{"id":1302,"date":"2018-02-20T10:34:21","date_gmt":"2018-02-20T14:34:21","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=1302"},"modified":"2018-02-23T11:31:00","modified_gmt":"2018-02-23T15:31:00","slug":"5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/","title":{"rendered":"5 Questions about GDPR with Steven Grossman of Bay Dynamics"},"content":{"rendered":"

\"GDPR<\/p>\n

At time of writing, only 93 days remain before the European Union\u2019s (EU) General Data Protection Regulation (GDPR) goes into effect on May 25. GDPR will strictly regulate the way enterprises can store and process the personal information of EU citizens, and applies even to companies outside the EU. The <\/span>consequences<\/span><\/a> of violating the law are incredibly severe, yet many enterprises in the U.S. seem unprepared to comply with the full extent of GDPR. Passive breaches especially may prove the most devastating and overlooked aspect of GDPR compliance.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

But what are passive breaches? And where are companies failing at GDPR preparations most? We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor <\/span>Bay Dynamics<\/span><\/a>, 5 questions about GDPR compliance and passive breaches. Here\u2019s our conversation, edited slightly for readability: <\/span><\/p>\n

1. Where do you think enterprises are at most risk for GDPR compliance violations? What are corporations overlooking that could end up hurting them?<\/b><\/h3>\n

There are many layers to preparing for, and complying with, the GDPR. If you divide the world into people, process and technology, changes to people and process are always more challenging to implement. The right people and process are also a requirement to successfully implement technological change. <\/span><\/p>\n

In the context of GDPR, that means a collaboration between the security, privacy, compliance, legal and technology stacks to ensure they understand the regulation, know where covered data resides in the organization, what business processes touch that data and what controls are in place to protect it. I think this very fundamental first step is where many companies continue to be challenged. Keep in mind personal information is not residing just in human resources and order processing systems. It\u2019s in corporate email, on file shares and Access databases created by someone who couldn\u2019t get IT to respond fast enough, on the cloud and in all sorts of places. How many people know where their cloud provider\u2019s data centers are geographically located? \u00a0<\/span><\/p>\n

So there is the historical challenge of finding all this data and locking it down or destroying it. \u00a0That\u2019s the easy part. Moving forward, the business needs to make sure that they are providing their employees and third parties with an easy button for working securely. You don\u2019t want to leave one of your employees having to make the choice between getting their job done or violating the GDPR. Either choice can end badly for the enterprise, impacting the bottom line in the form of lower profitability or regulatory fines. In line with the people and process changes, the right technical controls need to be put in place as well, to ensure that data is not accidentally or intentionally exposed.<\/span><\/p>\n

Data protection is not a new concept, but the potential fines give the GDPR teeth and have led companies to reexamine their posture. That is why you\u2019re seeing a resurgence of technologies like data loss prevention (DLP), CASB and user and entity behavior analytics (<\/span>UEBA<\/span><\/a>). <\/span><\/p>\n

2. Why do you think enterprises aren\u2019t preparing for GDPR? Where is the disconnect?<\/b><\/h3>\n

I don\u2019t think you have many large enterprises that are not scrambling right now to prepare. \u00a0They are likely behind the proverbial eight ball, but the alarm has gone off. \u00a0I think those that may be asleep at the wheel when it comes to GDPR are non-EU based mid-sized and smaller companies that think that because they are not located in the EU, it doesn\u2019t apply to them. \u00a0It applies to anybody storing or processing personal data on EU citizens. What\u2019s worse is that it is particularly dangerous for these smaller companies that often have less structured controls in place and have less resources to prepare and comply with the GDPR.<\/span><\/p>\n

3. There has been some talk about inadvertent or passive breaches being the major downfall of enterprises in the GDPR era. How would you define these kinds of breaches, and how should enterprises prepare for them?<\/b><\/h3>\n

Inadvertent or passive breaches are usually referring to non-malicious actions by a human being that leads to a loss of data, introduction of a bad actor, or malware.<\/span> They have been a significant problem since the beginning of time. Inadvertent breaches are not just the downfall of the GDPR era. It is often said that humans are the weakest link in security, but that is only part of the story. It is also about culture, training, business processes and controls.<\/span><\/p>\n

First, from a culture perspective, employees and third parties need to understand the importance of handling data securely and the ramifications to their employer (and therefore their job) if mishandled. These ramifications now become even more significant with GDPR. To elevate security in the eyes of employees and third parties, you are now seeing security as a performance factor in employee evaluations and third-party contracts. Everybody recognizes the importance of security training and secure business processes, but unfortunately, they usually get pushed to the bottom of the priority list, in lieu of more active risks. <\/span><\/p>\n

