What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

AIMA helps ensure you're prepared for GDPR

BY eSentire

February 9, 2018 | 5 MINS READ

Managed Detection and Response

Regulatory Compliance

Sensitive Data Protection

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

The General Data Protection Regulation (GDPR) comes into effect on May 25th, 2018 – a mere three months from now. In anticipation of this and the changes it will mean for compliance rules, the Alternative Investment Management Association (AIMA) recently released their GDPR Implementation Guide with the purpose of assisting AIMA members in preparing for the upcoming implementation of GDPR. While this guide explores the background of GDPR and provides a summary of key rules and questions as well as a compliance checklist, the guide also discusses the ramifications of GDPR on cybersecurity—which is where we’ll focus.

What are the GDPR rules around cybersecurity?

Article 25 of the GDPR contains minimum data-protection rules for organizations that process personal data. It requires they implement technical and organisational measures to ensure the protection of personal data during processing and that data is only accessible by authorised parties.

Article 32 outlines the requirements on controllers and processors for the security of processing activities. Organisations must implement technical and organisational measures to protect personal data from accidental or unlawful destruction, loss, alteration or unauthorised disclosure. To do so would require regular testing and evaluation of controls, as well as the proven ability to recover in a timely fashion from a natural or technical disaster.

GDPR compliance considerations

The flexibility of the GDPR means that firms should evaluate and be clear in what they believe is sufficient to comply with the requisite standard of data protection and security. Firms should consider undertaking the followings steps:

MDR prepares you for GDPR

Perhaps the most challenging requirement of the GDPR is the prevention of loss, alteration, unauthorized access or disclosure of sensitive personal data. Often, the prevention of unauthorised access to data involves the use of technologies, such as Intrusion Prevention Systems, Endpoint Protection and Logging. Given the complexity of these systems, organisations may choose to rely on managed security service providers (MSSPs). MSSP services provide the management of network and security technologies, with frequent reporting of performance and events. These services provide a means of managing complex security systems, but unfortunately do not typically provide firms with real-time monitoring to detect and then react to cyberattacks.

As previously mentioned, there is a new category of outsourced solution called Managed Detection and Response (MDR).[1] This service acknowledges:

  1. The shortage of in-house expertise needed to scan for threats and to take action to stop any attack before it leads to a data breach or other compliance violation;
  2. The device-management limitations and liability-averse approach of the traditional MSSP model. MDR typically provides 24/7 monitoring by security experts who use a combination of automated detection and mitigation, with human investigation of attacks that can evade technology-only defenses. Once detected, a human security analyst takes measures to halt the attack, capture forensic evidence and prevent further exploitation. Quick detection is key to mitigation, and creates the ability to respond to threats and to report material breaches within the GDPR required timeframe, while limiting potential damage caused by the breach.

Next steps

How will you prepare for the GDPR? Have you considered what changes you’ll need to make to your current cybersecurity practices? We have a number of tools to help you. To start, check out our GDPR eBook for background on the GDPR, why it’s important and how it will affect you. Then use this workbook to create a gap analysis to identify what areas you need to focus on in the near-term as the GDPR approaches.

Further, consider your company’s need for a MDR provider. eSentire’s Managed Detection and Response is an all-encompassing cybersecurity service used to detect and respond to cyber-attacks. Using the best of signature, behavioral and anomaly detection capabilities, along with forensic investigation tools and threat intelligence, human analysts hunt, investigate and respond to known and unknown cyber threats in real time, 24x7x365. Let us help you meet the requirements of the GDPR.

eSentire
eSentire

eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire