General Data Protection Regulation (GDPR) takes effect in the European Union (EU) on May 25, 2018. Since GDPR expands the privacy rights granted to EU individuals and it places many new obligations on organizations that serve
customers and individuals in the European Union, irrespective of their geographical location. Such organizations around
the world will be required to put in place security policies to address different risks and effectively enforce these policies
with technical controls or potentially face fines of up to 20 Million Euro or 4% of Global turnover whichever higher.
Furthermore, in event of data breaches, it is imperative for the organization to follow a schedule and provide
comprehensive information regarding the breach to the Data Protection Officer as mandated by GDPR. In light of the
tough timelines for reporting a breach – in addition to securing the IT infrastructure, it is also important to have robust
breach detection, investigation and internal reporting procedures in place.
While GDPR readiness and compliance poses a significant challenge for many organizations, many of its technical
requirements align closely with the security and compliance best practices already supported by eScan's range of
products.
eScan simplifies security and compliance by enabling enterprises to create a software-defined perimeter that combines
secure access to apps and data with contextual control, visibility and behavior analytics across devices and networks.
Enterprises can proactively secure, detect, and mitigate risk with intelligence applied to each unique scenario.
This white paper discusses the requirements of GDPR and how eScan's range of products address them for access, network
security, application security, data security, and analytics.
Applying to all organizations within the EU or
organizations that control or process the personal data
of the citizens of EU, the GDPR strengthens and
harmonizes data protection laws across EU nations.
The regulation mandates a high level of responsibility
and accountability for these organizations while giving
the citizens greater control over their data through
measures including anonymization and controls around
storage and accessibility.
Under the GDPR, citizens will have rights including the
ability to access their personal data; rectify inaccuracies
or omissions; request deletion or removal of data once it
is no longer required; restrict the processing of their data,
and object to the use of their data. The scope of the data
to which the GDPR applies is broad and comprehensive,
encompassing any information relating to an identified
or identifiable natural person, whether the data has been
provided by the individual, observed by systems such as
web browsers and social media platforms, derived
through straightforward processes such as transactional
history, or inferred through complex processing.
eScan's security solutions can facilitate GDPR readiness for any organization by providing a foundation of confidentiality, integrity and availability of all types of onpremises and cloud IT environments. The approach to security and compliance is based on the following principles:
eScan products are built on these very principles for contextual access, network security, application security, data security and analytics to support GDPR compliance across the following areas:
Records of Processing Activities
Maintaining complete records of the processing of personal data is one of the crucial requirements under Article 30 of the GDPR for all organizations. eScan's wide range of products provide auditing capabilities for enterprises to track exactly how and by whom the data has been accessed. By reporting on the movement of data to and fro from endpoints across various devices, organizations can better meet GDPR guidelines.
Access to Personal Data
The GDPR requires that organizations control and restrict access to personal data. With eScan, organizations can control access to applications, devicesand their data by way of Application/ Device whitelisting. Group-based and user-based access policies are complemented with contextual controls that adapt
access privileges based on the device, its location and network.
Data Isolation and Protection
So as to strengthen data protection and mitigate the risk of breaches as required by the GDPR, eScan provides comprehensive measures for application and data security including containerization and centralization. Centralization enhances data protection by enabling more efficient management of patches, policies and
updates. This helps organizations keep up to date with the latest protection against ransomware and other threats. Encrypted eBackup assists data recovery in case of data loss. For mobile devices such as smartphones and tablets, containerization keeps business and personal data separate from any of the user's own data that the device may contain. Modules such as TSPM helps organizations deter attacks against critical services and prevent data leakage.
Data Encryption at Rest
Protecting customers from unintended disclosure of their data, either by insiders or third party, eScan's Enterprise Mobility Management assist in enabling organizations to protect and encrypt.
Enterprises can prevent data from residing on the mobile devices, including bring-your-own-device (BYOD); containerization makes it possible to separate personal and business apps and their locally stored associated
data. Enterprise data on mobile devices is encrypted and controlled by IT to prevent it from being leaked when a smartphone or tablet is lost or stolen.
For more than a quarter-century, eScan has been trusted by organizations across industry verticals, including the most
highly regulated sectors, to protect sensitive business information without compromising workforce productivity. Various Government offices across the globe, too have entrusted eScan to protect their IT infrastructure, as eScan provides a secure platform for IT to control applications and data access across any device or network. eScan can help support GDPR guidelines through the following secure technologies.
End-Point Protection (EPP)
eScan's EPP solution helps in monitoring and securing critical data to prevent any kind of data leak or data theft from managed endpoints in the network. It allows the administrator to whitelist or blacklist USB and other storage devices, allow or block access to devices such as webcams, CD-ROMs, Composite devices, Bluetooth devices, SD Cards or Imaging devices. Authorized access to such devices can be provided using One Time Password without violating policy deployed to the group.
Enforcing certain settings in order for a device to connect to the network at all – such as local encryption, password complexity, security software, and the removal of the local administrator account – will be an essential part of protecting the organization within the GDPR framework.
Enterprise Mobility Management (EMM)
Enterprise data and applications can be containerized on mobile devices, including BYOD and wiped remotely to protect Enterprise data in the event that the device is lost or stolen. Any user content a device may contain is kept separate from business content and is unaffected by the remote wipe capability.
Perimeter Security and Advanced Threat Protection
Establishing defenses to keep malicious actors out, is essential even in the age of cloud when other than the computing resources, Enterprises have to protect their user network from malicious attacks.
More serious concern under GDPR is the potential for malware to harvest credentials for user and administrator accounts. Preventing infections requires a multi-faceted technological response. Traditionally, hackers have relied on targeting the email gateways by way of sending spear phishing emails or emails laced with malicious content.
Advanced threat protection mitigates threats by analyzing every URL to ensure that it does not contain malware payload and furthermore protects against
email attachments being used as an attack vector.
Blocking of hacking attempts and malware through technological means is essential for any organization
wanting to become GDPR complaint and reduce the likelihood of data breaches along with other implications such as data loss amongst other likely scenarios.
Mailscan at the gateway, with its heuristic engine weeds out spam, and malicious emails. Furthermore, with the rise of Ransomware and the usage of exploits for lateral movement, PBAE along with TSPM provides an additional layer of security for the end-points and for the Internet facing servers.
