The cyber security industry believes that the European General Data Protection Regulation (GDPR) is stifling innovation by making companies nervous about using cloud-based applications and services, according to new research published today by AlienVault, a provider of Unified Security Management and crowdsourced threat intelligence.
In a recent survey of over 900 conference participants at InfoSecurity Europe, almost half (49%) of respondents said that the threat of GDPR fines is making them more nervous of using cloud-based apps and services.
This could be due to the lack of cloud security expertise that participants described within their organisations. Over a quarter of them (28%) described the level of cloud security expertise in their organisations as either ‘novice’ or ‘not very competent’.
>See also: IoT boom and GDPR raise the stakes of a cyber security breach
Over a quarter of those surveyed (27%) admitted to cutting corners with cloud security in order to reduce costs, such as sharing credentials to access cloud-based apps and services within their organisations.
In addition, almost half (48%) either don’t have, or aren’t sure if they have, data processing agreements set up with new cloud providers. This is an essential part of GDPR compliance, and ensures that any cloud apps are adhering to data privacy protection requirements when processing customer data.
Javvad Malik, security advocate at AlienVault, explained that “Cloud security is clearly still a thorn in the side for some organisations, with IT teams still struggling to monitor their environments effectively for security threats. In a separate AlienVault survey, we found that around a fifth of IT professionals don’t know how many cloud applications are being used within their organisations. This lack of visibility raises the question of how cloud-consuming organisations are going to cope with the requirements of GDPR if they don’t even know which apps are being used.”
The 72 hour rule: more harm than good?
Article 33 of the GDPR legislation states that an organisation must report a data breach within 72 hours. The national data protection authority will then decide how much to fine the organisation for the breach; this could be up to 4% of the organisation’s global annual turnover, or over 20 million Euro, whichever is greater.
Half of respondents (50%) in the AlienVault survey believe that the 72 hour rule could do more harm than good. For example, people might try to cover up data breaches to avoid the fine, rather than reporting them in a less timely manner. One reason for this could be because a significant proportion (43%) of survey participants don’t think their organisation could, or aren’t sure if they could, identify and report a data breach within 72 hours.
>See also: GDPR compliance: what organisations need to know
“Organisations with small and overstretched security teams, and limited budgets for cyber security, are likely to be extremely worried about the threat of GDPR fines,” said Malik
“After all, the potential of having to pay up to 4% of global turnover could have a serious effect on a fledgling business potentially impacting earnings or funding opportunities. They could also lose customers through reputational damage and even have to consider making redundancies. Set against this backdrop, it’s easy to see why some might consider trying to cover up a data breach, rather than deal with the consequences. But this could lead to far greater problems for them in the long term.”
The political climate: Brexit and encryption
It is now widely accepted that the UK will still have to comply with GDPR and other EU legislation for the foreseeable future, despite the UK’s decision to leave the EU. However, over a quarter of survey respondents (26%) still believe that the corporate and customer data their organisation holds will be less secure when Britain leaves the EU.
In addition, the majority of security professionals questioned during the poll (54%) said that they thought a change of leadership at No. 10 Downing Street could have made the country more cyber secure, due to a change in policy towards encryption and the sharing of cyber threat intelligence.
When it comes to encryption, over a third of respondents (38%) said that their organisation would refuse to put a backdoor in their customer data if asked to do so by the government. In fact, many respondents were extremely scathing about the government’s policies towards encryption, leaving comments including: “The laws and things the Tory government talk about introducing show that they don’t understand the Internet”, and “Theresa May has literally no knowledge of the tech/security industry, and is using the standard rhetoric in order to scare the electorate into voting.”
>See also: How prepared are UK banks and insurers for GDPR: not very
Malik concludes that “British PM Theresa May has been waging a long battle against encryption, stating that end-to-end encryption is ‘completely unacceptable’ and is providing a safe haven for terrorists. While no one wants to actively support terrorism, the InfoSec Community is clearly concerned that the weakening of encryption and introduction of backdoors could also introduce significant risks. It seems likely that trouble will lie ahead for the government if it continues with its current approach. However, one way to resolve this might be for the government to detail its requirements to technology companies, and allow them to suggest methods of achieving these goals, rather than dictating methods that are viewed as either insecure or not feasible.”
The UK’s largest conference for tech leadership, Tech Leaders Summit, returns on 14 September with 40+ top execs signed up to speak about the challenges and opportunities surrounding the most disruptive innovations facing the enterprise today. Secure your place at this prestigious summit by registering here
