Who needs a Data Protection Officer?

The Office of the Data Protection Commissioner Ireland, recently shared its advice on who needs a Data Protection Officer, their role, responsibilities and obligations...

The Data Protection Officer (DPO) role is an important GDPR innovation and a cornerstone of the GDPR’s accountability-based compliance framework. In addition to supporting an organisation’s compliance with the GDPR, DPOs will have an essential role in acting as intermediaries between relevant stakeholders (e.g. supervisory authorities, data subjects, and business units within an organisation).

The DPO will have professional standing, independence, expert knowledge of data protection and, to quote the GDPR, be ‘involved properly and in a timely manner’ in all issues relating to the protection of personal data.

The DPC (Data Protection Commissioner) recommends that all organizations who will be required by the GDPR to appoint a DPO should do this as soon as possible and well in advance of May 2018. With the authority to carry out their critical function, the Data Protection Officer will be of pivotal importance to an organization’s preparations for the GDPR and meeting the accountability obligations.

A DPO may be a member of staff at the appropriate level with the appropriate training, an external DPO, or one shared by a group of organizations, which are all options provided for in the GDPR.

It is important to note that DPOs are not personally responsible where an organisation does not comply with the GDPR. The GDPR makes it clear that it is the controller or the processor who is required to ensure and to be able to demonstrate that the processing is in accordance with the GDPR. Data protection compliance is ultimately the responsibility of the controller or the processor. 

Who needs a DPO?

1.    All public authorities and bodies, including government departments.

2.    Where the core activities of the organization (controller or processor) consist of data processing operations, which require regular and systematic monitoring of individuals on a large scale.

3.    Where the core activities of the organization consist of special categories of data (ie health data) or personal data relating to criminal convictions or offences.

Public Authority or Body?

Public authorities and bodies include national, regional and local authorities, but the concept typically also includes a range of other bodies governed by public law.

It is recommended, as a good practice, that private organisations carrying out public tasks or exercising public authority should designate a DPO.

Core activities can be defined as the key operations necessary to achieve an organization’s (controller or processor’s) goals. For example, a private security company which carries out surveillance of private shopping centres and/or public spaces using CCTV would be required to appoint a DPO as surveillance is a core activity of the company. On the other hand, it would not be mandatory to appoint a DPO where an organization undertakes activities such as payroll and IT support as, while these involve the processing of personal data, they are considered ancillary rather than core activities. 

Large-scale processing

  ü  While the GDPR does not define large-scale the following factors should be taken into consideration.

  ü  The number of individuals (data subjects) concerned – either as a specific number or as a proportion of the relevant population.

     ü  The volume of data and/or the range of different data items being processed

  ü  The duration, or permanence, of the data processing activity.

  ü  The geographical extent of the processing activity.

Examples of large-scale processing include:

ü  Processing of patient data in the regular course of business by a hospital processing of travel data of individuals using a city’s public transport system (e.g.  tracking via travel cards).

  ü  Processing of real time Geo-location data of customers of an international fast  food chain for statistical purposes by a processor specialized in providing these services processing of customer data in the regular course of business by an insurance company or a bank.

Examples that do not constitute large-scale processing include:

1.        processing of patient data by an individual doctor
2.        processing of personal data relating to criminal convictions and offences by        an Individual lawyer. 

Regular and systematic monitoring

Regular and systematic monitoring should be interpreted, in particular, as including all forms of tracking and profiling on the internet, including for behavioral advertising. However, the definition of monitoring is not restricted to the online environment. Online tracking is just one example of monitoring the behaviour of individuals.

‘Regular’ is interpreted by the Working Party 29 (comprising the EU’s data protection authorities) as meaning one or more of the following:

Ongoing or occurring at particular intervals for a particular period.

Recurring or repeated at fixed times.

Systematic’ is interpreted as meaning one or more of the following:

            Occurring according to a system

            Pre-arranged, organised or methodical

            Taking place as part of a general plan for data collection

            Carried out as part of a strategy.

Special Categories of Data – these include personal data revealing; racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation or personal data relating to criminal convictions and offences.

If you would like help with your Data Protection compliance we're here to help.

