The management of privileged users is one of the key activities to comply with the GDPR. Read the blog to learn more!

The European Union is on the verge of enacting its new privacy regulations, known as the General Data Protection Regulation (GDPR). Replacing the existing EU data privacy rules, GDPR is simply the latest in a long line of privacy regulations dating back to 1980. While GDPR clarifies and simplifies a number of data protection requirements, it adds new rules that will almost certainly present challenges to international businesses working in the EU.

In fact, the GDPR applies to any business that deals with private EU resident data, regardless of whether they are based in the EU. For example, a US company with a subsidiary in the EU (or just doing business with EU citizens) would be bound by the rules. In other words, GDPR impacts virtually every company of any size everywhere in the world.

Prominent new rules found in GDPR include:

• Privacy Designed and Built into Business Processes – By default, privacy levels must be high.
• Data Protection Officer (DPO) – Organizations with more than 250 employees must appoint a Data Protection Officer.
• Consent – Under GDPR, EU citizens must give valid, explicit consent to have their personal data collected. The entity controlling the data (the “data controller”) needs to be able to prove consent or “opt-in.”
• Right to Erasure – GDPR updates the existing “right to be forgotten” with a new “right to erasure.” An EU citizen can now request the deletion of personal data under certain circumstances.
• Data Breaches – The DPO now has a legal obligation to notify the “Supervisory Authority” in his or her respective country about the breach within 72 hours. Individuals must be notified if their private personal data has been breached.
• Data Portability – EU citizens can move their personal data between systems. The data controller may not stop them.
• Expanded Notice Requirements – Data controllers have to explain how long personal data will be retained.
• Data Protection Impact Assessments – Data controllers must perform and report on a data protection impact assessment when there are specific risks expected to occur to the rights and freedoms of “data subjects,” those individuals whose data is being collected.
• Higher Penalties – GDPR raises penalties for violations, with fines of €20m or up to 4% of revenue, whichever is greater.

The Potential Impact of GDPR on IT and Cybersecurity

New GDPR rules go far beyond the realm of privacy. They affect a broad swath of IT and cybersecurity practices. For international businesses, GDPR will likely affect data management, data protection, software development, and system administration. For one thing, the GDPR introduction of the Data Protection Officer (DPO) will affect how IT and security teams operate and communicate. With the equivalent of a regulatory authority in-house, any employee who handles personal data will now have some level of obligation to keep the DPO informed about decisions and activities that relate to GDPR compliance.

Privacy is now part of almost every conceivable area of IT. For instance, an international company with EU locations will have to track its data movement across the EU. Such data moves must be auditable by the DPO.

“Privacy by Design” affects how systems are designed and developed. The right to erasure and data portability will create new workflows that will require new functionality being programmed into systems of record, such as customer-resource management (CRM) systems.

In short, GDPR is a pretty big deal for both IT and security teams.

Don’t Lose Sight of the Privacy Forest for the Regulatory Trees

Taking a step back, it is worth remembering the end goal of the GDPR: making personal data safer.

As IT and security professionals, it’s easy to see the GDPR as nothing more than another set of regulatory compliance hoops that we have to jump through, but as citizens of the world, it’s a good thing that companies are getting more serious about data privacy.

The previous data protection laws date from 1995 and served a world in which computing infrastructure was mainly fixed and in-house. The sorts of data and the sheer quantities we deal with now were practically unimaginable 20 years ago. The subsequent consequences of a data breach are equally unimaginable just a few years ago. Along with a bunch of requirements, GDPR comes with some benefits and advantages, especially for EU-based companies.

Don’t let GDPR become just another box-ticking exercise. Take the opportunity to both protect your data and create transparency around how you are doing it.

GDPR and Privileged Access Management (PAM)

The management of privileged users is one of the key activities to enable the smooth transition to GDPR compliance.

A privileged user has administrative or “root” access to a system. He or she is the individual who can add, modify, or delete email accounts on Microsoft Exchange Server, for instance. These access privileges need to be tightly controlled and easily revoked when no longer necessary.

Privileged Access Management (PAM) is a security discipline that uses tools and practices to keep an organization safe from accidental or deliberate misuse of privileged access. A PAM solution:

• Offers a secure, streamlined way to authorize and monitor all privileged users for all relevant systems
• Grants and revokes privileges to users for systems on which they are authorized
• Centrally and quickly manages access over a disparate set of heterogeneous systems
• Creates an unalterable audit trail for any privileged operation

GDPR compliance requires tracking administrative access control for any system that manages personal data. For instance, this might mean managing and monitoring how multiple admins manage and protect data across multiple EU territories for an international business. Documentation of privileged access is necessary to establish that GDPR rules are being followed.

A PAM solution can document GDPR compliance in this regard while streamlining internal and external audits. A PAM solution can show, for example, which roles and which persons in an organization are allowed to modify data protection policies.

A typical GDPR risk might involve having a privileged user in an EU country whose access logs are not transparent. This user might, without realizing it, violate GDPR rules. Without a pervasive PAM solution, that user has generated a potentially costly liability from GDPR fines or litigation.

PAM solutions can also enable the new “Privacy by Design” intentions of GDPR. As any number of recent data breaches shows, securing data should start with those who have the most access. PAM is one way of tackling the issue and should include application onboarding, maintenance, and offboarding. To cover the full life-cycle, PAM needs to be included from the initial integration into the system through all changes during the lifetime and end with final system removal after decommissioning. PAM can check the workflows of individual users to ensure and document that their actions are legitimate.

The WALLIX Solution – PAM for GDPR

WALLIX offers a PAM solution that rises to the challenges of GDPR compliance. The WALLIX solution combines robust PAM capabilities with unique ease of installation, maintenance, and use. An agentless architecture streamlines both deployment and ongoing network and system updates.

WALLIX spans both cloud and on-premises system deployments. Its single gateway has a single sign-on for access by system admins. With this capability, the IT department can define and enforce privacy policies for admins and employees across the globe. Other core features include:

• Access Manager – Governs access to privileged accounts, creating a single point of privileged access management policy definition and enforcement needed for GDPR compliance. A privileged user requests access to a system through the Access Manager. The Access Manager knows which systems the user can access and at what level of privilege. A super admin can add/modify/delete privileged user accounts on the Access Manager.

• Password Vault – Prevents privileged users from knowing the actual passwords to critical systems. A manual override on a physical device becomes impossible. Instead, WALLIX keeps these passwords in a secure vault and opens access to a system for the privileged user once he or she has cleared the Access Manager. Password management strengthens GDPR privacy controls by ensuring that an administrator cannot change settings for data management or data protection on a local appliance.

• Session Manager – Tracks actions taken during a privileged account session. For audit and incident transparency purposes, WALLIX’s Session Manager offers fine-grained detail for DPA reporting.

WALLIX’s solution is lightweight. It easily establishes the kind of pervasive, sustainable PAM that GDPR needs to work effectively across a geographically distributed organization. It sets up rapidly no matter the system and doesn’t require complex maintenance or agent updates as underlying systems change. This leads to a level of flexibility that’s critical for GDPR compliance. GDPR rules are bound to change again and there will surely be a period during which the specifics of rule implementation will evolve as practical details get worked out.

For more information request a live demo of the WALLIX Bastion PAM solution.