6 tricky obstacles security teams face in GDPR compliance

The European Union’s General Data Protection Regulation (GDPR) takes effect May 25 and the penalties are stiff for failing to comply. Many are still unsure whether their companies are safely out of harm’s way. The regulation is long and full of terrors, to be sure. However, resistance is futile.

“Many organizations are saying that they will simply refuse traffic from EU countries, and think that will dispense with the need to comply with GDPR,” said Anne P. Mitchell, attorney, GDPR compliance consultant, and author of Section 6 of the CAN-SPAM Act of 2003 (the Federal anti-spam law). She’s also legislative consultant and CEO/president of the Institute for Social Internet Public Policy (ISIPP), formerly known as The Institute for Spam and Internet Public Policy, among many other positions and achievements in internet law and policy issues, from both the legal and the technical sides.

“However, beyond the fact that there is simply no real way to know—because of VPNs, tethering and so forth—it is a violation of GDPR to do any sort of automated profiling of data, including to determine location,” she added. “So, the very act of detecting and geolocating an incoming IP address—unless done manually for every single IP address— is itself a violation of GDPR.”

Since there is no escape from GDPR, here are six of the trickiest obstacles security teams will have to overcome:

Cookies, IP addresses and other data points that enable someone to deduce a person’s identity are now considered personal identifying data, too. This is problematic on several fronts, since a lot of these types of data are routinely and automatically collected and because companies typically are not aware of what data they are collecting and storing. Therefore, most companies are unable to identify every instance.

“For the most part, companies already treat the standard bits of personally identifying data, such as date of birth, SSN, etc., securely, and even if it is not up to snuff for GDPR, it’s not always that difficult to get there,” said Mitchell.

“But IP addresses, for example, are a whole other ballgame because network systems take note of incoming IP addresses in a host of different ways—some of which the IT and security teams may not even think about. For example, when a sending mail server connects to your receiving mail server, your server makes note of the sending IP address. If it is storing that IP address —which, of course, it is in mail logs—that data is subject to GDPR. Likewise, the recording and storage of IP address in the email headers in received email, which are in the mail clients of the employees, etc., at the organization. And of course, the email addresses as well.”

A privacy audit and risk assessment are in your future, if you haven’t done it already. Several experts are recommending the use of OCTAVE Allegro methodology for that.

“Unlike some risk assessment methodologies that deal with the security of a particular system, OCTAVE deals with data assets, what they are, who has access, where they are stored, and what threats they are exposed to,” said Tom DeSot, EVP and CIO of Digital Defense.

“As an example, when looking at GDRP and personal information, you would want to look at the common components of the data, say ID number, and then look to see how the ID number is being collected and stored, who inside and outside the company has access to the captured information, and what threats such as a hacking breach or insider action may place the data at risk,” DeSot added. “Once you’ve done this you can begin putting mitigating controls in place.