In the context where the digital transformation of the healthcare sector is accelerating, the protection of health data is an increasingly critical issue. In 2021, our article “Health Data Host Certification: Two Years Already!” by Laurent Guille and Alexandra Cuillerdier, provided a promising initial assessment of the HDS framework. Faced with growing concerns related to data sovereignty and cybersecurity, a redesign was necessary. This evolution towards HDS v2, which came into effect in 2024, marks a turning point in the approach to health data hosting in France, strengthening the protection and sovereignty of health data in an ever-evolving digital context. 

HDS v1: a first structuring but perfectible framework 

Since its introduction in 2018, the HDS framework has helped structure and professionalize the health data hosting sector. However, this first version of the framework had certain limitations. In particular, the initial framework presented gray areas regarding data sovereignty, especially concerning the location and control of health data. Additionally, the rapid evolution of cyber threats and technologies required a substantial update of security requirements to maintain a level of protection adapted to current risks. 

Overhaul of the Technical and Security Framework 

On the technical side, the new requirements of the ISO 27001:2023 standard are adopted within the new version of HDS. This update integrates security risk management adapted to new digital contexts, as well as new controls related to cybersecurity. The other normative references are rationalized. References to ISO 20000-1, ISO27017, and ISO27018 standards disappear in the HDS v2 framework, while 31 specific requirements are directly integrated into the framework, which also relies on the ISO/IEC-17021-1:2015 standard to govern conformity assessment. This new version also clarifies the articulation with the requirements of the SecNumCloud framework to facilitate obtaining HDS certification for hosts already qualified with SecNumCloud. 

A Major Strengthening of Digital Sovereignty 

One of the most significant developments in HDS v2 concerns the strengthening of digital sovereignty. The new framework now requires that the physical hosting of health data be carried out exclusively within the territory of the European Economic Area (EEA). This requirement reinforces guarantees in terms of data protection and contributes to the emergence of an ecosystem of European players in the field of digital health. 

This is complemented by enhanced transparency, which also becomes a central issue of the framework, with two major obligations: 

• Hosts must now publish on their website a map of any data transfers to countries outside the EEA, thus allowing data subjects and healthcare actors to have clear visibility on the journey of their data; 

• In the case of remote access to data from a third country or submission to non-European legislation that does not ensure an adequate level of protection within the meaning of Article 45 of the GDPR, the host must inform its clients in the contract. In particular, it must specify the associated risks and detail the technical and legal measures implemented to limit them. 

Strengthening of Contractual Requirements 

Subcontracting supervision receives particular attention in HDS v2. The associated measures are reinforced, and hosts must now: 

• Precisely detail the certified hosting activities in their contracts; 

• Maintain complete transparency regarding their subcontracting chain; 

• Ensure that their subcontractors comply with the same requirements for data security and location; 

• Implement mechanisms to control and audit their subcontractors. 

These new contractual obligations aim to ensure better control of the value chain and greater transparency for data controllers. 

Practical Consequences for the Ecosystem 

For health data hosts, these evolutions of the framework imply an adaptation of their infrastructures to guarantee the location of data within the EEA. They also require an upgrade of their security measures to meet the requirements of the 2023 version of the ISO 27001 standard and the review of contracts, both with their clients and with their subcontractors. 

Perspectives and Implementation 

This new modernized version of the HDS framework addresses the growing challenges of security, sovereignty, and transparency. Its implementation is spread over approximately two years, with immediate application for new certifications from November 16, 2024, and a transition period until May 16, 2026, for hosts already certified under HDS v1. 

In the longer term, several questions arise regarding the evolution of the framework. At a time when the NIS 2 directive already includes healthcare providers and the pharmaceutical industry among its essential sectors of activity, while classifying the manufacturing of medical devices and in vitro diagnostics in its important sectors, the emergence of HDS 2 raises a question: could European cooperation lead to an even more integrated framework for health data protection and harmonize practices across the continent? 

Cet article Evolution of the HDS Framework – Towards Enhanced Security and Sovereignty  est apparu en premier sur RiskInsight.

Today, as governments actively craft AI guidance and legislation, policymakers face the challenge of delicately balancing the need to foster innovation and ensuring accountability. A regulatory framework that prioritizes innovation but relies too heavily on the private sector’s self-governance could lead to a lack of oversight and accountability. Conversely, while robust safeguards are essential to mitigate potential risks, an overly restrictive approach may stifle technological progress.
This whitepaper will explore the approaches proposed by the governments of the United States and the United Kingdom as they pertain to AI governance across both the public and private sectors.

American Approach to AI Regulation

In October of 2023, the White House published the AI Executive Order. The order specifies key near-term priorities of introducing reporting requirements for AI developers exceeding computing thresholds, launching research initiatives, developing frameworks for responsible AI use, and establishing AI governance within the federal government. Longer-term efforts focus on international cooperation, global standards, and AI safety.
On the side of ensuring accountability, the order calls for the Secretary of Commerce to enforce reporting provisions for companies developing dual-use AI foundation models, organizations acquiring large-scale computing clusters, and Infrastructure as a Service providers enabling foreign entities to conduct certain AI model training. While these criteria will likely exempt most small to medium sized AI companies from immediate regulations, large industry players like Open AI, Anthropic, and Meta could be affected if they surpass the computing threshold established by the order.
On the other side of fostering innovation, further sections of the order reaffirm the US government’s aim to promote AI innovation and competition – supporting R&D initiatives and public-private partnerships, provisioning streamlined visa processes to attract AI talent to the US, prioritizing AI-oriented recruitment within the federal government, clarifying IP issues related to AI, and preventing unlawful collusion.
Overall, the nature of the documents published by the US is mostly non-binding, indicating a strategy of encouraging the private sector to self-regulate and align to common AI best practices. In this approach, the White House has been persistent in its messaging that it is committed to nurturing innovation, research, and leadership in the domain, while also balancing with the need for a secure and responsible AI ecosystem.

The British Approach to AI Regulation

The Bletchley Declaration, agreed upon during the AI Safety Summit 2023 held at Bletchley Park, Buckinghamshire, marks a pioneering international effort towards ensuring the safe and responsible development of AI technologies. This declaration represents a commitment from 29 governments to collaborate on developing AI in a manner that is human-centric, trustworthy, and responsible, with the UK, US, China, and major European member states among the notable signatories. The focus is on “frontier AI,” which refers to highly capable, general-purpose AI models that could pose significant risks, particularly in areas such as cybersecurity and biotechnology.
The declaration emphasizes the need for governments to take proactive measures to ensure the safe development of AI, acknowledging the technology’s pervasive deployment across various facets of daily life including housing, employment, education, and healthcare. It calls for the development of risk-based policies, appropriate evaluation metrics, tools for safety testing, and building relevant public sector capability and scientific research.
In addition to the declaration, a policy paper on AI ‘Safety Testing’ was also signed by ten countries, including the UK and the US, as well as major technology companies. This policy paper outlines a broad framework for testing next-generation AI models by government agencies, promoting international cooperation, and enabling government agencies to develop their own approaches to AI safety regulation.
The key takeaways from the Bletchley Declaration include a clear signal from governments regarding the urgency to address the development of safe AI. However, how these commitments will translate into specific policy proposals and the role of the newly announced AI Safety Institute (AISI) in the UK’s regulatory landscape remain to be seen. The AISI’s mission is to minimize surprise from rapid and unexpected advances in AI, focusing on testing and evaluation of advanced AI systems, foundational AI safety research, and facilitating information exchange.

As they seek to establish themselves as AI leaders in the global community and set the direction for effective policymaking, both the US and the UK are navigating the balance between promoting AI innovation and ensuring ethical governance. While most of the current focus is on proposing guidelines and frameworks for the safe and responsible use of AI, the reference to potential future regulations across both documents should serve as a wake-up call for companies to start aligning their practices with the principles and recommendations outlined.
To stay ahead of the curve, organizations should develop robust methodologies to monitor AI risks effectively. This involves adapting their AI strategy to prioritize risk mitigation, identifying potential harms that may arise from the deployment of AI systems, and preparing for forthcoming regulatory measures by implementing a secure and comprehensive risk management program.
However, the US and UK opportunist approach to AI legislation is not followed by all. China chose a targeted and evolutive approach by writing a law on Generative AI that came into effect in 2023. Finally, in Europe, the AI Act shows that the EU doesn’t want to let AI technologies go out of hand.

