Story image

Why encryption is a critical step towards NDB compliance

16 Oct 2017

In the first half of 2017, 1,901,866,611 data records from 918 breach incidents were compromised globally with only 4.6% of breaches rendered useless due to encryption. With results like these, it’s clear awareness needs to be raised around the potential risks of our data and the criticality of businesses implementing effective security solutions.

The businesses that made the decision to encrypt their data are setting the example for businesses and will be the ones to showcase encryption’s ability to render data useless to anyone that has breached the perimeter security, attempting to access the data without authorisation. When considering encryption, businesses must first understand what data they produce and which data is most valuable or sensitive, through conducting a data sweep. Only by understanding what data they have can businesses then seek to encrypt and protect it.

Encryption keys are essential to unlock secured data and provide fundamental control over who has access to certain data – making companies, and more importantly customers, the custodians of their own data. The best approach is to store encryption keys in specially designed hardware, to avoid them from being hacked. Otherwise, it is like fitting your house with the best security out there, and then leaving your key under the doormat for the burglar to find.

Assuming responsibility

It’s not just the risk of a financial hit businesses need to worry about, but a reputational one too. It may not come as a big shock, but consumers believe the majority of responsibility lies with the business to protect their data and will blame them if something goes wrong. Companies need to take note of this, because if something does go wrong, customers are likely to go elsewhere.

With the upcoming Notifiable Data Breach (NDB) legislation, the true cost of a breach is still to be felt across Australia as businesses are currently not forced to reveal when they have been breached. As such, they still mostly maintain customer loyalty. While businesses should know that it is a case of when, not if, a breach occurs, NDB should serve as a wake-up call. To keep that loyalty, they must show they are actively working to protect their customer data using techniques like encryption.

Currently, there is limited incentive to prioritise security, and a lack of accountability for the business.

Access management

Encryption itself is very effective, but if you do not protect it and the encryption keys that unlock it, then it can easily be cracked by unauthorised individuals. To protect against this, businesses should also focus on who is authorized to access valuable and sensitive data.

The best approach is to use two-factor authentication, which requires the employee to have something like a phone or access to an email address and to know a code or password that is constantly changing, rather than just a code or password that can be guessed. These types of security are readily available, but need to be more widely adopted by businesses.

Currently, there is limited incentive to prioritise security, and a lack of accountability for the business. Companies need to start taking security seriously and this means from the top down. NDB is still to come into effect, but businesses need to start preparing now before it is too late and they are faced with a potential fine and damaged reputation.

Company boards should take a considered approach to security. It is not a question of the Chief Information Security Officer (CISO) saying no all the time, but rather implementing security protocols early so that it does not affect innovation and ensures the company adheres to the latest regulations.

Furthermore, by establishing a security mindset at the top of the company, it will filter down to the rest of the employees. Every business should know that its defence is only as secure as its weakest link.

Article by Graeme Pyper, regional director, Australia and New Zealand at Gemalto.

Survey: IT pros nostalgic over on-prem data centre visibility
There are significant security and monitoring challenges faced by IT staff responsible for managing public and private cloud deployments.
61% of CIOs believe employees leak data maliciously
Egress conducted a survey to examine the root causes of employee-driven data breaches, their frequency, and impact.
Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.
SIS announces a partnership with Platform 4
“We are looking forward to a strong future in the New Zealand security industry with this global giant as our strategic partner."
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.