AT&T: Four considerations for cybersecurity
The end of May ushered in the General Data Protection Regulation (GDPR).
Companies now need to have stricter policies and processes related how they collect, use and store personal data.
There will be heavy penalties for GDPR violations. The new law sets stricter requirements on for example user consent, information to be provided to the user and stricter requirements on implementation of data protection measures. Data controllers have to disclose personal data breaches to regulators within 72 hours of becoming aware of a personal data breach.
International companies need to comply with the new regime if they want to have access to the EU market of 500mn people.
Four recommendations to reassess security readiness
Now is the time to safeguard your business for the long term and reassess your security processes as part of data protection readiness. As part of your reassessment, try this four-point security checklist.
1) Conduct a cyber security risk audit and assessment
An audit helps determine your current cybersecurity investments. A risk assessment will evaluate your security infrastructure and controls relative to the cybersecurity threat from emerging technologies and new hacking techniques. This could include the internet of things, mobility and cloud security. A gap analysis can also help you understand where you are versus where you want to be.
Two-thirds of organisations do not conduct regular cyber risk assessments. Regular reviews are crucial for the success of your business.
See also:
2) Set up a threat alert platform
Every end-point, such as an IoT device or mobile device is a potential entry point. And each has different security implications. The key is to build an integrated threat-analytics platform for all end-points. This platform needs to have a built-in, always-on security approach.
You can use threat analytics to study the ecosystem and ensure you are safe at all times.
An automated system that detects and responds to threats is important for audit and compliance procedures. A feed-back loop between your internal cybersecurity operations is ideal. Combined with a flexible risk management strategy, it can evolve based on daily threat activity and response.
3) Get support from your service providers
To help protect sensitive data and apps that reside in your network, you need to work with your service providers. You should have full visibility of your network traffic and be able to authenticate legitimate users while blocking suspicious activity.
Today, an increasing number of companies are using artificial intelligence (AI) technologies to support their customers. AI tools can detect anomalous behavior and zero-day attacks. It helps to overcome the challenge of limited security resources.
4) Organise ongoing staff training
People are still the weakest link in the cybersecurity chain. Cybersecurity attacks affected nearly 80% of organisations in the past year; but only 61% mandated security training for staff.
Every member of your organization needs to be aware of new types of security threats. Building a security culture takes time and effort and this sort of ongoing conversation with a top down approach is essential.
At the same time, threats are getting more sophisticated. From casual intruders to well-funded criminal organisations, hackers are increasingly using big data analytics to search for threat vectors. They are also using AI for social engineering attacks, such as phishing, to steal sensitive data and credentials. Daily cybersecurity events now number in the millions, and we should expect ransomware, malware and other attacks to continue to escalate. The focus has to be on changing user behavior and putting in place the right procedures to counter these attacks.
John Vladimir Slamecka, Region President, EMEA, AT&T