Cet article US Executive Order & Betchley Declaration est apparu en premier sur RiskInsight.

A denser and more complex cybersecurity regulatory landscape

The first attempts to regulate personal data protection and cybersecurity remained partial until the early 2000s, being driven mainly by the United States and the European Union.  Initially, they focused on the protection of personal data, in France with the Loi Informatique et Libertés (1978) and in the United States with sector-specific regulations: the Privacy Act (1974) for the public sector, the Health Insurance Portability and Accountability Act for the healthcare sector (1996) and the Gramm-Leach-Bliley Act (1999) for the financial sector.

The first cybersecurity regulations were introduced in the financial sector in the early 2000s, with the aim of improving the security of the services provided. Notable regulations include the Sarbanes-Oxley Act (2002), in the USA, reinforcing corporate transparency in terms of internal control, and the Payment Services Directive (2007) in the European Union, regulating the security of online payments and transactions.

Since the early 2010s, more structuring regulations have emerged to form an initial cyber regulatory base in the same regions. These regulations are mainly focused on critical infrastructure protection, with France’s Loi de Programmation Militaire de 2013-2018 (2013), the USA’s National Cyber Security and Critical Infrastructure Protection Act (2014), but also the Network and Information Security 1 Directive (2016) enacted by the European Union.

It wasn’t until the late 2010s that the desire to regulate the cyber space became more global. As many countries followed in the footsteps of the United States and the European Union, stricter cyber regulations began to emerge, with far-reaching impacts on information systems. This can be seen in the arrival of major personal data protection regulations around the world: the General Data Protection Regulation (GDPR, 2018) in Europe, the California Consumer Privacy Act (CCPA, 2020) in California, the Personal Data Protection Law (PDPL, 2020) in Brazil, the Personal Information Protection Law (PIPL, 2021) in China, or the Personal Data Law (2022) in Russia.

Other regulations aimed at protecting information systems are multiplying, with the Cybersecurity Law in China (2017), the NYCRR 500 Cybersecurity Regulations for the State of New York (2017), or the new iteration of the NIS Directive (2023) and DORA in Europe.

Evolution of cybersecurity regulatory landscape[2]

Added to this complex cybersecurity regulatory landscape is a vast ecosystem of cybersecurity requirements and standards, with different levels of constraint: regulatory requirements stemming from cyber or other regulations, mandatory requirements, recommendations or even requirements with contractual value. In this context, it is essential to identify all applicable requirements and the level of constraint they impose.

Types of cybersecurity requirements and standards, beyond cyber regulations

A cybersecurity regulatory compliance strategy adapted to the new paradigm

With the global cybersecurity regulatory landscape becoming increasingly complex, compliance cannot be thought of solely as total compliance with all applicable regulatory requirements. Faced with detailed, costly and sometimes contradictory requirements, it is becoming necessary to implement risk-based cyber compliance strategies. The definition of these strategies will be based on a study of the existing level of regulatory compliance, an assessment of the effort and complexity of the measures required to comply with each regulation, and a consideration of the risks associated with potential non-compliance, both in terms of sanctions and IS protection. This analysis, far from seeking to escape the law, aims to identify the benefit/risk of activities, and may lead to redirecting activities, limiting their scope, or acting in concert with the ecosystem to evolve requirements.

To implement such a strategy, it is first essential to identify all applicable regulations, and to set up a regulatory watch to keep alongside regulatory developments and related news. A two-tiered organisation must then be set up to manage cyber regulatory compliance.

A first level of overall management aimed at providing a high-level overview: a global analysis of the level of cyber compliance must be carried out. This can be based on a recognised cybersecurity standard such as NIST or ISO 27001 for security requirements. For requirements relating to the protection of personal data, GDPR is a good foundation, since most international regulations on this topic are derived from it. The NIST privacy and ISO privacy standards are also solid references in this field. These benchmarks can be mapped onto the main applicable regulations, and advantage can be taken of existing synergies between regulations, as illustrated by the two examples below.

To complete this analysis, an audit plan should be drawn up to assess compliance with key local regulations in greater detail.

A second level of “local” management, on a geographical or business line scale, aimed at ensuring local regulatory compliance in each of the regions where the Group is present. This requires first of all the implementation of a local watch to identify and know precisely the regulations and associated news. This is followed by a detailed analysis of the level of compliance with local regulations, the identification of specifics needed to ensure the right level of compliance, and the feedback of these elements to the Group to ensure the overall management of compliance actions.

Protection regulations call into question the need to separate information systems

Complying with a multitude of cybersecurity regulations is becoming a real challenge for companies with an international presence and centralised information systems. This is due to the stacking up of these regulations, sometimes with incompatible or contradictory provisions, but also to the emergence of requirements with far-reaching impacts on information systems.

This is the case, for example, with China’s PIPL regulations, and in particular Article 40, which stipulates that the transfer of data outside China will only be authorized if processing complies with the security assessment established by the Chinese authorities. This regulation will apply above a certain volume of personal data (not yet specified by the Chinese authorities).

Incompatibilities between regulations have also arisen between the United States and the European Union. This is illustrated by the invalidation of the U.S. Privacy Shield[3] by the European Court of Justice, its Schrems rulings calling into question the ability of U.S. Cloud hosts to process the personal data of their European customers in line with European requirements.

Against this backdrop of heightened cybersecurity and personal data protection requirements, emphasised by the protection intentions of certain countries, it may become necessary to study the need to separate globalised and centralised information systems by considering separation into several geographical zones, which could be:

• A zone comprising the USA and the UK
• A second zone centered on China
• A third zone made up of the European Union and GDPR-relevant[4]

Depending on their regulatory reality and potential developments, other countries or regions could be attached to one or other of these three zones.

In the future, the information systems of these different zones could rely more heavily on the sovereign clouds that are currently being developed.

Constraints that can even lead to the closure of a region’s operations

We’re even seeing a number of companies halting or postponing the launch of activities in certain countries where the regulatory constraints and associated risks of sanctions are too great in relation to the business challenges and strategy of the company. This is particularly the case in certain US states, and in Europe, where some major players are putting the brakes on their development because of the RGPD (e.g. Google’s open AI/ Bard, or Meta’s launch of Thread).

What’s next for 2023 and beyond?

The complex regulatory landscape will continue to expand in the months and years ahead. Both in new areas (AI, product security) and in existing areas, such as critical infrastructure.

On the “critical infrastructure” front, after the first phases of regulations focused on personal data protection, the authorities have been looking at critical infrastructure protection, which continues with the NIS2 directive in particular. Adopted on November 10, 2022 and soon to be implemented into French law, it aims to reduce disparities between member states, strengthen cybersecurity in a context of increasing digitalisation, and establish security measures to improve the level of security of critical infrastructures within EU member states.

A new phase is now taking shape, during which regulations will focus on the safety of digital products, with in particular:

• The AI Act, a European regulation aimed at defining a common frame of reference for the development and use of Artificial Intelligence (AI). Against a backdrop of lightning acceleration in the uses of AI, new regulations are also set to emerge around the world, and particularly in China, where measures have already been taken and led to the closure of 55 applications and 4,200 sites between January and March 2023[5].
• The Cyber Resilience Act (C.R.A), another European regulation, which aims to strengthen the security of digital products by imposing measures to be respected by manufacturers right from the product design stage. Not to mention the recent announcement by the White House of the “Cyber trust mark” initiative, which targets the same objective but with a different approach[6].

The regulatory stakes are not about to diminish, and cyber teams need to be prepared. At the very least, it will be necessary to strengthen links with the business lines concerned, as well as with legal teams. The most mature companies in this field have set up legal departments within their cyber teams, to exchange information with the various legal departments. This may not necessarily be necessary, depending on the organization of each structure, but it can also be a guarantee of strong mobilization.