Just Contact Us 

Best Regards ,

Web Admin

LATVIK SECURE

LATVIK TECHNOLOGIES ™

www.latvikhost.com | https://latviksecure.blogspot.com 

Behind Bars : Russian Cybersecurity Chief Sentenced to 22 Years in Prision

A Russian court has handed down lengthy prison terms for two men convicted on treason charges for allegedly sharing information about Russian cybercriminals with U.S. law enforcement officials. The men — a former Russian cyber intelligence official and an executive at Russian security firm Kaspersky Lab — were reportedly prosecuted for their part in an investigation into Pavel Vrublevsky, a convicted cybercriminal who ran one of the world’s biggest spam networks and was a major focus of my 2014 book, Spam Nation.

Sergei Mikhailov, formerly deputy chief of Russia’s top anti-cybercrime unit, was sentenced today to 22 years in prison. The court also levied a 14-year sentence against Ruslan Stoyanov, a senior employee at Kaspersky Lab. Both men maintained their innocence throughout the trial. Following their dramatic arrests in 2016, many news media outlets reported that the men were suspected of having tipped off American intelligence officials about those responsible for Russian hacking activities tied to the 2016 U.S. presidential election.

That’s because two others arrested for treason at the same time — Mikhailov subordinates Georgi Fomchenkov and Dmitry Dokuchaev — were reported by Russian media to have helped the FBI investigate Russian servers linked to the 2016 hacking of the Democratic National Committee. The case against Fomchenkov and Dokuchaev has not yet gone to trial.

What exactly was revealed during the trial of Mikhailov and Stoyanov is not clear, as the details surrounding it were classified. But according to information, the most likely explanation for their prosecution stemmed from a long-running grudge held by Pavel Vrublevsky, a Russian businessman who ran a payment firm called ChronoPay and for years paid most of the world’s top spammers and virus writers to pump malware and hundreds of billions of junk emails into U.S. inboxes.

In 2013, Vrublevsky was convicted of hiring his most-trusted spammer and malware writer to launch a crippling distributed denial-of-service (DDoS) attack against one of his company’s chief competitors.

Prior to Vrublevsky’s conviction, massive amounts of files and emails were taken from Vrublevsky’s company and shared with this author. Those included spreadsheets chock full of bank account details tied to some of the world’s most active cybercriminals, and to a vast network of shell corporations created by Vrublevsky and his co-workers to help launder the proceeds from their various online pharmacy, spam and fake antivirus operations.

In a telephone interview with this author in 2011, Vrublevsky said he was convinced that Mikhailov was taking information gathered by Russian government cybercrime investigators and feeding it to U.S. law enforcement and intelligence agencies. Vrublevsky told me then that if ever he could prove for certain Mikhailov was involved in leaking incriminating data on ChronoPay, he would have someone “tear him a new asshole.”

An email that Vrublevsky wrote to a ChronoPay employee in 2010 eerily presages the arrests of Mikhailov and Stoyanov, voicing Vrublevsky’s suspicion that the two were closely involved in leaking ChronoPay emails and documents that were seized by Mikhailov’s own division. A copy of that email is shown in Russian in the screen shot below.

Best Regards ,

Web Admin

LATVIK SECURE

LATVIK TECHNOLOGIES ™

www.latvikhost.com | https://latviksecure.blogspot.com 

India 3rd most Vulnerable country to CYBER THREATS

The U.S. remains most vulnerable to such attacks, followed by China, according to the recently released ‘Internet Security Threat Report’.

India emerged as the third most vulnerable country in terms of risk of cyber threats, such as malware, spam and ransomware, in 2017, moving up one place over previous year, according to a report by security solutions provider Symantec.

In 2017, 5.09% of global threats detected were in India, slightly less than 5.11% in 2016. The U.S. (26.61%) was most vulnerable to such attacks, followed by China (10.95%), according to ‘Internet Security Threat Report’.

The global threat ranking is based on eight metrics — malware, spam, phishing, bots, network attacks, web attacks, ransomware and cryptominers.

As per the report, India continues to be second most impacted by spam and bots, third most impacted by network attacks, and fourth most impacted by ransomware.

The report also pointed out that with the threat landscape becoming more diverse, attackers are working harder to discover new avenues of attack and cover their tracks while doing so.

In 2017, 5.09% of global threats detected were in India, slightly less than 5.11% in 2016. The U.S. (26.61%) was most vulnerable to such attacks, followed by China (10.95%), according to ‘Internet Security Threat Report’.

The global threat ranking is based on eight metrics — malware, spam, phishing, bots, network attacks, web attacks, ransomware and cryptominers.

As per the report, India continues to be second most impacted by spam and bots, third most impacted by network attacks, and fourth most impacted by ransomware.

