Inside Track: Centring data centres

Asystec Peter O’ Connor, data governance consultant

 

advertisement

 

Here are the four key areas, mentioned above, and a brief explanation of their relevance to the new EU regulations:
Data classification – Know where personal data is stored on your system, especially in unstructured formats in documents, presentations, and spreadsheets. This is critical for both protecting the data and also following through on requests to correct and erase personal data.

Metadata – With its requirements for limiting data retention, you’ll need basic information on when the data was collected, why it was collected, and its purpose. Personal data residing in IT systems should be periodically reviewed to see whether it needs to be saved for the future

Governance – With data security by design and default the law, companies should focus on data governance basics. For unstructured data, this should include understanding who is accessing personal data in the corporate file system, who should be authorised to access, and limiting file permission based on employees’ actual roles – i.e., role-based access controls.

Monitoring –The breach notification requirement places a new burden on data controllers. Under the GDPR, the IT security mantra should “always be monitoring”. You’ll need to spot unusual access patterns against files containing personal, and promptly report an exposure to the local data authority. Failure to do so can lead to enormous fines, particularly for multinationals with large global revenues.

Viatel Damien McCann, head of marketing and sales

While the new Privacy Shield agreement is being trashed out this provides opportunity for companies to take stock of the current situation, questioning what client data they actually hold and analyse what data is being transferred outside of the EU. Where is this data going? And what are you doing to secure it?

Client’s should engage with current cloud providers and request that data is not stored outside of the EU, going forward additional due diligence is needed on the customer side when choosing future cloud platform providers making sure that in a post safe harbour world that you know exactly where data is stored and more importantly how secure it is. Reputable cloud platform providers will happily engage and go the extra mile to address and reassure clients. In Ireland clients will have a number of cloud providers that provide options and guarantees that data is securely stored within the EU or within providing users with options to select the actual primary and backup country for data to be stored.

Triangle Computer Services Donal Byrne, head of automation

Typically, around 80% of IT security budgets are spent on parameter security devices such as firewalls and data loss prevention (DLP).

This usually leaves the internal networks as a free-for-all where the introduction of firewalls and DLP for every server and desktop is operationally complex and highly expensive. With VMware NSX, you can prepare for the GDPR by deploying security controls inside your datacentre network through what is known as the micro-segmentation model. With NSX, security policies can be defined not just in the typical 3-tier manner of Web/App/Database but also down to which individual groups of users or service accounts can connect to particular sensitive IT services. It offers a zero-trust security model inside the datacentre and allows for data-centric adaptive security. Businesses can protect sensitive data processed by their applications and control the security risk level of each workload in real-time.
The four main modes of security that VMware NSX can utilise are:

• Fully isolated networks
• Segmented virtual networks utilising the native NSX high-performance, automated firewalls
• Segmentation with the integration of security partners for advanced security services such as ‘Layer-7’ DLP and preventing network exploits in-flight
• Data-at-rest DLP where systems are routinely scanned for sensitive data such as banking details and can automatically secure workloads where sensitive data is found

GDPR does not need to become an obstacle to your business operations and may indeed help bring business value by automating IT security safeguards.