In all cases, the challenge for companies will be to transform these often mandatory regulatory requirements into a competitive advantage for their business, not by punitive, minimal compliance, but rather by taking ownership of the subject and transforming these practices in a way that can be leveraged externally.

[1] https://blog.checkpoint.com/2023/01/05/38-increase-in-2022-global-cyberattacks/

[2] Non-exhaustive list of cybersecurity regulations

[3] https://www.cnil.fr/fr/invalidation-du-privacy-shield-les-suites-de-larret-de-la-cjue

[4] Countries complying with the level of protection required by the EU https://www.cnil.fr/fr/la-protection-des-donnees-dans-le-monde

[5] https://www.01net.com/actualites/comment-les-lois-chinoises-tres-strictes-risquent-de-nuire-a-lia-made-in-china.html  

[6] https://arstechnica.com/information-technology/2023/07/the-cyber-trust-mark-is-a-voluntary-iot-label-coming-in-2024-what-does-it-mean/

Cet article Cyber regulatory landscape: challenges and prospects est apparu en premier sur RiskInsight.

The NIS directive is the first initiative of EU-wide legislation on cybersecurity. Its goal is to ensure a high and common level of security for European information systems and networks. To achieve this objective the directive focuses on four key points:

• Consolidating the member states’ national cybersecurity capabilities
• Creating a political and organizational cooperation framework on cybersecurity across the EU,
• Ensuring the cybersecurity of operators of essential services (OES). OES are private or public entities providing essential services for the maintenance of economic and societal activities. The provision of these services depends on network and information systems.
• Ensuring the cybersecurity of digital service providers (DSP). DSPs are defined as “any service normally provided for remuneration, at a distance by electronic means and at the individual request of a recipient of services”[1]. Three types of services are mentioned in the NIS Directive: Cloud computing services, online marketplace and online search engines.

On the one hand, the security of operators of essential services is a sovereign prerogative of states while onn the other hand, the role of the EU is to ensure the proper functioning of the European market. In order to reconcile these two objectives, the NIS directive clearly states that: “This Directive should be without prejudice to the possibility for each Member State to take the necessary measures to ensure the protection of the essential interests of its security, to safeguard public policy and public security, and to allow for the investigation, detection and prosecution of criminal offences.”[2]. Each country can therefore adapt the legislative text to fit its priorities and strategic objectives as well as to guarantee its security and that of its networks and information systems. The NIS directive, however, sets common requirements in terms of; transposition of the directive into national legislation, of sectors concerned, of risk identification, of supervision, of implementation of technical and organisational measures, of cyber incident notification, and of sanctions in case of non-compliance.

This analysis brings together elements on the transposition of the NIS directive in each of the 27 member states of the European Union, as well as in the United-Kingdom and Switzerland. It highlights the various approaches and underlines the similarities and differences between countries, especially in the context of the upcoming evolution of the legislative text. Indeed, a proposal to revise the NIS directive has been adopted by the European Commission in December 2020 and aims at replacing the original text.

An achieved transposition for certain themes…

Different types and numbers of legislative texts to transpose the NIS

The transposition of the NIS occurred in all the national legislations of EU member states. However, there is heterogeneity in the type of legislative text adopted. In most countries, the transposition takes the form of a law (twenty-two countries), to which thirteen countries have added at least on other legislative text (ordinance, decree, regulation, amendment or ministerial decision). In two countries, the transposition took place in each sectoral law which increases the number of legislative texts (four texts or more).

A general implementation of cyber incident notification processes

All countries managed to implement cyber incident notification processes. Once again, there are various approaches depending on the country.

There are six different procedures for transmitting alerts during a cyber incident:

• In the first case (nine countries), the operator of essential services must first notify the competent national authority of the occurrence of a cyber incident,
• A second process (ten countries) exists in which the first point of contact is the CSIRT, the Computer Security Incident Response Team, also called CERT (Computer Emergency Response Team),
• In a lower number of cases (three countries), the OES must notify the competent sectoral authority,
• The notification of cyber incident is carried out via a secure platform in four countries.
• Even less frequently (two countries), the single point of contact (SPOC) has to be alerted.
• Finally, for one country (Hungary), the OES alerts an event management centre.

In addition, all member states must notify the point of contact of a member state, if it is also affected by the cyber incident, and must inform the public when necessary.

To comply with the constraints imposed by the NIS, certain states have even gone further

The NIS directive initially applies to the following sectors: transport, energy, health, drinking water, banking, finance, and digital. In the transposition, more than half of the analysed countries added other essential sectors and sub-sectors in addition to the seven previously mentioned. They are listed below, sorted by frequency of occurrence :

• Austria, Croatia, Cyprus, Lithuania, Malta, Slovakia, Spain and Switzerland also mention public administration,
• Cyprus, Estonia, Germany, Lithuania, the Netherlands, Slovakia, Spain and Switzerland add information and communication technologies and IT.
• Estonia, France, Germany, Hungary, Lithuania, Slovenia, Spain, Switzerland add
• The Czech Republic, Lithuania, the Netherlands, Spain complete the list with industry.
• Estonia, Germany and Switzerland also mention heating and housing.
• Lithuania and Slovakia subjoin defence, Switzerland national security.
• Lithuania and Slovenia add the protection of the environment.
• France is the only one to add education.
• Spain is the only one to mention space and research centres.

… However, the variation needs to be finalized on other themes.

Strong disparities on state supervision

Several categories and different levels of control are exercised by authorities to certify compliance with the NIS. The strong disparities concern in particular the authorities ensuring the control (national or sectoral authority) as well as the expected level of control (supervision, inspection, audit, evaluation…): there is no consensus around the process to adopt. Moreover, six countries do not provide any information on the type of supervision implemented.

Heterogeneous level and diffusion of security measures

Except for six countries for which no information has been given on the type of security measures implemented, there are two main approaches:

• The security measures are directly mentioned in the body of the legislative text(s) transposing the NIS (eleven countries),
• They are enumerated in; a guide, a list of recommendations, an online publication and established by different entities (government, regulation, decree…) in twelve countries.

For the measures included in the body of the legislative text(s), there are similarities on their organisation:

• The international norm ISO27001 and the cybersecurity framework NIST are used as models to establish the security measures in respectively four and two countries.
• The same six categories (security of systems and installations, handling of incidents, business continuity management…) are used in four countries.

Different amount and format of penalties

The financial penalty for not complying with the directive varies in the different countries and can range from less than a 100k€ to 20M€ maximum (except for Finland which has not implemented any sanctions). Most countries have chosen to apply a fine of less than 200k€ (eighteen countries) whereas four countries have decided that the maximum should be beyond 1M€. It should also be noted that the sanctions are likely to accumulate in the event of multiple non-conformities, which does not make the overall maximum amount of a sanction a certainty.

Imprisonment sentences have been implemented in two countries (Belgium and Cyprus).

Finally, four countries have not yet communicated the penalties in case of non-compliance.

Conclusion

The goal of the NIS directive was to address the unequal levels of security of networks and information systems within the European Union. To achieve it, it has now been transposed in all the member states. This has led to the creation of a common security framework while also leaving the possibility for states to ensure their security and the protection of their essential and strategic interests. Indeed, each country designates its operators of essential services and chooses the sectors it deems the most strategic to protect. In addition, the transposition of the directive as well as the supervision and cyber incident notification processes are carried out by the authority deemed competent. This is non dependantwhether national or sectoral, whether it is the CSIRT or the single point of contact. This flexibility makes it possible for the NIS to adapt to the organisation of all member states. There are visible similarities creating groupings between the countries, as well as major dissimilarities. These leave room for many variations and make the comparison relevant and rich.

A proposal to revise the NIS directive  was adopted in December 2020, but its provisional calendar has not yet been communicated. However, its main objectives has  been listed and includes reaching a higher level of cybersecurity and more homogeneous processes within the EU, while further increasing the cooperation between member states. The revision of the NIS directive revolves around;

• the abandonment of the distinction between OES and DSPs
• the designation of OES by the Directive and not the states
• the creation of a new European network for major cyber incidents
• imposition of CSIRTs supportive of entities,
• the control by the states of the technical and organisational measures implemented (for risk analysis and crisis management).

