Early last month, activists leaked the latest draft of the European Unions new data protection law – intended to protect citizens personal information when its in the hands of business and government. Their reaction to the draft was…less than stellar.
Some of the councils proposals gut data protection of all meaning, explained a group of privacy advocates in a prepared statement. For example, the council suggests that Internet browser settings could constitute consent for being tracked and profiled online.
In other words, if someone hasnt configured their browser settings to prevent themselves from being tracked, that means they consent to having information gathered about them. Awesome, right? Good to know the EUs government is looking out for the rights of its people.
Now, at this point, some of you are probably wondering what this has to do with you. After all, the EUs data protection law is primarily a consumer issue, isnt it? It doesnt have an impact on enterprise, really…does it?
Aside from the fact that failing to safeguard consumer privacy can lead to lawsuits, it most definitely does impact business. Think about it – if the European Union takes this lackluster of an approach to safeguarding consumer privacy, what about the safety of your own data? What about the sensitive information youve no doubt stored on your servers, or the activities and identity of your own staff?
Im going to be blunt here. Governments can no longer be trusted to safeguard our data. Data privacy and security laws in many developed nations are shoddy, at best – to say nothing of the fact that plenty of governmental organizations like the NSA dont really pay said laws any mind when it comes to monitoring.
So what can we do about it? Obviously, proper encryption and security is the first step…but is there anything that can be done beyond that? Its already become painfully obvious that even the best encryption can be cracked – and that sophisticated enough hackers can readily make their way past even the stoutest of firewalls.
Data encryption could help enterprises protect their sensitive information against mass surveillance by governments, as well as guard against unauthorized access by ill-intended third parties, explains PC Worlds Lucian Constantin; but the correct implementation and use of encryption technologies is not an easy task.
The challenge, he continues, citing security expert Matthew Green; is what kind of encryption to use. SSL is the most common way to protect data transmitted over the wire and the protocol is actually fairly strong, but SSL keys are relatively small and it’s not outside the realm of possibility that an organization like the NSA could obtain these keys at some point.
We have no idea what the NSA can do, Constantin quotes Green as saying. However, its reasonable to assume that even if they can break modern encryption schemes – a pretty big assumption – its going to be pretty expensive for them to do so. That rules out massive non-targeted eavesdropping on encrypted connections.
Aside from making sure all the sensitive data in your organization is properly encrypted, there are a few additional steps you can take to protect yourself from prying eyes:
- Familiarize Yourself With The Law: You need to know the data privacy laws for each and every region in which you operate. Thats a tall order, sure – but its a necessary one, at least until we manage to sort out the issue of regional dissonance. Mind you, that also includes keeping abreast of the latest legal battles in the privacy space – such as the battle between Microsoft and the United States Government over emails stored in other countries.
- Have An Intrusion Detection System In Place: Theres a good chance that you might eventually suffer a breach, no matter what security measures youve put in place. Having a decent intrusion detection system means youll be aware of that breach the moment it happens.
- Understand The Policies Of Your Host Or Colocation Provider: Are you hosting with a company thats spotty on the matter of data privacy or doesnt mention it at all? What are your rights when it comes to your colocation space? These are things you need to understand if you want to keep your companys information safe.
- Keep In Touch With Your IT Staff: Theres a growing disconnect between IT departments and the businesses they serve – you cant let your business be one of them if youre going to take security seriously. Make sure youre constantly in touch with IT professionals, both to ensure theyve the tools they need to get the job done and so that youre kept apprised of whats going on with your data.
These days, corporate data is threatened from all sides – its not just cyber-criminals, anymore. With organizations like the NSA constantly sniffing around for information, it seems as though businesses cant even trust the governments they operate under. It thus falls to you to make sure that your privacy – and the privacy of your customers and employees – is protected.
Because if you dont do it, who else will?
