Connect with us

Features

Misaligned Policy Priorities Complicate Data Protection Compliance

Published

on

Drew Bagley, VP and Counsel, Privacy and Cyber Policy, CrowdStrike

Data protection efforts are proliferating. Clearly a response to daily news about data breaches and other unauthorized data exposures, these efforts are all well-intended. Increasingly, advocates and policymakers recognize the need to harmonize cybersecurity requirements within data protection laws. But proposals to localize data persist — and threaten to undermine improvements to both data protection broadly and cyber resilience specifically.

Common Cybersecurity Requirements Provide a Roadmap for Privacy Compliance

Despite a seemingly confusing “alphabet soup” of data protection requirements in the form of GDPR, CCPA, APPI, amendments to the Australian Privacy Act and an increasing number of U.S. privacy laws, there have been positive developments for those seeking to build a global program. The text of these regulations actually share seemingly common security requirements demanding the implementation of safeguards “appropriate” or “reasonable” to the risk. For years, it has been understood that these requirements were designed to ensure organizations did not view data protection compliance as a “one and done” but instead enhanced data protection methods as threats and technologies evolved.

Today, we have both more clarity and greater consensus than in years past as to what constitutes “appropriate” or “reasonable.” Common cybersecurity technologies and practices appear in the ENISA “State of the Art” guidelines, the U.S. Executive Order on Improving the Nation’s Cybersecurity and the latest guidelines from the New York State Department of Financial Services. These best practices include endpoint detection and response (EDR), dark web monitoring, log management, threat hunting and Zero Trust identity protection. Moreover, it appears that patching against known vulnerabilities has shifted to a compliance priority in the wake of the Federal Trade Commission’s statement after Log4Shell. This common recognition of specific cybersecurity practices means that practitioners now have more certainty into baseline standards in the face of potential regulatory enforcement and litigation.

Confusing Policy Trends Can Undermine Cybersecurity Best Practices

Simultaneously, but in contrast to the increased clarity in meeting the security requirements of data protection laws, emerging data localization proposals threaten to misalign data protection priorities. Current cybersecurity trends make clear that cyber intrusions continue to pose a significant threat to privacy. In essence, security requirements and the endorsed practices are designed to prevent unauthorized access to data.

Nonetheless, many policy proposals around the globe seek to deny otherwise authorized access, such as managing a network across jurisdictions, in effect limiting defenders’ means to protect against unauthorized access. Recent examples include provisions in India’s draft Digital Personal Data Protection Bill, France’s draft cybersecurity certification, SecNumCloud, an early draft of Italy’s Presidential Decree implementing NIS 1.0, certain interpretations of post-Schrems II cross-border data flows, and other policies promoting data sovereignty for domestic intelligence gathering or industrial policy objectives.

While these policy debates remain fluid, the reality is clear that data localization requirements would actually limit use of the very cybersecurity best practices for which there is consensus around the globe. To utilize these, defenders require software-as-a-service (SaaS) platforms, aggregated security data, unified visibility across an enterprise, centralized log management, the ability to track lateral movement, and 24/7 services, which invariably require data flows.

The irony is that threat actors don’t follow the rules, so defenders lacking global analytics and threat hunting capabilities would be met by threat actors naturally aiming to exfiltrate data across borders and move laterally within a global network. In other words, data localization requirements could incentivize organizations to mitigate against the perceived risks of foreign legal processes at the expense of complying with domestic requirements to use the right technologies to protect data against breaches.

Fortunately, there have been some positive developments, including an OECD agreement on government data access principles, which has the opportunity to resolve many of the concerns of data localization proponents.

Cybersecurity Realities Give New Meaning to Today’s Privacy Requirements

As security and privacy teams work together to comply with modern data protection standards of “reasonable” and “appropriate” to the risk, and policy makers weigh the merits of data localization debates, it is important to take note of how different today’s threats are.