These changes will be detailed further in a new article.

Sources :

Directive Network and Information System – Article ANSSI Link: Link to the article on NIS Directive

Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union Link : Link to the NIS Directive

On Digital Service Providers (DSPs) – ANSSI Article – May 23rd 2018 Link : Link to the article on DSPs

On Operators of Essential Services (OES) – ANSSI Article Link : Link to the article on OES

Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on measures for a high common level of cybersecurity across the Union, repealing Directive (EU) 2016/1148 Link: Link to the proposal of the revised NIS Directive

[1] Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015.

[2] Directive (UE) 2016/1148 of the European Parliament and of the Council of 6 July 2016.

Cet article While preparing the NIS 2, update of the European overview of NIS transposition by the Member States…toward convergence ? est apparu en premier sur RiskInsight.

In this series, we’ll first present connected vehicles and their associated cybersecurity challenges; the main sources of threat and the risks will be addressed in a second installment. Lastly, a third article will present our views on the issue and the main lines of the response required to address it.

The connected car: a vehicle supporting a raft of interactions

Entertainment, an extension of your smartphone, shared mobility, management of the car’s life cycle… users are demanding new experiences, and the services and applications they generate are resulting in a range of interactions. We can imagine a smart car being able to find a free parking space, automatically schedule an appointment for maintenance, or turn a traffic light green as it approaches. Since April 1, 2018, all new vehicle models must also have an emergency call system, as well as geolocalization to enable the authorities to be contacted in the case of an accident. In this respect, they are already “connected”.

Manufacturers and other players are already capitalizing on the opportunity to maintain a close relationship with customers throughout the vehicle life cycle. By doing this, they become “providers of services and mobility solutions,” drawing on, among other things, collected data. In particular, because such connectivity represents a step toward autonomy, the vehicle needs to be able to communicate with other vehicles and the surrounding environment. These changes are underway, and their pace will progressively increase.

However, the challenge of cybersecurity is scarcely taken into account, or ignored: yet it has to be a key plank of any connected solution—from the design phase to the end of the life cycle. Such thinking is essential to safeguarding the vehicle’s integrity, protecting passenger lives, and complying with current and future regulation.

The first prerequisite is to properly understand the connected vehicle’s technologies and ecosystem.

How connected vehicles interact with their environment

A specific feature of a connected vehicle is that it interacts with its ecosystem, via mobile data streams, over both the short and long-ranges.

• Short-range connections: Here, the vehicle interacts directly with an object (such as a smartphone, infrastructure, etc.), without any intermediary. It uses technologies with a limited range for local exchanges (WAVE, on-board Wi-Fi, Bluetooth, etc.).
• Long-range connections: Here, the vehicle uses remote access to interact with external components via a cloud platform. 4G, and soon 5G, connections are the technologies of choice for connecting vehicles to the internet.

This connected-vehicle concept also covers exchanges with the vehicle’s direct environment under the umbrella term “Vehicle-to-Everything” (or V2X). Lastly, the standard, ISO 20077, covers “Extended Vehicles” (or ExVe) as a whole: which comprise the physical vehicle as well as all the platforms and infrastructures that the car manufacturer is responsible for.

A range of ecosystems and players that need to work together

The car was once a very closed system; with the exception of diagnostic connections for garages and some connectivity to be able to broadcast multimedia content; any connectivity risks were largely contained. Today, the proliferation of forms of connectivity and access to the internet have opened up new opportunities for manufacturers and service providers, but also for attackers.

The first ecosystem to consider is the . Electronic and communication systems must be able to communicate with each other without the transmitted data or stored secrets being altered or stolen. Among these systems are the ECUs, the mini “on-board computers” that control the vehicle’s key functions, such as the braking system, air conditioning, lighting, etc.

Beyond on-board security, there are the user and owner (the latter not necessarily an individual) who have the right to give orders to the vehicle according to pre-defined rules. In the future, their authentication will be essential when it comes to questions of responsibility, as well as for verifying the legitimacy of the orders they issue.

Another vitally important aspect concerns connected services that use centralized platforms, or even cloud-based ones, which have been developed by the manufacturers or their partners. These platforms represent a significant threat because they can trigger orders for entire fleets of vehicles, and therefore the impact of any problem is multiplied. Manufacturers will need to put in place sufficiently secure solutions to allow such services; they’ll need to combine their own platforms with those of partners and the APIs on the vehicle, as well as ensuring the required level of confidence in the environment.

Lastly, in the medium-term, external objects and the surrounding environment (other vehicles, garages, parking lots, road infrastructure, etc.) will need to communicate and share information. The challenges of ensuring security in real time (in terms of availability, integrity, etc.) will be complex ones.

Cybersecurity issues: from the virtual to the real world

People’s safety, inside and outside vehicles, is a top priority for the automotive industry. We might imagine, then, that the cybersecurity issues raised by connected vehicles will be treated with the same degree of rigor—such that they can guarantee the car’s safety and integrity.

The first issue represents an organizational challenge for all stakeholders, especially manufacturers, because the emergence of this new model brings together two opposing worlds: services and engineering. The first is characterized by agility and speed, and large numbers of short-term projects. The second, with a much longer development cycle, must meet the safety and quality requirements associated with vehicle approval. This dichotomy has impacts on cybersecurity and, in particular, its integration into development projects, as well as the coverage of end-to-end risk. For example, as a result of its position, the backend becomes a nerve center that must be fully protected to avoid any risk of a systemic attack that could have repercussions for the entire fleet. Unfortunately, the true value of this need for security is not currently appreciated, mainly as a result of requirements for very short times to market.

Considering the other issues, it’s clear that the cybersecurity challenges for connected vehicles don’t differ greatly from those in the IS world: identity and access management, detection and response, the security of infrastructures, cryptography, third-party management, patch management, etc. A connected vehicle is a mobile IS, and numerous security standards (ISO2700x, NIST 800, etc.) have already been developed. These set out good practice in various guides and reference documents (SAE J3061, AUTOISAC, NHST, etc.) and the topic will shortly be covered to the ISO/SAE 21434 standard.
However, a number of factors inherent to vehicles and their embedded systems mean that the topic needs to be considered from new and specific angles.

The vehicle’s mobility and connectivity make security more complex: security must be guaranteed where there is a limited connection, or no connection, and in the context of a changing environment. Regulatory aspects must not be ignored either, given that the vehicle may have to move between countries.

The world of on-board systems also places constraints on hardware—in terms of cost, computing power, and size.

Questions about updating components and services arise too, given that a system must be able to function at all times but may also be shut down for long periods.

Lastly, vehicles are designed for a long life cycle, which implies thinking about security from the start, especially when it comes to managing identities and accesses. This long life cycle also means considering evolving standards over time, as well as developing a model for updates that guarantees vehicle security in a way that is sustainable and manageable for constructors.

The road ahead is long, and cybersecurity is approaching a crossroads that was not in view a decade ago. It’s vital that all players involved grasp the importance of what’s required and start to put in the effort now, before it’s too late.

Cet article Saga 1/3: connected car: between cybersecurity and safety est apparu en premier sur RiskInsight.

The bill, originally created to amend a 1986 bill, The Stored Communication Act, allows the United States to force US-based service providers to transfer their customers’ data hosted overseas much more rapidly. It currently takes an average of ten months to obtain the data, rendering investigations conducted from within the US highly unproductive. The bill aims to allow US authorities (from sheriffs to the CIA) to access the data hosted by US companies, without the authorization of a judge. Large technology companies, who have supported the bill in the Senate, will be able to oppose a request if:

• The customer or subscriber is not a U.S. citizen or resident (section 3.2.b.h.2.i), and
• The transfer would require the provider to contravene the regulations of the country hosting the data (section 3.2.b.h.2.ii)

Such a request would then be brought before a US court which would be able to quash (or uphold) the request for the data transfer. Its decision will be based, among other things, on the validity of the information provided, the US’s interest in the request, the scope of the violation, and the chances of it being deemed to contravene the law in the foreign country. The public nature of the appeal is not specified, especially regarding the capacity of companies to communicate about contested requests. Today, it seems likely that the major US players are using such appeals to maintain the trust of their customers.

