Watch the webinar on-demand: https://info.trustarc.com/what-gdpr-means-for-your-cybersecurity-strategy-webinar.html In this highly-connected world, there is potential for even the most secure networks to be compromised. With the GDPR bringing increased fines and heightened consumer expectations on how consumer data is handled, there’s additional pressure on your company’s cybersecurity strategy to stay one step ahead. A focus on preventative measures needs to become more sophisticated with a multi-layered approach to cybersecurity and ongoing risk management. Watch this on-demand webinar now to look at the role the CISO plays in managing GDPR compliance, the role of tools such as anonymisation and integrated assessments, and how the privacy team can partner effectively with the security team. To register for upcoming/on-demand webinars visit: https://www.trustarc.com/events/webinar-schedule/ https://info.trustarc.com/what-gdpr-means-for-your-cybersecurity-strategy-webinar.html

1. © 2018 TrustArc Inc Proprietary and Confidential Information
PRIVACY INSIGHT SERIES
Summer / Fall 2018 Webinar Program
PRIVACY INSIGHT SERIES
What the GDPR Means for your
Cybersecurity Strategy
November 28, 2018

2. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Thank you for joining the webinar “What the
GDPR Means for your Cybersecurity Strategy”
• We will be starting a couple minutes after the hour
• This webinar will be recorded and the recording
and slides sent out later today
• Please use the GotoWebinar control panel on the
right hand side to submit any questions for the
speakers
2

3. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Today’s Speakers
Andre Mintz, CISSP, CTPRP
EVP, Chief Information Security Officer | Chief
Privacy Officer
Red Ventures
3
Martin Gomberg, CISSP, CIPP/E
Senior Consultant
TrustArc
Margaret Alston, CIPP/G/C/M FIP
Consulting Director
TrustArc

4. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Today’s Agenda
• Welcome & Introductions
• Set the stage
• Importance of Security in GDPR
• Reasonable organizational and technical
measures
• CISO and CPO roles in delivering GDPR program
• Recommendations – Next Steps
• Questions
4

5. PRIVACY INSIGHT SERIES
Summer / Fall 2018 Webinar Program
© 2018 TrustArc Inc Proprietary and Confidential Information
Setting the Stage
5

6. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Poll Question
6

7. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries7
Per cent of companies
indicating they are in full
compliance
(600 companies polled)
20%
Estimated to achieve
compliance by year end
2018
60%
Companies still unaware
of obligations for
compliance under GDPR
Undetermined
(miscellaneous sources)
Comparative State of EU, UK and US Corporate
Compliance (TrustArc, 2018)
Comparative State of EU, UK and US Corporate
Compliance (TrustArc, 2018)
We should be done, but are we getting close?

8. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Who Owns GDPR?
8
LEGAL
RISK
ITCISO
Operations
GDPR

9. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
HIPAA
CCPA
SECNYDFS
PIPEDA
GDPR
And we are getting numb….
9
BRAZIL
CHINA
BELARUS
SINGAPORE
RUSSIA
ISRAEL
TAJIKISTAN
KENYA UK

10. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Poll Question
10

11. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Are Cyber and Privacy controls the same?
• Cyber controls:
– Monitoring, testing, detection, analysis, correlation, response, review,
reinforcement, and defense
• Privacy controls:
– Minimization (collection, retention, distribution, manipulation, transfer)
– Obfuscation (encryption, hashing, pseudonymization, anonymization)
– Informed choice (basis for consent, cookies and tracking, cookie wall,
legitimate interests)
– Individual data rights (view, access, correct, limit, stop, erase, port or
withdraw consent)
– Privacy by design
11

12. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Legacy Systems
GDPR affords individual data subjects the right to
know if we hold their data and to view, access,
correct, limit or stop processing and ask that it be
erased or returned.
– SAR (Subject Access Rights) Requests
– Can we find the data we hold?
– Can traditional system design support this?
– How effective our controls around the data we hold in
general?
12

13. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Reasonable Organizational and Technical
Measures – What Does That Mean?
• They are undefined, but they are risk aligned
• Proportional to the need and the investment
• Where controls are lacking, compensating controls are
applied sufficient to the risk
• Measures may be technical devices, technical process,
staffing, structure, or procedure
• They address monitoring, testing, detection, analysis,
correlation, response, review, reinforcement, defense,
authorized use and behavior, and privacy controls
13

14. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
RISK ALIGNMENT OF REASONABLE MEASURES
14
Classified
Intelligence
Vital
Systems,
Apps, Data
High Risk
Systems,
Apps, Data
Moderate
High-Risk
Systems,
Apps, Data
Moderate
Risk
Systems,
Apps, Data
Low Risk
Systems,
Apps, Data
Negligible
Risk
And/or
Public Data
Validated
Secure
Controls
High Risk
Controls
Moderate
High Risk
Controls
Moderate
Risk
Controls
Low Risk
Controls
Negligible
Risk
Controls
Examples of
Reasonable Measures
Technical Measures
Reasonableness should
apply to defenses,
infrastructure investment,
monitoring and detection,
development, process and
procedure.
Organizational Measures
Reasonableness should
also apply to adequacy in
staffing, and authorization
of access and use,
dictating who has access
to specific data, what they
are authorized to do,
whether it can be
transported, and required
protection.

15. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
The CIA Triad and GDPR
CIA governs our traditional approach to security.
– Is the concept of CIA (Confidentiality, Integrity and
Availability) sufficient for GDPR?
15

16. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Are our categories of risk sufficiently
defining for GDPR?
Corporate data can be high risk, but not in scope for
GDPR.
– Under GDPR, what data are considered in scope?
– Does de-identification through encryption render data
out of scope for GDPR?
16

17. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Cloud and GDPR
• Cloud moves data out of direct control. Is it
compatible with controller obligations?
– Remote management
– Effective controls
– Contracts
– Third party support
17

18. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Emerging Threats and GDPR
• Ransomware
• Social engineering
• Spear Phishing
• Nation State Actors
• Malicious Data Exfiltration
18

19. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
GDPR – A Comprehensive View of Breach
• Data loss
• Exfiltration
• Isolation
• Manipulation
• Destruction
• Disclosure
19

20. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Challenges for emerging technologies and
GDPR
• AI
• BlockChain
• IOT
• MedTech
20

21. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Poll Question
21

22. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
CISO and CPO roles in delivering GDPR
program
Can the CISO also be the DPO or CPO?
– Skills compatibility?
– Conflicts of interest?
– Organizational reporting
22

23. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
If you haven’t started you need a plan
• Evaluate
• Advocate
• Educate
• Plan
• Assess and mitigate
• Operate
• Document
• Build a repeatable, demonstrable and reportable
process
23

24. © 2018 TrustArc IncPrivacy Insight Series - trustarc.com/insightseries
Recommendations and Next Steps
• Inventory networks, systems, data location,
purpose, need, owners and controls
• Assess business gaps to the law
• Map business processes and movement of data
• Risk assess data and system assets
• Evaluate contracts, disclosures
• Data owner choice, rights and controls
• Correct deficiencies
24

25. PRIVACY INSIGHT SERIES
Summer / Fall 2018 Webinar Program
© 2018 TrustArc Inc Proprietary and Confidential Information
Questions?
25

26. PRIVACY INSIGHT SERIES
Summer / Fall 2018 Webinar Program
© 2018 TrustArc Inc Proprietary and Confidential Information
Contacts
26
Andre Mintz amintz@redventures.com
Martin Gomberg mgomberg@trustarc.com
Margaret Alston malston@trustarc.com

27. PRIVACY INSIGHT SERIES
Summer / Fall 2018 Webinar Program
© 2018 TrustArc Inc Proprietary and Confidential Information
Thank You!
Register now for the last webinar in our 2018 Summer / Fall Webinar
Series “Privacy Management: Emerging Trends, Benchmarking and
Best Practices” and is due to take place on December 19, 2018.
See http://www.trustarc.com/insightseries for the 2018
Privacy Insight Series and past webinar recordings.
27