Data leak extortion poses a significant threat to privacy and security today. Moreover, from a tactical perspective, modern attacks are identity-driven, leveraging the use of legitimate credentials. Other trends include some of the findings in CrowdStrike’s 2022 Falcon OverWatch Threat Hunting Report:

• Malware-free activity accounted for 71% of all detections indexed by CrowdStrike Threat Graph®
• Adversaries move fast, with the average speed of measurable breakout time being 1 hour 24 minutes, with 30% of those intrusions indicating the ability to move from one host to another within 30 minutes

The stakes of today’s attacks and the techniques leveraged make it important for organizations to ask whether or not security technologies deployed on their network are appropriate to the risk, meet today’s legal standards, and adhere to common best practices. Similarly, such realities can inform policy debates on whether or not certain proposals would create better cybersecurity outcomes.

It is important to reflect on what holistic data protection entails, and how critical cybersecurity is, not only for compliance but for protecting privacy and human rights. Data breaches pose a significant threat to privacy today. Accordingly, policy makers and government agencies can improve privacy not only by promoting transparency but also by incentivizing the adoption of best practices to protect data against breaches. This should be prioritized instead of seemingly arbitrary proxies for privacy like data localization.

Today, modern IT infrastructure, cybersecurity and privacy compliance programs are dependent upon global data flows. Introducing frameworks that enhance security and provide certainty for data transfers is an important element to achieving holistic data protection.

 

Continue Reading

Features

Establishing data sovereignty in a ‘datafied’ world

Published

on

data

By: Omar Akar, Regional Vice President for Middle East & Emerging Africa, Pure Storage

Data is the currency of the digital domain, and with every passing day, the world is getting increasingly ‘datafied’. Billions of gigabytes of digital data pertaining to citizens, businesses, governments, and institutions are generated, collected, and processed every day. Understandably, there are concerns about how we can protect personal data, business data, as well as sensitive data that has implications for national security.

Challenges associated with data sovereignty

It is possible that a company based in a certain country uses cloud infrastructure from a provider abroad, and that cloud provider also has customers in other countries and regions. If data collection, data storage, and data processing happen in different countries, it will be subject to the data sovereignty rules of all those countries. Many of the concerns surrounding data sovereignty pertain to ensuring data privacy and preventing data that’s stored abroad from violating the laws of that country. Many countries have therefore introduced new laws, or modified the existing ones, so that data is kept within the boundaries of the country where the individual or entity is based. However, verifying that data indeed exists only at permitted locations can be very difficult.

On the other hand, storing huge amounts of data at only a few locations can increase the risk of data loss and data theft through cyberattacks, which can have huge ramifications on the financial health and reputation of businesses.

Moreover, data sovereignty makes it complex to share data across international borders. This can increase cost and inefficiencies for any business that operates across multiple countries and requires flow of data between its offices. Such businesses must now establish infrastructure in local data centers to comply with data protection regulations in each country. Companies also need to keep in view the data sovereignty requirements of each country and international data sharing agreements while wanting to share data which can impact business operations.

Ways to ensure data sovereignty and elevate data performance

Although establishing data sovereignty is undoubtedly challenging, there are some best practices and approaches that can help in achieving it and elevating data performance. Organizations should conduct a comprehensive audit of their data, including where it is stored, processed, and shared. This is the first step in identifying potential data sovereignty risks and ensuring compliance with the relevant laws and regulations of the concerned countries. It is also necessary to adopt data protection measures — such as encryption, access controls, and monitoring — to prevent unauthorized access and use of data, whether it is in transit or at rest.

The company’s data protection policy should define protocols for handling and storing data as well as measures for protecting it. This policy should be regularly reviewed and updated to keep up with any changes in data protection laws and regulations. If an organization has a footprint spanning multiple regions, it is a good idea to take the strongest data sovereignty laws among them and implement it across all regions. Cloud providers can be of assistance in this regard.

Benefits of working with cloud service providers

Most cloud providers have data centers in multiple countries. Organizations should go for a provider whose data residency provisions are aligned with their own data sovereignty requirements. Today, leading cloud providers also offer other features, including data encryption, that can help in achieving data sovereignty. To take it one step further, companies must introduce strict data governance processes in the cloud. This will ensure regulatory compliance, risk assessment, and risk mitigation at all times.