In order to avoid contravening the regulations of the countries concerned, the US can enter into bilateral agreements with them, which, in return for their goodwill, will be able to access data from the United States.

In the US, the CLOUD Act remains contested due to the risks introduced by the potential agreements with foreign countries. The fact that an executive power can put in place mutual agreements worries the American people, who fear that foreign powers are using the CLOUD Act to access their data without any safeguards.

What are the consequences for customers in Europe?

While tech giants (like Facebook, Google, Microsoft, and Apple) have supported the bill (with the US authorities refraining from approaching them for back-door access and providing a clear framework for data transfer), these regulations raise concerns about customer privacy for the targeted businesses. The act could leave customers without a right to consult, or any information about access to their data by US authorities.

However, European customers whose data is processed in Europe are now protected by the General Data Protection Regulation (GDPR). Articles 45 and 48 of the regulation, which is now in force, lay down a clear set of rules for allowing data to be transferred to third-party countries. According to Frank Jennings (a renowned lawyer on cloud matters), the European Data Protection Board, which oversees the implementation of the GDPR, will be responsible for deciding whether data appropriation under the CLOUD Act constitutes a necessary measure for the safeguarding of US national security, or whether a request does not comply with the new regulation. This could force the United States to negotiate with the EU or its Member States on the conditions for such data transmission, thus protecting their citizens against illegitimate transfers. US customers, however, would remain within the scope of the CLOUD Act.

Negotiations are due to begin between the European Commission and the US. EU leaders have already criticized the US bill as being hastily adopted, something that may complicate negotiations. In the meantime, some 100 civil society organizations have urged transparency from the European Council about the negotiations of the CLOUD Act as set out by the “Convention on Cybercrime” (or “Budapest Convention”).

Privacy laws: an asset for companies?

While the GDPR has preoccupied a good number of companies with respect to the changes it involves for their information systems, and that the ePrivacy Directive is in preparation, it is instructive to consider the connections between regulatory developments and the world of business. Data privacy laws could, whether in the near or distant future, be considered as an aid to protecting business’ data and to maintaining customers’ trust.

In a world where data-privacy issues are becoming increasingly important (think of Cambridge Analytica and Google Home Mini ), protection of customer data can be a decisive factor when choosing between competing offers. The position US providers will take on privacy and data protection issues is therefore eagerly awaited.

What can you do today?

To conclude, the new regulations on privacy remain somewhat ambiguous and may even clash in certain areas. The main conclusion remains that, as a result of the GDPR, Europeans should be better protected against the CLOUD Act, provided US suppliers reject inappropriate requests, and the courts with responsibility for arbitrating them play their roles correctly. Meanwhile, non-European customers will not gain greater protection by choosing to host their data in Europe.

While awaiting the implementation of new laws dealing with confidentiality and possible data appropriation, there are steps you can take to protect your personal and business data against it being inappropriately accessed while overseas, and other potential threats:

1. Clarify with your provider under what conditions it may be required to give access to your data, without forgetting to consider any mutual legal assistance treaties.
2. Define or review your hosting strategy according to the type of data held, your provider’s nationality, and the hosting site’s location.
3. Favor data hosting in European data centers, or in countries with well-established data privacy frameworks.
4. Choosing a French or European supplier enables you to avoid the risks associated with the CLOUD Act. You must, however, stipulate contractually that it does not use US subcontractors (either directly or indirectly)!

Cet article The Cloud Act: does it mean your data is better protected? est apparu en premier sur RiskInsight.

A NEW LEGAL FRAMEWORK IN 2018 FOR HEALTH DATA HOSTING

The Health Data Hosting Decree was published in the French Official Journal on February 28, 2018. This decree confirms the developments announced in the Order of January 12, 2017, relating to the hosting of personal health data, which is itself an instrument of the act to modernize the health system of January 26, 2016.

This new decree makes Health Data Host certification mandatory for any public or private organization that hosts “personal health data collected during prevention, diagnosis, care, and social or medical follow-up activities, on behalf of natural or legal persons who are the source of the production or collection of this data, or on behalf of patients themselves”.

Health Data Host certification must be overseen by an independent body, which has been accredited by the French Accreditation Committee (COFRAC) or one of its European equivalents. Achieving certification confirms the conformity of the service with all the relevant requirements. Health Data Host certification remains valid for three years but is subject to annual monitoring.

APPROVAL OR CERTIFICATION: WHAT’S THE DIFFERENCE?

As part of the approval process, the candidate organization had to compile a (large!) application file which included a set of completed forms and supporting documents, as well as a compliance audit report prepared by a company of its choosing.

Rather than starting from scratch every time, Health Data Hosting certification now relies almost exclusively on recognized international standards: ISO 27001 in its entirety—and parts of ISO 27017, ISO 27018, and ISO 20000-1. Some specific requirements are added too; these mainly focus on two aspects:

• The protection of health data: protection of outsourced backups, prohibition of the use of health data for purposes other than the provision of hosting services, the traceability (including names) of the use of generic accounts, and other provisions;
• The transparency of the service: the option for the customer to carry out audits, a mandatory revocation policy, including the methods that will be used to return data, provision of the certification audit report at the client’s request, etc.

Beyond the “usual” gains provided by ISO 27001 certification, which are discussed at length in some of our previous articles, these additional requirements aim to professionalize the hosting of services, improve transparency between the hosting provider and its customers, strengthen health-data security, and reaffirm the rights of those whose personal data is being processed in accordance with the General Data Protection Regulation (GDPR).

HEALTH DATA CERTIFICATION REALLY MEANS TWO CERTIFICATES

Health Data Host certification now includes two separate certificates, each tailored to a specific type of activity that the host may choose to carry out:

• A “Data Management Host” certificate;
• A “Physical Infrastructure Host” certificate

The diagram below, taken from requirements for Health Data Hosting, provides the relevant detail on the certificate required for the type of health data hosting activity to be carried out.

Activities requiring Health Data Host certification (diagram from accreditation requirements reference material v1.0, accessed on 04/04/2018)

A certificate is required if at least one activity within the scope of the certification type is to be carried out. For example, a hosting provider offering the outsourced backup of health data (Activity 6) will need to have a “Data Management Host” certificate; it will therefore have to comply with for requirements of the Health Data Host certification for this form of certification. Similarly, a p  rovider supplying premises (Activity 1) must have a “Physical Infrastructure Host” certificate and comply with the requirements applying to that type of certification.

Every hosting provider will have to acquire one or both certificates, depending on the health data hosting services it plans to offer to its clients.

FUTURE CERTIFICATION FOR APPROVED HEALTH DATA HOSTS…

Health Data Hosting approvals remain valid until they expire (withdrawal or suspension notwithstanding, as was the case when this was the regime in force). The period of validity will be extended by six months for approvals due to expire before March 31, 2019. After this date, all Health Data Hosts will have to obtain Health Data Host certification.

The mandatory nature of certification will boost the French market for ISO 27001 certifications, which is currently sluggish, according to ISO’s most recent study: in 2016, only 209 valid ISO 27001 certificates were awarded, compared with 227 in 2015.

120 Health Data Hosts have already been approved and logged on ASIP Santé’s (the French government’s digital health agency) website . Although some are already ISO 27001 certified (and assuming that the scope of the Information Security Management System includes the hosting of health data), additional certification will be required to become a certified Health Data Host. For the rest, certification covering all requirements will be needed, and this development should, in itself, lead to growth in the market for ISO 27001 certifications in future years.

… AND SOME FACILITIES THAT ARE PART OF AREA HOSPITAL GROUPS (GHTs)

Another consequence of the act to modernize the French health system is that public health facilities are currently coming together as Area Hospital Groups (GHTs) to share aspects of their work. Each of the 135 GHTs is organized around a support facility, which provides a range of services to the GHT, including “Strategy, optimization, and joint management of a combined hospital information system” (Article 107 of the act). This provision requires the implementation of unique applications for all GHT facilities and each functional area (computerized patient files, medication circuits, biology, imaging, etc.).