The best approach I\u2019ve seen has been to automate and distribute as much as possible. \u00a0Behavioral analytics, used in a GDPR compliant manner, can help you identify non-malicious, risky handling of sensitive data that allows for more targeted training at \u201cteachable moments\u201d that are far more effective than the spray and pray four hour training used to check the box on compliance requirements. Similarly, behavioral analytics can be used to identify when a business group is violating security policies in a consistent way that helps identifies broken business processes, allowing for targeted change efforts. <\/span><\/p>\n

Like active malicious threats, dealing with inadvertent or passive breaches requires an ongoing effort. It\u2019s not a one and done process, where you put something in place and move on.<\/span><\/p>\n

4. Do you have any suggestions on the best way to train employees in cybersecurity? What areas should companies focus on in their training for GDPR compliance?<\/b><\/h3>\n

As mentioned earlier, it requires ongoing training and reinforcement. The industry can learn from factories a century ago, where worker safety was a serious concern. Significant effort was expended across the people, process, and technology spectrum to greatly reduce the exposure of factory workers to dangerous conditions. It of course has not eliminated injuries, but has made safety a cultural mandate. Factories have signs everywhere about being safe and it is a high priority issue in the back of everybody\u2019s mind. A lot of that effort was driven by government regulation and the creation of OSHA. Similarly, we are reaching a pivoting point, much of which is being driven by industry and government regulation, where cyber security is becoming a prominent issue for the business. This will change how everybody thinks of the problem and lead to positive changes.<\/span><\/p>\n

5. What should enterprises do to prepare for GDPR compliance overall? <\/b><\/h3>\n

There is obviously a lot to do. \u00a0Enterprises should start by identifying their in-scope data, where it resides, where it moves, who accesses it and how they access it. They should classify, monitor, and limit access to the data to limit its exposure (DLP is key here). Third party experts can be of significant value in getting the job done. <\/span><\/p>\n

GDPR is a significant regulation with many dimensions. Internal resources have a day job, and most simply don\u2019t have the bandwidth to make the required changes in the short time frame remaining. It is up to internal resources to drive the right sponsorship, provide the institutional knowledge and work with third parties to achieve changes in people, process and technology that achieve compliance in a way compatible with their business needs.<\/span><\/p>\n

Thanks again to Steven Grossman of Bay Dynamics for his time and expertise!<\/b><\/h4>\n


Widget not in any sidebars
<\/p>\n","protected":false},"excerpt":{"rendered":"

At time of writing, only 93 days remain before the European Union\u2019s (EU) General Data Protection Regulation (GDPR) goes into effect on May 25. GDPR will strictly regulate the way enterprises can store and process the personal information of EU citizens, and applies even to companies outside the EU. The consequences of violating the law […]<\/p>\n","protected":false},"author":41,"featured_media":1227,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[56,95,239,549,21,57],"acf":[],"yoast_head":"\n5 Questions about GDPR with Steven Grossman of Bay Dynamics<\/title>\n<meta name=\"description\" content=\"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"5 Questions about GDPR with Steven Grossman of Bay Dynamics\" \/>\n<meta property=\"og:description\" content=\"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2018-02-20T14:34:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-02-23T15:31:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/\",\"name\":\"5 Questions about GDPR with Steven Grossman of Bay Dynamics\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg\",\"datePublished\":\"2018-02-20T14:34:21+00:00\",\"dateModified\":\"2018-02-23T15:31:00+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg\",\"width\":800,\"height\":400,\"caption\":\"gdpr compliance passive breaches Steven Grossman\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"5 Questions about GDPR with Steven Grossman of Bay Dynamics\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"5 Questions about GDPR with Steven Grossman of Bay Dynamics","description":"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/","og_locale":"en_US","og_type":"article","og_title":"5 Questions about GDPR with Steven Grossman of Bay Dynamics","og_description":"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2018-02-20T14:34:21+00:00","article_modified_time":"2018-02-23T15:31:00+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/","name":"5 Questions about GDPR with Steven Grossman of Bay Dynamics","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg","datePublished":"2018-02-20T14:34:21+00:00","dateModified":"2018-02-23T15:31:00+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"We asked Steven Grossman, VP of Strategy of Strategy at cyber risk analytics vendor Bay Dynamics, 5 questions about GDPR compliance and passive breaches.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/01\/GDPR-mod.jpg","width":800,"height":400,"caption":"gdpr compliance passive breaches Steven Grossman"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/5-questions-about-gdpr-with-steven-grossman-of-bay-dynamics\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"5 Questions about GDPR with Steven Grossman of Bay Dynamics"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1302"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=1302"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1302\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/1227"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=1302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=1302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=1302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}