EU
citizens (PII).
• GDPR takes direct legal effect in EU member states
without need for local legislation
• Takes precedence over any local conflicting legislation,
including sector-related regulation
• Significant reputational risk & fines for non-compliance
• The EU can’t sustain a
“Patchwork Carpet”* of
Privacy Laws
• GDPR solves unique
privacy laws per country
• Difficult to conduct
business
- Multi-nation Employees
- Manage Customer Data
- Manage Health Care Records
Perspective on GDPR
*Christoph Stoica
Scope of GDPR – who is affected?
• Expanded territorial reach vs existing data protection
directive
• Applies to organisations established in the EU, but also to EU-
based entities, regardless of whether data is processed inside or
outside the EU; or organisations based outside the EU who are
offering goods and services to EU citizens, or monitoring their
behaviour where that behaviour takes place in the EU
Data Controllers & Data Processors
Data Controller:
"Controller" means the natural or legal
person, public authority, agency or any
other body which alone or jointly with
others determines the purposes and
means of the processing of personal
data; where the purposes and means of
processing are determined by EU or
Member State laws, the controller (or the
criteria for nominating the controller) may
be designated by those laws.
Data Controller:
"Controller" means the natural or legal
person, public authority, agency or any
other body which alone or jointly with
others determines the purposes and
means of the processing of personal
data; where the purposes and means of
processing are determined by EU or
Member State laws, the controller (or the
criteria for nominating the controller) may
be designated by those laws.
Data Processor:
"Processor" means a natural or legal
person, public authority, agency or any
other body which processes personal
data on behalf of the controller.
Data Processor:
"Processor" means a natural or legal
person, public authority, agency or any
other body which processes personal
data on behalf of the controller.
What do we mean by ‘Processing’ Personal Data?
Personal
Data
Collection
Recording
Organisation
Structuring Storage
Adaptation/Alteration
Retrieval
Use
Erasure
Destruction Consultation
• 1. Personal data shall be:
• (f) processed in a manner that ensures appropriate security of the
personal data, including protection against unauthorised or unlawful
processing and against accidental loss, destruction or damage, using
appropriate technical or organisational measures ('integrity and
confidentiality').
• 2. The controller shall be responsible for, and be able to demonstrate
compliance with, paragraph 1 ('accountability').
Obligations when Processing Personal Data
What is Personal Data?
"Personal data" means any information relating to an
identified or identifiable natural person ("data subject");
an identifiable person is one who can be identified,
directly or indirectly, in particular by reference to an
identifier such as a name, an identification
number, location data, online identifier or to one or
more factors specific to the physical,
physiological, genetic, mental, economic, cultural or
social identity of that person.
"Sensitive Personal Data" are personal data,
revealing racial or ethnic origin, political opinions,
religious or philosophical beliefs, trade-union
membership; data concerning health or sex life and
sexual orientation; genetic data or biometric data.
But, who..?
• Organisations within scope must:
• Prove compliance – document/record the principles behind
processing decisions
• Implement comprehensive, proportionate governance measures
such as privacy impact assessments, and ‘privacy by design’
• Report data breaches within 72 hours of becoming aware of the
breach
More Accountability with GDPR
• Mandatory data breach reporting for all organisations is a
key change to current legislation
Data Breach Reporting?
Notification to relevant supervisory
authority:
Where the breach is likely to result in
significant detrimental effect on
individuals – i.e. discrimination,
reputation, financial loss, loss of
confidentiality or other social or
economic disadvantage
Notification to relevant supervisory
authority:
Where the breach is likely to result in
significant detrimental effect on
individuals – i.e. discrimination,
reputation, financial loss, loss of
confidentiality or other social or
economic disadvantage
Notification to individual concerned:
Where the breach is likely to result in
high risk to the rights and freedoms of
individuals, they must be notified directly
Notification to individual concerned:
Where the breach is likely to result in
high risk to the rights and freedoms of
individuals, they must be notified directly
"Data breach" means a breach of security leading to the
accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to, personal data
transmitted, stored or otherwise processed.
i.e. a breach is more than just losing personal data
What is a Data Breach?