GHTs have two main (though not exclusive) options:

• Contract a certified third-party Health Data Host to host their data; or
• Host their data within one of the GHT’s facilities (for example, the support facility).

In the latter case, the host establishment will need to be a certified Health Data Host. While the majority of GHTs are still considering whether to outsource all, or part, of their combined information system, in late 2017, 57% of them were still planning to outsource hosting. Nevertheless, large numbers of GHTs may well, in the end, choose to maintain their health information system within the GHT and certify the host facility, in order to maintain full control of the information system and health data. This choice is likely to be seen mainly among GHTs that have large support facilities (a large central hospital, for example). This, then, will also drive strong growth in the number of ISO 27001 certificates issued in France.

FINANCIAL HELP TO SUPPORT THE TRANSFORMATION OF GHTs

To support the creation of their combined ISs, GHTs can draw on various forms of financial support. €20m has already been invested through Regional Health Agencies (ARSs), and a call for projects, with a scope of €25m, was announced at the end of 2017 by the French government agency, DGOS. The scope of the e-Hôp 2.0 Program , the successor to the 2012-2017 Digital Hospitals Program, should have seen funding, to a level of €400m, to support the development of health-care facilities to 2021. Given that it has been recently replaced by the Hop’EN Program, the eventual level of funding remains unknown at present.

Part of this funding may be used by GHTs to configure their combined information systems, for example by financing an outsourcing program with a certified hosting provider, or by financing the Health Data Host certification of one of the GHT’s facilities.

By changing the regulations related to the health data hosting at a time when the GHTs are configuring their combined ISs, the government is seizing the opportunity to strengthen the data security of patients treated by the public health service. Indirectly, this provides a dual driver for growth in the French market for ISO 27001 certification, which will result in the standardization, and dissemination of good practice, in information-security management across the healthcare sector.

Although the result of long-awaited developments, this growth is likely to lead to an explosion of applications for ISO 27001 certification and health data hosting in the coming years: will COFRAC, and the companies that will be accredited to deliver Health Data Host certification, be able to meet demand? …There could be a bottleneck on the horizon.

Cet article “HEALTH DATA HOSTS”: HEALTH PROVIDES A SHOT IN THE ARM FOR THE FRENCH ISO 27001 CERTIFICATION MARKET est apparu en premier sur RiskInsight.

So why should we care about Records Management? Records Management matters now more than ever with the incoming General Data Privacy Regulation (GDPR). It is a unique opportunity to turn a compliance issue into a business enabler by taking matters at a strategic level: by mapping out what data your company holds, where it is stored, and how it is processed, you accomplish many positive outcomes. First, you comply with Data Protection laws, which is the primary driver ahead of May 2018 when GDPR comes into force. But you also bring clarity to the Business as to what they do, you bring clarity to Information Security as to what they protect, and you bring clarity to clients and partners as to what information you hold about them and what you do with it. This in turn enables your company to save on storage costs and information security costs because you can now differentiate essential information that needs to be kept, maintained and protected, from information that is not required or that requires less protection. Your customers will welcome your transparency and control as they become more demanding in terms of respecting their privacy and understanding why you require such information.

So where should you start? You shouldn’t feel the need to hire a department full of Records Management experts to achieve your goals. You will find that employees that have been around for several years have a deep knowledge and understanding of how your company works. You can leverage their expertise through targeted interviews as you build your strategy.

The 3 steps to creating and implementing your Records Management strategy are as follows:

1. Create a Records Management Policy for your company
2. Create a register of applications and vendors in use by your company (which can be based on your service catalogue)
3. Implement the Records Management Policy across your applications and vendors – this is where you will realize savings and efficiencies

Records management policy

Every business has legal, regulatory and operational reasons for keeping records. For example, you could be recording customer phone conversations with your customer service for training and quality purposes (business reason), because of a regulatory requirement when selling financial products (MiFID), or because of legislation.

The Records Management Policy will synthesize these business, regulatory and legal purposes for keeping records during the course of doing business.

Each Business Unit should be able to tell you what type of data they process and where it is held, so that the Policy can be built from the ground-up efficiently through a round of targeted interviews with long-standing employees or key business managers.

Once you have an inventory of types of records processed by your business, you then need to balance legal, regulatory and business imperatives for choosing the retention period for each record type: regulation will usually force a floor retention period (for example keep phone conversation audio records for 5 years minimum with MiFID II). Legislation will either force a minimum or a maximum retention period (e.g. Data Protection Act states you should not keep personal data for longer than required for the stated business purpose).

The combination of the record types, their retention periods and the purposes for which these records are held form your Records Management Policy.

Register of applications and vendors

Once you have a Records Management Policy, you will need to align your IT systems so they support the implementation of the Policy. Thus, you need to build a top-down view by collecting the list of applications in use in your company through your IT and sourcing team. This will be your starting point. You should then cross-reference this list with the Information Security team to check it corresponds to applications they see end-users requesting access to. Finally, you can further corroborate this list with Business Heads which will usually be aware of any shadow IT applications there may be. The final list thus complied will support the implementation of your Records Management Policy. You can take advantage of the completeness of this list to feedback Information Security and Sourcing to plug in gaps you may have uncovered, which will help reduce risk of data loss through unsupervised vendors or systems.

You will then need to map the IT systems to the records they hold and that you have identified in your Records Management Policy. This will help to implement your Records Management Policy.

Implementation of your Records Management Policy

Having a Records Management Policy and a mapping of your data is only a compliance tick-box exercise if you don’t follow through with implementation. Additionally, this step is where you will realise any savings and efficiencies. A good example is back-up tapes. If you can agree that the purpose of back-up tapes is only for network restoration in case of major disaster recovery, and you state it in your policy, then you can confidently state in your policy that their retention period should be, for example, no more than a week for daily tapes, no more than a month for weekly tapes, no more than a year for monthly tapes, and no more than 3 years for end-of-year tapes. Applying this will save you a lot of storage space and will bring clarity of purpose for your operations team. Certainly, you must in parallel define in your policy what other records will serve for satisfying record keeping obligations from a business, regulatory and legal perspective.

Companies that do not have a Records Management policy will struggle to agree on retention periods, and will tend to over-store records, which leads to unnecessary costs and even raises the risk of liability: old back-up tapes, to stick to this example, might not be encrypted or readable in current technology media, so that they are no longer of use to the business. If they get stolen, however, the data might still be exploitable and lead to reputation damage if not litigation for the firm.

Once you have a Records Management strategy in place and being implemented, you can review your Information Security, Legal, Compliance and Business strategies to align with the data you know you own and the operations around it. This will bring added benefits beyond the Records Management realm: focus Information Security Resources on areas of sensitive data, identify high risk operations currently being performed and change them to a lower risk alternative or drop them altogether if the business case is negative.

It is now clearer what businesses stand to gain from having a clear Records Management strategy: better compliance with data protection laws, heightened operational efficiency, and more focused and efficient information security. To maximize the benefits of a Records Management strategy, it should also be integrated with the Information Security, Legal, Compliance and Business strategies to enable the business to operate in an efficient, compliant and secure environment going forward.

Cet article How to turn Records Management into a business asset est apparu en premier sur RiskInsight.

However, they are also facing increasingly stringent measures under new regulations such as the General Data Protection Regulation (GDPR), which covers all personal data, or the various new regulations on the protection of critical national infrastructures. France is in the vanguard of this activity with its Military Programming Act which applies to the organizations classed as “most critical” in terms of the country’s functioning.

But how can you put in place increasingly sophisticated detection systems, while, at the same time, complying with an ever-stricter regulatory framework?

SOCs ARE BEING STANDARDIZED AT THE EUROPEAN LEVEL—AND GLOBALLY

In the mid-2000s, the implementation of the first SOCs consisted, for the most part, of deploying log collectors based on geographical hubs and the setting up of a central alert management system. However, recent regulatory changes may require modifications to architecture. In France, in particular, within the context of the Military Programming Act, the requirement to set up a “system of log correlation and analysis” (i.e. a SOC equipped by a SIEM system) has been accompanied by a strict regulatory framework, which is set out in its PDIS (Security Incident Detection Service Providers) Requirements Reference Document.

