Author: Eli Migdal

Posted on by

How to Hold an Azure Information Protection Staff Training

How to Hold an Azure Information Protection Staff Training feature image

In light of the latest data security climate, where a risk of a breach is higher than ever, it is of utmost importance to keep valuable data safe. Microsoft’s Azure Information Protection (AIP) helps in achieving this goal and it’s the solution we recommend.

Particularly when you consider that the UK average cost of a data breach is close to £2.87 million ($3.68 million) according to a recent report from the Ponemon Institute.

Azure Information Protection is a cloud-based data protection solution that keeps data safe through advanced encryption, identity, and authorisation policies.

But. 

Adopting AIP isn’t enough – you need to train your staff on how to use it properly. Newly accepted regulations like the EU General Data Protection Regulation (GDPR), combined with concerns about what awaits the UK in terms of free data flow after Brexit, make data security an important aspect to every company, so it makes sense to invest into Azure Information Protection staff training.

Ensuring Your Employees Are ‘On Board’

Change is something many employees are not fond of, so getting them on board with Azure Information Protection Staff Training is the first thing to do before you begin with implementation and actual training.

When your employees are educated on GDPR and data breach consequences, they will become more engaged in Azure Information Protection staff training. Not being compliant and risking a breach could cost them their job because many businesses that suffer a major data breach never recover. 

But, how do you do hold Azure Information Protection Staff Training?

Step #1 Educate on the Risks

Start by making your staff aware of the dangers of security breaches and just how little it takes for one to occur if data protection is lacking.

Step #2 Explain Their Role in Compliance & Data Protection 

Many employees are not aware of just how important they actually are in keeping data safe. Start by explaining their role in the company security and compliance. Explain that whenever they send data – be it email or access to a folder – to somebody inside or outside of the company, it can be a security risk. The risk here is that often there are no resources that would monitor or restrict misuse of that shared data.

The most recent statistics included in IBM’s Cost of a Data Breach Report show that a staggering 27% of all data breaches that happened was caused by a human error – in other words, employee negligence was the cause.

Think about the following scenario: You are sending sensitive financial data to an outside partner. The partner is negligent and sends this confidential data to parties that should not have access to it. This constitutes a data breach.

A data breach has serious consequences far beyond actual financial costs including:

  • Hacking
  • Downtime
  • Loss of customers
  • Loss of personally identifiable information (PII) from customers and employees
  • Loss of intellectual property
  • Loss of financial information
  • Breach of data protection laws
  • Legal fines and claims
  • Reputation damage

Step #3 Show Why Azure Information Protection is the Solution 

Proper training will help reduce the risk of a data breach as a result of human error. Before you fully implement AIP, ensure your staff become familiar with all the features and that each department knows how to utilise its full potential. 

Explain how Azure Information Protection works and how, when integrated, in the organisation it can help on an operational level. 

Step #4 Show off Features They Can Use

During Azure Information Protection staff training, the focus should be on providing specific and detailed guidelines to each department. Present all the important features that AIP offers:

  • You Can Classify Your Data – AIP helps classify and label data based on how sensitive it is through a system of labels that automatically protect it once applied.
  • 24/7 Protection – Once you classify data and protect it, it stays protected. AIP follows data and ensures it’s protected even when shared outside of your organisation or stored on an external device.
  • Track Data and Revoke Access  – AIP helps you track what is happening to data you have shared, and in case it’s needed, you can easily revoke access.
  • Log and Report Support Compliance – Get access to powerful features that help analyse and monitor usage of data. The reporting feature helps maintain compliance with rules and regulations.
  • Safe Collaboration – Thanks to labeling and classification, you have complete control over who has access to data and how they can interact with it.
  • Microsoft Office Integration – AIP is integrated into MS Office so you can secure any document with a single click as well as automatically in the background. 
  • Easy to Manage and Deploy – AIP works in the cloud and on-site equipment too.

Step #5 Make it Specific

Once done, provide each department with detailed guidelines and best practices for using AIP specifically for them. For example, teach your finance department staff on how to use AIP features like the Do Not Forward Button or Sensitivity Bar, or your marketing department on how to apply AIP labels and send data to external partners.

If you want to make your AIP staff training easier, we’ve created an Azure Information Protection Staff Training Course on The TowerWatch Academy.

Posted on by

How Azure Information Protection Can Be Used in GDPR Email Compliance

Today, businesses make data-driven decisions in order to have a competitive edge. If your business deals with personal data from customers, it is required to be compliant with EU’s General Data Protection Regulation (GDPR) requirements – this means disclosing how it handles data and ensuring that data remains safe.

Everything You Need To Know About GDPR & How It Will Affect Your Business

Why You Should Use Azure Information Protection for GDPR Emails

Sending sensitive data internally or to recipients outside your company carries a certain risk. Every email you send could lead to a disclosure of sensitive data, which constitutes a breach of GDPR. Therefore, investing in the protection of emails and files that are sent is crucial.

Azure Information Protection help keep your emails safe through advanced encryption and protects data at a file level with any attachments you might share too.

It’s a great solution that we recommend to our clients and one we can deploy seamlessly.

How to Install Microsoft’s Azure Information Protection for Small Businesses

While GDPR email compliance may seem like just another regulatory hassle, it is actually an opportunity to invest into your company’s digital security. The most recent data from the Ponemon Institute shows that the global cost of a data breach is increasing steadily, and in 2018, it has reached $3.86 million.

If that’s not enough to convince you, why not use IBM’s data breach cost calculator and see what yours could actually cost.