Data Breach Penalties
Failure to Notify
2% Global Turnover
Maximum of €10m
Failure to Notify
2% Global Turnover
Maximum of €10m
Serious Breaches
4% Global Turnover
Maximum of €20m
Serious Breaches
4% Global Turnover
Maximum of €20m
Each supervisory authority shall ensure that the imposition of administrative fines pursuant to
this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6
shall in each individual case be effective, proportionate and dissuasive
GDPR Differentiated from PCI
GDPR
Non Prescriptive
Controls are not
mandated.
No mapping of controls.
PCI DSS Compliance*
Prescriptive
Controls like MFA are
mandated.
Mapped controls.
*Payment Card Industry
≠
What do customers need to do?
• Speak to their lawyers
• Undertake mandatory obligations, such as determining
whether they need to appoint a Data Protection Officer,
Privacy Impact Assessments and implement Privacy By
Design and Privacy by Default
• Look at GDPR holistically – it’s a whole organisation issue
• e.g. all employees must understand their obligations regarding the
processing of personal data
What do customers need to do…
3 Fundamental Principles for Protecting Personal
Data – What, Where, Who
What personal data do we store/process? Do we need to?
Where do we store/process personal data? Is it protected?
Who has access to personal data? Is it appropriate?
The major threat comes from inside
1- 2016 Ponemon Institute, The cybersecurity risk to knowledge assets 2- 2015 Ponemon Institute, Cost of Cyber Crime Study
The most likely root causes
of data breaches1
1.67
2.45
2.89
1- most likely
3- least likely
Careless
INSIDER
Malicious
INSIDER
EXTERNAL
Attacker
Malicious insiders
Denial of services
Web-based attacks
Phishing
Stolen devices
Malware
$145,000
$127,000
$96,000
$82,000
$34,000
$7,400
Average cost per attack2
The Role of IAM in Protecting Personal Data
1. Personal data shall be:
(f) processed in a manner that ensures appropriate security of the personal
data, including protection against unauthorised or unlawful processing and
against accidental loss, destruction or damage, using appropriate technical or
organisational measures ('integrity and confidentiality').
2. The controller shall be responsible for, and be able to demonstrate
compliance with, paragraph 1 ('accountability').
Remember this…?
GDPR impacts the way that organisations
need to think about security…
The Role of IAM in Protecting Personal Data
Manage &
Govern Rights
Enforce
Access
Controls
Monitor
Activity
How to achieve compliancy ?
( Обхват на решението )
MICROFOCUS CAN HELP !
• Внедряване на система за IT Assets Management
NetIQ Asset Management
Внедряване на инструмент за инвентаризация на всичките ИТ активи.
Придобиването на информация в реално време за всички устройства и софтуер в
ИТ инфраструктурата както и за тяхното натоварване и използване ще позволи да
се намали опасността от компрометиране на сиурността поради наличието на
неконтролирани източници на заплахи. Събирането и поддържането на актуална
информация ще позволи правилно да се планира обхвата на всеки един от
следващите етапи. Всеки опит за включване на нови устройства или за
инсталиране на нов софтуер ще се открива автоматизно и веднага и ще
предизвиква съответните действия.
Обхват на GDPR решението (1)
• Внедряване на система за Access Management и Privileged
Account Management (NetIQ)
Изграждане на система за предоставяне и за контрол на достъпа на потребители
до WEB базирани услуги в ИС с автентификация в LDAP. Интеграция на всички
WEB базирани приложни системи с досегашна локална автентификация към
системата за централизирана автентификация. Изграждане на услуга за
автентификация за външните потребители на услуги, предлагани от
организацията. Изграждане на система за управление и контрол на достъпа на
привилегированите потребители (потребители с административни права,
компрометирането на които крие най-голяма опасност). Осигуряване на
централизирана автентификация за администраторите на сървърите през LDAP
и ограничаване на локалния достъп.
Обхват на GDPR решението (2)
What does it do? • It delivers a seamless single sign-on (SSO) experience for internal and consumer users of all web applications using
standards-based federation (SAML, OAuth, OpenID Connect, WS-Federation, etc.) as well as other technologies.
• It allows organizations to securely share information—such as supply chain, customer, financial, intellectual property, patient
information (and so on)—with business participants.