In terms of standardization, this addresses three points in particular:

• First, the framework for surveillance: there is now an obligation to detect certain types of common attacks and implement controls, following recommendations made through audits carried out by qualified bodies, in accordance with the PASSI (Cybersecurity Audit Service Providers) Reference Document. Companies must also put in place a permanent surveillance unit to notify ANSSI (the French national agency for information system security) in the event of an IS being critically compromised.
• The second area addresses the securing of the SOC’s assets: new security measures described in the PDIS Requirements Reference Document demand, in particular, more robust measures for SOC operators and administrators (two-factor authentication, limitations on internet access, etc.). These security measures will be verified by ANSSI through audits, or retrospectively, following the compromise of an IS being notified to it.

Finally—the architecture—where there’s a requirement for greater complexity: partitioning into trust zones and an enlargement to the perimeter of the monitored network are introduced (going beyond the traditional scope of equipment under security surveillance: business servers and handheld devices must also now be monitored). Information related to security incidents (events, analysis reports, and their associated notifications) must also now be retained for as long as the service is provided.

STRONG SECURITY AND CAREFUL HANDLING OF PERSONAL DATA: INCOMPATIBLE GOALS?

To carry out retrospective analyses and, in particular, to determine the origin of cyber-attacks, a good deal of personal and critical data must be collected, stored, and exploited. However, this data is covered by the GDPR, which tends to limit its collection and use.

Google’s recent fine by the AGPD (Spain’s personal data protection authority) highlights the types of issue that a SOC may encounter regarding the processing of personal data:

• Google’s obligations in the processing of personal data and the user’s right to be forgotten were the prime causes of Google’s penalty. In fact, the GDPR intends to offer European citizens the option to access, modify, or delete their data wherever it is stored (including in the cloud). This means that, in practice, companies must know exactly what data is being collected by their SOC, so that they can inform their customers, employees, etc. accordingly—and offer them the option of having it removed at any time. Having said that, the GDPR seems to indicate that preservation of some data is acceptable, where this is necessary for the protection of companies. The details of exactly how this provision will operate are expected to be worked out over the next few years.
• An obligation of transparency with respect to the exploitation of data is the second issue that the AGPD’s action raises. Yet, for PDISs, the obligation to monitor a wide range of equipment gives rise to the collection of a large and varied amount of data. The content of logs will therefore have to be addressed to ensure that only the data needed for security-monitoring activity is collected.
• Finally, the GDPR imposes a requirement to justify the preservation of the data. Yet, PDIS requirements are for data to be kept for at least six months, in order to have the ability to carry out long-term or retrospective analysis; this creates regulatory uncertainty: how far can a company go in ensuring the protection of its IS?

Looking beyond the example of Spain, it’s instructive to compare the different legislative approaches to the notification of incidents. Those dedicated to the protection of personal data target rapid notification in order to limit the impacts on people’s lives; while legislation concerning the protection of critical infrastructure requires limited and highly confidential notifications in order to allow sufficient time for incidents to be correctly managed, without revealing to an attacker the fact that they have been discovered. In the end, the GDPR took into account this type of scenario, but that’s not to say that other texts won’t result in contradictory obligations.

A STRICT—BUT BENEFICIAL—REGULATORY FRAMEWORK

The tightening of the regulatory framework for SOCs, whether direct (via PDIS requirements) or indirect (through the GDPR), will result in a transformation of the IS ecosystem. New types of profiles could thus be integrated into teams, such as the Data Privacy Officer (DPO), which the SOC could consider as a key player in maintaining its long-term compliance.

In addition, these regulations will raise maturity levels among the players who have to comply with them, as well as among those who draw inspiration from them. Already, there are numerous moves toward compliance involving SOC architecture, as well as its processes and governance.

In complying with the regulations, tools also count—and that means looking at innovations such as data-based surveillance (with Data Leakage Prevention [DLP] tools), which can help ensure compliance with respect to the protection of sensitive data.

TOWARD MORE REALISTIC REGULATIONS…

The value of the requirements for many organizations, both as standards and objectives to be met, cannot be disputed.

While the bar may seem high, and regulatory inconsistencies remain, one thing is for sure: the next round of regulatory updates will provide a solid framework for the design and improvement of SOC.

Cet article The SOC – a department undergoing a full regulatory overhaul est apparu en premier sur RiskInsight.

The presidential race was marked by a strong emphasis on cybersecurity. The topic, considered during the campaigns as “one of the most important challenges the next president is going to face” (Hilary Clinton, Derry, New Hampshire, February 3, 2016) and “an immediate and top priority,” (Donald Trump, Herndon, Virginia, October 3, 2016) was on the agendas of both final candidates, who expressed a strong willingness to better protect the country’s “cyberspace.” Furthermore, the leakages from various political organizations during the electoral process highlighted the weaknesses of the society against cyber threats.

U.S. critical infrastructure sectors, such as financial services, transportation systems, and energy, will inevitably have a role to play.

The cyber community is now eager to see the new government’s cybersecurity plan. In addition to federal agencies, private institutions that are heavily involved in U.S. critical infrastructure sectors, such as financial services, transportation systems, and energy, will inevitably have a role to play.

Significant efforts have been made to increase cybersecurity in the U.S. and abroad. A common trend is to improve protection of what is generally called critical infrastructure. To that end, the previous U.S. administration launched several governmental initiatives, including the development of the Framework for Improving Critical Infrastructure Cybersecurity by NIST (“NIST Cybersecurity Framework”). The framework is used worldwide aside major standards and is now being updated. In 2016, the Cybersecurity National Action Plan (CNAP), planned to increase the country’s Federal budget for cybersecurity to $19 billion in 2017. In Europe, the Directive on Security of Network and Information Systems (“NIS Directive”) requires Member States to adopt and publish sufficient laws and regulations to protect essential services. This is a global trend which is already visible in many countries such as France with the LPM law and China through the recently enacted Cybersecurity Law. Even international organizations such as NATO are promoting critical infrastructure cybersecurity protection.

Will President Trump focus the country’s cybersecurity program on critical infrastructure?

The two draft Executive Orders released show the new administration is seriously considering the issue.

The first draft Executive Order Strengthening U.S. Cyber Security and Capabilities suggests President Trump will order an extensive review of the country’s weaknesses, strengths, and enemies within an aggressive timeline. The previous administration initiated similar effort less than a month after taking office in 2009, resulting in the rather theoretical Cyberspace Policy Review.

This draft focuses on the following initiatives:

• Vulnerabilities – Review most critical cyber vulnerabilities and submit a list of initial recommendations for enhanced protection of national security systems and most critical infrastructure;
• Adversaries – Review principal cyber adversaries and submit a first report on their identities, capabilities, and vulnerabilities;
• Capabilities – Review relevant cyber capabilities and identify an initial set needing improvements to adequately protect critical infrastructure; review efforts to educate and train the cyber workforce and make recommendations for the future;
• Incentives – Propose options to incentivize private sector adoption of effective cybersecurity measures and submit recommendations.

Leveraging incentives reduces the immediate need for additional regulation or legislation.

While the review of vulnerabilities, adversaries, and capabilities is consistent with actions taken by foreign governments, a more original approach may be taken to ensure adoption of cybersecurity measures by the private sector. Indeed, the focus on Leveraging incentives reduces the immediate need for additional regulation or legislation, which echoes well President Trump’s “Two-for-One” Regulation Executive Order. On the contrary, in Europe, the NIS Directive calls for “effective, proportionate, and dissuasive penalties” to ensure requirements are fulfilled.

Based on currently available information, it is difficult to discern how and to what extent the government would be able to fully execute these initiatives, as they are relatively sweeping in scope. However, the assessment of tangible vulnerabilities and adversaries may indicate a willingness to focus on launching concrete actions.

The second draft Executive Order Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure is similarly ambitious, ordering the government to produce no less than 11 reports and requiring the involvement of the whole executive branch of the Federal Government and critical infrastructure actors.