The report also pointed out that with the threat landscape becoming more diverse, attackers are working harder to discover new avenues of attack and cover their tracks while doing so.

“From the sudden spread of WannaCry and Petya/NotPetya, to the swift growth in coinminers, 2017 provided us with another reminder that digital security threats can come from new and unexpected sources,” it said.

Cyber criminals, it said, are rapidly adding “cryptojacking” to their arsenal as the ransomware market becomes overpriced and overcrowded.

Real threat

“Cryptojacking is a rising threat to cyber and personal security,” Tarun Kaura, Director, Enterprise Security Product Management, Asia Pacific and Japan, at Symantec said, adding that, “The massive profit incentive puts people, devices and organisations at risk of unauthorised coinminers siphoning resources from their systems, further motivating criminals to infiltrate everything from home PCs to giant data centers.”

“This coin mining gold rush resulted in an 8,500% increase in detections of coinminers on endpoint computers during the final quarter of 2017.”

While the immediate impact of coin mining is typically performance related — slowing down devices, overheating batteries and in some cases, rendering devices unusable— there are broader implications, particularly for organisations. “Corporate networks are at risk of shutdown from coinminers aggressively propagated across their environment. There may also be financial implications for organisations who get billed for cloud CPU usage by coinminers,” Symantec said.

Source : The Hindu 

Written by : Yuthika Bhargava on April 5 2019

Article Source : https://www.thehindu.com/news/national/india-third-most-vulnerable-country-to-cyber-threats/article23437238.ece

      This article was so informative that we copied it  for information purpose for our audience.

Best Regards ,

Web Admin

LATVIK SECURE

LATVIK TECHNOLOGIES ™

www.latvikhost.com | https://latviksecure.blogspot.com 

Bridge the cyber security knowledge gap with an on-demand virtual Chief Information Security Officer (CISO)

Having someone in charge of your security is vital to your company in the Information Age. But if your business is just getting on its feet, hiring someone full-time with executive-level pay can be challenging, if not impossible.

This is where a Virtual (C)ISO can come in handy. You hire them for a set number of hours a week and they perform the (C)ISO job remotely. Depending on the size of your business, you can scale the hours required while ensuring that your company’s data security is in good hands.

What is a Virtual (C)ISO?

Many companies assign security duties to on-site personnel as a secondary part of their job. The problem is that it is not their area of expertise – and this leads to information security taking a backseat to other tasks.

This isn’t good – and every day, more companies are beginning to realize how dangerous attacks that can cripple productivity and profits. But bringing a new person on board, full-time, can be daunting if not impossible, depending on the size of your company.

(C)ISO stands for Chief Information Security Officer. And the good news is that with a Virtual (C)ISO, the duties of a (C)ISO can be performed off-site on a part-time basis. This means that for a budget-conscious company, a Virtual (C)ISO can be a godsend.

It frees up the time of your staff to do what they are good at – 

while maintaining the highest levels of information security.it can be to put inexperienced management into information security positions, can lead to data breaches, sensitive or confidential information being disclosed, and malware.

How does a Virtual (C)ISO work?

A Virtual (C)ISO works like any other employee – except you don’t have them on site, don’t pay them full-time, and don’t offer them benefits.

They perform their duties on a contr

act basis. You can bring in a Virtual (C)ISO for a specific project or purchase a set number of hours and use them when you need them.

They can advise on any number of issues, including:

ü  Whether your best practices meet current regulations

ü  Any issues in your security protocol that need updating

ü  If there is a risk inside your organization from personnel

ü  Cross-compliance issues – not all nations share the same data protection laws

ü  Protecting your data

ü  Planning for a data breach – because time is essential when you are compromise

Should I hire a Virtual (C)ISO for my company?

Data security should be a priority for any company. You shouldn’t pray that breaches don’t happen or rely on an untrained worker to be up-to-date on security issues.If you can’t afford to hire a full time Information Security Officer, then you need to have a Virtual (C)ISO at your disposal. 

By selecting a Virtual CISO from Latvik Secure to help mitigate your organisation’s cyber security risk, benefit from an independent expert familiar with the challenges of managing information security across industries.

Latvik Secure can provide your company a Virtual (C)ISO that will work with your schedule and budgetary needs. We have packages available for organisations from very small to large enterprises. 

Don't hesitate just  Contact Us 

Best Regards ,

Web Admin

LATVIK SECURE

LATVIK TECHNOLOGIES ™

www.latvikhost.com | https://latviksecure.blogspot.com