• Enables administrators to quickly and effectively add or remove access as needed, as well as track access to ensure
compliance.
• Its risk-based authentication engine empowers organizations to increase the security of the services and applications
containing private information while simplifying access for low-risk services or situations.
Common uses
• Federation. Enable control user access and single sign-on through federation to cloud based applications.
• Gateway. Enable user access control and single sign-on across the organizations’ entire web
environment. Access Manager’s gateway is the best in the industry, providing integration for all types of web-based
applications.
• Fills out NetIQ’s Identity Manager solutions: 70% of access manager deployments are part of an IDM installation. Typically,
the end goal for managing identities is to control access.
• Office 365: Use Access Manager to address access control and single sign-on.
• Consuming social identities so governments and businesses can allow customers/citizens to use those identities rather than
create a new identity with the business. Access Manager also allows organizations to tie social identities to verified identities.
• Provide access to mobile apps by (1) pushing web apps out to portable devices through the MobileAccess App; (2)
integrating with mobile apps that support OpenID Connect; (3) using Access Manager’s iOS SDK (Android coming soon).
Capabilities • Provides SSO for mobile applications.
• Provides a simple-to-implement cross-platform portal (mobile devices as well as
full browsers)
• Supports standards-based federation like SAML, OAuth, OpenID Connect, WS-
Federation.
• The simple sign-on add-on supports any service that can’t be integrated through
standards based federation or the gateway.
• Enables SSO by managing multiple passwords for applications at the back end.
• Is integrated with the NetIQ Advanced Authentication Framework that lets
customers use almost any authentication methods, including biometrics, smart
cards, tokens and more.
• Makes it possible to deliver single sign-on access to Office 365 and Microsoft
SharePoint without the need to deploy and maintain complex Microsoft Active
Directory Federation Services (ADFS) configurations.
• Integrates with social identities so applications and services can be personalized
while not requiring the user to create another isolated user account.
• Includes built-in monitoring and analysis tools so that administrators can track
usage trends as well as spot anomalies.
• Внедряване на система за Identity Management (NetIQ)
Синхронизация, интеграция и репликация на информацията за
цифровите идентичности и информацията за активите между всички
информационни системи на организацията. Изграждане на удобен
механизъм за създаване, блокиране на електронна идентичност и
предоставяне на права от представители на “Човешки ресурси” без това
да ангажира системните администратори. Осигуряване на механизъм за
изграждане на различни нива на достъп до различните услуги;
Обхват на GDPR решението (3)
What does it do?
• Automates account creation and revocation, centralizes access administration and ensures every user has just one
identity.
• It reduces the time, effort and cost of changes (such as when a user changes jobs within a company), protects
against compliance violations by enforcing policy and controls, and makes it easy to immediately provision and
revoke resources.
• It provides management of roles, policies, workflow and reporting to meet the most demanding scale and regulatory
requirements.
• Solves problems:
• Integrate silos of identity to reduce security risk due to missed changes, while reducing the significant
workload placed on IT to maintain those silos.
• Add or remove accounts instantly to reduce or eliminate lag time that leaves users unproductive and exposes
the business to the risk of users who retain too much access when they leave a job or role.
• Condense the time needed to produce reporting on roles, users and activities down to minutes rather than
days or weeks.
• Centralize identity and access management for SaaS applications to avoid inconsistent policy enforcement
between internally and externally provided services.
• Reduce the time, expense and expertise needed to integrate with applications with the drag-and-drop
Designer utility.
• Внедряване на система за Single Sign-On и въвеждане на
многофакторна афтентикация
NetIQ Access Management, NetIQ Advanced Authentication, NetIQ Secure Login
Реализация на технология позволяваща осигуряване на достъп на потребителите
до всички приложения след еднократна автентификация и авторизация в
директорийната услуга. Осигуряване на възможности за внедряване на средства
за еднократно регистриране/подписване (Single Sign On) за приложения, за които
не може да се осигури централизирана автентификация в LDAP. Изграждане на
технология за използване на средства за многофакторна идентификация във
вътрешната и външната инфраструктура (Smart cards, Tokens, УЕП). Интеграция
на средствата за многофакторна идентификация с директорийната услуга;
Обхват на GDPR решението (4)
What does it do? • It enables organizations to elevate secure access beyond username
and password using multi-factor authentication methods. These
methods usually replace the traditional username and password
paradigm, but they can also be used to augment username and
password for interactions that need an extra layer of protection against
unauthorized access.