This draft retains the initiatives on vulnerabilities and capabilities from the first draft, but the scopes are quite different. It suggests more stringent effort will be made on the protection of executive branch and less on critical infrastructure. Among other things, the government here aims to:

• Hold heads of executive departments and agencies accountable for managing cyber risk. This follows a trend already adopted by regulators in the financial services sector, for example through the NYS-DFS 23 NYCRR 500 Cybersecurity Requirements for Financial Services Companies  and the NFA Interpretive Notice on Information Systems Security Programs (ISSP). Bringing accountability to the senior management level is a necessary step toward reinforced focus on cybersecurity and inclusion at the enterprise level, beyond technology departments;
• Generalize the use of the NIST Cybersecurity Framework. While the framework was originally intended for critical infrastructure, it is easy to imagine it applied to federal agencies. It would likely complement and structure the usage of other materials such as the NIST FIPS PUB 200 Minimum Security Requirements for Federal Information and Information Systems and the NIST SP 800-53 Security and Privacy Controls for Federal Information Systems and Organizations, which agencies are already required to leverage under the Federal Information Security Management Act of 2002 (FISMA). It would also increase alignment of practices between the public and private sectors;
• Review executive departments’ and agencies’ risk management practices and actual risk decisions, assess whether they are appropriate and sufficient, as well as develop a plan for improvement. Such effort is consistent with the first draft but this time applies only to the executive branch;
• Develop a plan to modernize IT architecture by transitioning to shared IT services and consolidating network architecture, especially for National Security Systems. Shared IT services allow for increased security through industrialization, and consolidated network architectures are easier to protect and monitor.
• Identify authorities and capabilities to support cybersecurity efforts of entities managing critical infrastructure at greatest risk in case of cyber attack, in collaboration with those entities. The notion of critical infrastructure at greatest risk originates from President Obama’s Executive Order 13636 Improving Critical Infrastructure Cybersecurity;
• Assess the Federal policies and practices efficiency to promote market transparency of cyber risk management. No more incentives here, but a market-driven approach to foster extended cybersecurity measures among the private sector, and no reference to any new regulation;
• Identify and promote initiatives to improve resiliency of core telecommunications infrastructure. Those initiatives, likely at the Internet service provider level, would mainly focus on preventing continuously increasing distributed attacks.

The initiatives described in the two drafts are aligned with general market practices and are headed in the right direction.

Overall, the initiatives described in the two drafts are aligned with general market practices and are headed in the right direction. However, some uncertainty remains on a number of topics such as privacy and protection of PII, and private-public collaboration. Moreover, as American technology companies that have historically stored their data in the U.S. are opening more and more data centers abroad to meet local regulatory requirements, the U.S. will have to define their own data localization requirements.

The challenge for the new administration is to develop unified data protection policies to drive consistent regulations

The U.S. has led the effort in defining modern cybersecurity tools such as the NIST Cybersecurity Framework and the FFIEC Cybersecurity Assessment Tool but now needs to focus on execution. The challenge for the new administration is to develop unified data protection policies to drive consistent regulations, and move from a theoretical approach to concrete results.

If we are to expect actual results, the effort should enable a country-wide response that is transversal and coordinated, with sufficient oversight. Putting in charge a single agency, as announced by White House officials moments before the President’s signature was called off, may well be a first step in that direction. The new administration will have to define clear roles and responsibilities between the public and private sectors, a governance for collaboration, and a strategy to drive implementation.

Beyond this transformation, the upcoming challenge will be on the collaboration with other countries to align with foreign initiatives with a NATO-like approach, with the objective to drive harmonization of standards and requirements for a more efficient approach to cybersecurity. Stakes and expectations are higher than ever.

Cet article The trends of Trump’s Cyber Regulation est apparu en premier sur RiskInsight.

This blog post is a part of a series of articles which is itself the result of a synthesis on Privacy at the digital age published on our website. 

An increasingly international regulatory framework

The concept of privacy, as understood in history, can be understood across several centuries of legislation. It began taking shape in 1948, inscribed in Article 12 of the Universal Declaration of Human Rights: “No one will be the object of arbitrary interference in his private life (…). Everyone has the right to be protected by law against such interference or attacks”.

Regulation around the protection of personal data is a more recent phenomenon. It is directly linked to the development of information technology and the increased collection of data by organisations. In addition, the market value of data adds a further layer of complexity with the emergence of an international regulatory consensus. Sweden was the first state to establish legislation on the subject in 1973. In France, the “Loi Informatique et Libertés” was enacted in 1978, following debates over the Safari project, aimed at creating a centralised database of information about individuals.

Without reviewing each national law and its timeliness, an analysis of the initiatives implemented on regional scales provides a holistic view of the main privacy trends.

European Union: the state protecting its citizens

The European Union was the first institution to establish legislation on the subject in 1995 with the publication of Directive 1995/46/EC. This first attempt at creating legislative harmony on an institutional and European scale has been followed by the implementation of numerous principles, defined in the law of various Member States, including the establishment of supervisory authorities. This legislation is rooted in the “Guidelines for the Protection of Privacy and Transborder Flows of Personal Data” published by the OECD in 1980, which were non-binding.

In April 2016, the European Union elected to strengthen its legislation with the General Data Protection Regulation (GDPR), which, unlike the 1995 directive, will be directly applicable in the law of the Member States of the European Union.

Its implementation is planned for May 2018, when organisations must ensure their compliance with the requirements of the regulation. Developments will soon take place in e-privacy in the near future, aligning traditional requirements on privacy with more recent developments and innovation, thus addressing the topics of secrecy and correspondence in the digital age. Through such literature, the European Union will adopt the position as a protector of citizen data.

US: Making people aware of their responsilities

There is no specific regulation nor regulator within American law which oversees the collection and use of personal data at a federal level. Instead, the United States operates under a combination of laws which apply to certain sectors or states. Some regulation covers specific categories of personal data, such as financial data or health-related data, while others regulate activities which exploit such data, such as digital marketing. In addition to such regulations, best practices developed by federal agencies and industrial groups are also used as a means of auto-regulation. The Fourth Amendment of the US Constitution can also be referenced for the protection of personal privacy. Finally, laws around consumer protection, while they do not regulate personal privacy, forbid practices around the disclosure of personal data. Nevertheless, American citizens display a certain degree of flexibility regarding the distribution of their personal data.

As shown by the evolution of “Safe Harbor”, differences exist between the American and the European vision. This legal mechanism was implemented to ensure the protection of data transfer between the EU and the USA until October 2015, thereafter invalidated by the Court of Justice of the European Union (CJEU). According to the CJEU, the level of data protection offered by the United States was no longer satisfactory in light of the information leaked by Edward Snowden regarding the global surveillance programme operated by the American government. In February 2016, the United States and the EU drew up a new arrangement, the Privacy Shield, which came into force in August 2016 and is designed to offer better protection for data transfers.

Asia: a situation under development

With respect to data protection, we can categorise Asian countries and territories in two ways. Some are relatively mature on the subject, including South Korea, Singapore, Hong Kong or Taiwan. Until recently, China did not have any specific personal data protection legislation. However, in November 2016, new regulations applicable to operators from June 2017 were implemented. This new regulation will integrate widely agreed principles on respecting personal privacy and will require the storage of personal data on Chinese territory. On the other hand, other countries in the area are yet to implement regulations regarding the protection of personal data on a large scale, despite on-going debates.

Rest of the world: regional initiatives under development

In Africa, the first legislation on the subject was implemented in 2001, in Cape Verde. In 2004, Burkina Faso was the first state to establish a national regulator. At the regional level, the African Union Convention on Cybersecurity and Personal Data Protection, signed by 18 countries in 2014, incorporates notions derived from European legislation, with no legal binding.

In the Middle East, states such as the United Arab Emirates (UAE) and Saudi Arabia do not have specific legislation regarding the protection of personal data. Specific to these countries is the application of Sharia law, stating that damage can be claimed if the disclosure of personal data leads to abuse or damage.

In South America, several countries implement independent regulators. Moreover, they benefit from constitutional guarantees regarding personal data protection. This is particularly the case in Uruguay and Argentina, two countries recognised by the European Union as providing sufficient levels of data protection.

Cet article Privacy: which legal frameworks should be implemented on an international scale? est apparu en premier sur RiskInsight.