Data sovereignty laws apply not only to data but also to data backups. It is therefore important to understand how your organization backs up information — whether it is done on-premises or using dedicated cloud services or public cloud services. Adopting cloud-ready solutions and leveraging the benefits of all-flash storage is one of the ways to future-proof your organization’s data storage infrastructure. Uncomplicating storage will help in reimagining data experiences and powering the digital future of the business.

Finally, it is important to view data sovereignty holistically, and not as the exclusive responsibility of any one individual or team. The need to comply with data regulations extends across the board, from businesses to suppliers to the end-users. From a business perspective, ensuring data sovereignty calls for robust governance, holistic risk management, and concerted efforts on the part of the IT security, legal department, procurement, risk managers, and auditors — under the guidance and supervision of the company’s Chief Information Officer. It is a good way to build digital trust in today’s business environment.

Continue Reading

Features

HOW FSI INCUMBENTS CAN STAY RELEVANT THROUGH THE GCC’S PAYMENTS EVOLUTION

Published

on

payment

By Luka Celic, Head of Payments Architecture – MENA, Endava

Banks and payment services providers (PSPs) have been the region’s engines of economic growth for as long as anyone can remember. It is therefore jarring to imagine that this dominance is now under threat. After all, venerable banks and credit card companies have elegantly embraced the Internet, mobile banking, and the cloud to deliver self service banking to millions of customers. But consumers, especially digital natives, have never been known for congratulating an industry for a job well done. Instead, with each convenience, their expectations only grow. The siege reality of the pandemic accelerated a shift in consumer behaviour, and Middle East banks and PSPs now face challenges on three fronts.

The first is FinTechs. from Saudi Arabia’s BNPL (buy now, pay later) pioneer Tamara and Qatar’s unbanked oriented platform cwallet, to online financial services, Klarna, tech startups have been able to tap into rapidly changing consumer markets. New companies find it easier to pivot. And like speed boats racing against aircraft carriers, they weaved effortlessly to fulfil a range of desires amid high smartphone connectivity rates and a range of other favourable market conditions. By one estimate from 2022, BNPL alone accounted for US$1.5 billion (or 4%) of the Middle East and Africa’s online retail market.

The second threat is open banking, which comes in many forms, but one example is the instant-payments platforms being introduced by central banks such as those in Saudi Arabia and the United Arab Emirates. To get a sense of how this could play out, we need only look to Europe, where players who once relied on payments through card schemes are now pivoting towards open banking enabled payments. Closer to home, Al Ansari Exchange recently announced its customers can now transfer money and settle bills via the recipient’s mobile number, enabled by the UAE’s Aani IPP.

And finally, comes big tech. To augment its e-wallet service, Apple has signed up to an open banking service in the UK. The open banking framework which banks enabled through their investments is being exploited by a Big Tech firm that has access to 34% of UK smartphone users. Unsurprisingly, this sparked a fierce antitrust complaint by UK’s banks. Other big names will surely follow as they continue to craft ways of offering the digital experiences that garnered them user loyalty in the first place.

THE BALANCE

Apple Wallet is aimed at blending payment methods, loyalty cards, and other services into a single experience. But such moves have raised regulators’ eyebrows regarding a lack of interoperability and the preservation of competitive markets. Hence, Apple’s open banking foray — a gesture to calm the nerves of a finance market that fears having to compete with a company armed with countless millions of user transactions from which to draw insights. The massive user bases of tech giants will give any FSI CEO goosebumps. How does a traditional bank lure an Apple user? Open banking initiatives open the door to greater competition and innovation, both of which are good for consumers. But the only way to ensure both is by building an ecosystem that balances innovation with regulatory oversight.

FROM INCUMBENT TO INNOVATOR

Yes, smaller businesses have freedom of movement that larger incumbents do not. But that does not mean that there are no paths for banks and PSPs. There are, in fact, several strategies that larger FSI companies can employ to capitalise on the open banking revolution.