• Strong authentication methods are more foolproof than passwords can
ever be. With the Advanced Authentication, your customers can:
Safeguard access with multiple layers of security: What the user knows
(password), what the user has (smart card, token or other
authentication device) and who the user is (biometric authentication—
retina scans, breath and capillary analyzers, and more).
• Eliminate the need for passwords altogether—a simple card swipe or
finger scan (or any option required) immediately gives authorized users
access.
• Meet regulatory requirements for healthcare, finance, government, law
enforcement (including the Criminal Justice Information Services, or
CJIS, mandate) and more.
• Provide support for a wider range of devices than any other solution on
the market: Advanced Authentication integrates with almost any
authentication reader or device.
• Eliminate the need for multiple authentication solutions and separate
servers to support each device.
• Внедряване на система за Privilege Account Management (NetIQ)
• Изграждане на система за управление, мониторинг и контрол върху действията
на привилигированите потребители (администратори с максимални права на
достъп). Персонифициране на правата на база роли/задължения и текущ одит
върху всички действия извършвани от привилигированите потребители.
• Изграждане и настройка на система за алармиране в реално време при
откриване на инциденти, свързани с действията на привилигированите
потребители.
Обхват на GDPR решението (5)
What does it do? • Manage insider risk by closely controlling and monitoring what
privileged users, such as super-users and administrators, are doing
with their access.
• It eliminates the need to distribute administrative credentials to the
entire administrative staff by delegating privileged account access
rights using configurable, centralized policies
• You can:
• Secure privileged access to sensitive assets with advanced
authentication controls: Integrates with NetIQ Advanced
Authentication to support two factor authentication and step-up
authentication.
• Single sign-on to Linux and UNIX servers: Authorized users
can access servers without entering additional credentials or
complex commands.
• Ensure users get only the access rights they need, when they
need them: Users can only perform administrative tasks that
are specific to their identity and role.
• Eliminates use of “global” passwords. Shared Account
Password Management (SAPM): Store credentials in a secure
vault that authorized users must check out. Supports
databases, applications and systems in both physical and
virtual (e.g., VMware ESXi) environments.
• Risk-based privileged session control: Immediately identifies
potential threats as they are typed and can be configured to
automatically terminate the session or revoke access.
• Внедряване на система Security information and event
management (SIEM) и File Integrity Monitoring (FIM)
NetIQ Sentinel, NetIQ Change Guardian
• Изграждане на система за мониторинг и управление на събития, свързани с
информационната сигурност (Log Management). Осигуряване на възможност за
регистриране (logging), и контрол (auditing) на дейностите на потребителите с
възможност за извършване на справки за произволен период от време.
Изграждане и настройка на система за алармиране в реално време при
откриване на инциденти, свързани с комуникационно-информационните системи;
• Внедряване на система за File Integrity Monitoring.
Обхват на GDPR решението (6)
• GDPR (Регламент (ЕС) 2016/679 на Европейския парламент и на
Съвета от 27 април 2016 година относно защитата на
физическите лица във връзка с обработването на лични данни и
относно свободното движение на такива данни),
• НАРЕДБА за общите изисквания за мрежова и информационна
сигурности,
• Директива (ЕС) 2016/1148 на Европейския парламент и на
Съвета от 6 юли 2016 г. относно мерки за високо общо ниво на
сигурност на мрежите и информационните системи в Съюза
Важни закони и нормативни актове:
БД 1
ЦИ
П1
БД N
ЦИ
П N
Централно репозитори за ЦИ
Управление на Цифрови Идентичности
(процеси, форми, логика, правила, ... )
Управление на Достъпа до уеб приложения
Управление на одитни записи (логове) (LM)
Управление на инциденти (SIEM)
Въпроси и коментари ?
• Веселин Янков
• VYankov@MicroFocus.com
• +359 888 340 856