The first of these is collaborating to create ecosystems that provide users with frictionless experiences. Established FSIs already have access to a wealth of information about their customers and must now consider how to integrate data sources to create highly streamlined and frictionless workflows. A customer applying for a loan could then see their details auto populated, and credit history already accounted — all without the hassle of lengthy phone calls, application forms, or submission requests. In an age when instant is everything, it’s easy to see why the former approach could foster loyalty, while the latter would only serve to drive customers towards more capable competitors.

Card companies and issuer banks could also work with acquirers to smooth out the rough landscape that has arisen from the advent of digital payments. Acquirers traditionally acted on behalf of the merchants that accepted payment methods to recoup funds from the PSP through the issuing bank. This system has served the industry well, but with more payment methods emerging, acquirers have branched out into mobile wallets, QR codes, and gateway services. Gradually the relevance of established players has dwindled as their lack of representation at the critical checkpoint has diminished their significance. Incumbents must work to turn back the tide by recognising that acceptance and acceptance ownership are becoming increasingly important for maintaining market relevance.

Another strategy is diversification. Veteran FSIs may feel like they’ve lost ground to nimble start-ups and Neo Banks, but history shows value in patience — established FSI players now benefit from the investments of early innovators, and double down on payments innovations which have already shown the most promise. Moreover, if they diversify their portfolios through acquisitions, innovations, and partnerships, they can secure their future. Mastercard presents an excellent example with their US$200m investment into MTM payments. This single move has given the company access to MTM’s 290 million strong subscriber base, allowing these customers to become familiar with Mastercard products before getting entrenched with mobile wallet alternatives.

WHO’S ON TOP?

If we look at the rise of BNPL services, we see an origin story with — at least — major supporting roles for large card providers. But open banking has sidelined them in just a few years. BlackBerry was a stock market darling just five years before it sought a buyer. Traditional FSI players must innovate; they must collaborate with emerging disruptors; they must diversify. They can survive and thrive if they do these things — after all, they already have much of the infrastructure, and experience required for success. Middle East banks and PSPs have the existing user bases, so they have the scale to get out in front in the era of open banking. All they lack is the kind of compelling use cases that will entice the banking public. PSPs and their issuers could offer embedded payments, for example. The right services at the right time will be warmly received by consumers, no matter the scale of the offering institution, so there is every reason to believe that incumbents will come out on top against FinTech and Big Tech.

Continue Reading

Features

SEC paves way to approve spot ethereum ETFs

Published

on

ETF

By Simon Peters, Crypto Analyst at eToro

Ethereum spot ETFs took a significant step forward to being available to US investors last week with approval of the 19b-4 applications, allowing US exchanges (namely Cboe BZX, NYSE Arca and Nasdaq) to list and trade ethereum spot ETFs.

On the back of this, ethereum has been one of the best performing cryptoassets this week, gaining 19%.

According to a recent survey by eToro with retail investors in the UAE, over 74% respondents agreed that the prospect of an ethereum ETF will significantly influence their decision to increase, decrease or maintain their current ethereum allocation.
Focus now turns to the S-1 registration statements from the ETF issuers, as these still need to be approved by the SEC before the ethereum spot ETFs can actually launch and investors can buy them.

As to when the S-1s will be approved we have to wait and see. It could be weeks or months unfortunately.

Nevertheless, with the 19b-4s out of the way, it could be an opportunity now for savvy crypto investors to buy ethereum in anticipation of the S-1s being approved, frontrunning the ETFs going live and the billions of dollars potentially flowing into these.

We’ve seen what happened when the bitcoin spot ETFs went live, with the bitcoin price going to a new all-time high in the months after. Could the same happen with ethereum? The all-time high for ethereum is $4870, set back in 2021. We’re currently at $3650, about 35% away.

We’re also going into a macroeconomic climate with potentially looser financial conditions, i.e. interest rate cuts and a slowdown of quantitative tightening, conditions where risk assets such as crypto tend to perform well price-wise.

Continue Reading

Trending

Please enable JavaScript in your browser to complete this form.

Copyright © 2023 | The Integrator