The Latest Data Breach Report Shows a Troubling Trend

A data breach carries serious consequences, and every business operation will suffer – financial, sales, marketing, safety, you name it. The 2018 Cost of a Data Breach Study states there are three main causes of a data breach, with percentages of attack globally being:

  • Malicious or criminal attack – the main reason for 48% of all breaches
  • System malfunction– the cause of 25% of all breaches
  • Human error – the cause of 27% of all breaches

The report shows that human error was the reason behind a data breach more often than a system malfunction was, while malicious and criminal attack took first place.

Note: It’s important to state that human error only includes insiders who were careless, while malicious attacks also include insiders, third parties, and contractors who caused a data breach intentionally.

In the UK specifically, malicious and criminal attacks were the reason of 50% of all breaches, human error was behind 26%, with system glitch causing only 24% of all data breaches.

This means as high as:

 76% of all GDPR breaches in the UK can be caused by either negligence or malicious intent.

Which can be vastly reduced when using a file or email encryption like Azure’s Information Protection

The True Cost of a Data Breach to Your Business

How AIP for GDPR Emails Keeps You Compliant

Azure Information Protection (AIP) is a cloud-based service that allows you to protect any sensitive and confidential data through encryption. You can protect local data you keep on your devices or data that you store in the cloud. When you send that data outside of your company, the encryption remains in place because it’s active at a file-level.

This means that even if you’re compromised, documents that are recovered cannot be read or unencrypted. Plus, intercepted emails cannot be read unless the intended user verifies themselves.

Ultimately, AIP can’t stop your users from making a mistake, but it can support them and arm them with the tools to protect company data properly.

Azure Information Protection Protects Against Malicious Intent

For example, if one of your employees or third-party recipients wants to email a file to an unauthorised person, they won’t be able to do so. Plus, AIP has a great feature called Do Not Forward for GDPR compliant emails. When this option is used, the recipient must first be authenticated to even view the email, and this is all they can do. They can’t forward the email or print, or screenshot. This ensures the email is for their eyes only and that they cannot execute a data breach by forwarding onto non-approved users that would lead to GDPR violation.

Documents attached to these emails are also counted as DO NOT FORWARD and will have the same restrictions.

Azure Information Protection Activity

Not only does AIP limit who can view the data, but it also tracks how that data is being used. By doing so, it ensures that data is safe at all times and that GDPR compliance standards are met. Plus, if you suspect there’s a risk that the data could be used in a way that violates GDPR regulations, you can even revoke access to it.

There are a range of other uses for Azure Information Protection to help keep your company emails and files protected. If you need help learning the reigns or want to deploy Azure Information Protection Yourselves, get started today by clicking here.

Posted on by

Why You Need a Managed Service Provider in Hospitality

With most industries actively embracing digitalisation, the need for having IT staff is more prevalent than ever before. Still, not everyone has the required means or knowledge to set up and manage their IT infrastructure in-house, or enough time to research the best options for their specific needs to keep up with innovation.

The hospitality industry is no exception. Many don’t realise the reliance on technology within the hospitality industry, but with booking and ordering systems, restaurant wi-fi and networks and cloud storage for venues with limited space (just to name a few) it’s more important than ever to stay on top of it.

Plus, hospitality means people. And with the GDPR regulations and the emphasis of increasing data protection from customers, you need to protect your business and technology.

Unfortunately, IT support often doesn’t follow suit here, with security threats and potential problems becoming more prevalent issues within the industry. While established players often have a dedicated in-house IT staff to manage all their needs, not all have the means to do so, and some don’t have the technical expertise to deal with this challenging industry. This is where managed service providers come in.  

What Is a Managed Service Provider (MSP)? 

A managed service provider (MSP) is a company that specialises in the management of IT infrastructure and systems for their customers. This management can either be remote or done at the customer’s office. Most often, it is offered as a continuous service for a set monthly fee.

It is different from traditional IT support because it not only covers reactive maintenance, i.e. maintenance when something goes wrong, but also proactive services and system monitoring, as well as cybersecurity, IT consulting, and upgrades. It is a flexible service that adjusts to the needs of each client instead of offering a one-size-fits-all solution.

For example, if a hotel already has good booking solution that can easily handle peak times during holiday season, they will not need infrastructure maintenance, but they might require additional services with their staffing software. A good MSP will adjust to meet these needs.

What Does a Managed Service Provider Do? 

Managed Service Providers cover a broad range of IT support – from infrastructure maintenance to incorporating automation, handling security and compliance matters, or migrating to a new platform. The range of services differs between industries – and even in the same industry – and depends heavily on the needs of each client. An MSP will always provide a fully customisable solution and can do the following:

  • Automate routine tasks
  • Provide maintenance for your entire technological stack
  • Monitor IT infrastructure to ensure all systems perform optimally
  • Develop technological strategies to address current issues
  • Do preventative maintenance to detect loss of efficiency and catch issues early on
  • Implement new technological solutions that scale with your business
  • Future-proof IT systems by upgrading legacy software
  • Apply system and software upgrades and patches to ensure system and data safety
  • Deliver responsive support so that any major IT crisis is resolved quickly
  • Handle data storage and disaster recovery

A managed service provider helps you focus on your business while taking care of your IT systems. They are more than just IT professionals – they align with your goals and ensure your IT capabilities don’t hold you down on your journey to reach them.

Why You Should Work with an MSP 

Employing a managed service provider helps businesses stay on top of the latest technologies and security requirements. MSPs help by identifying flaws in IT systems, operations, or infrastructure and working out the best solutions to improve overall business efficiency in a cost-effective way.

For example, a restaurant needs to sell more seats, not always have the latest fancy equipment, so an MSP will help identify the best option within budgets to suit the individual needs of the client.

They allow businesses to quickly implement new technological solutions and adapt to rapidly changing business environments (particularly when there is a change in legislation.)

They work with their clients to achieve the ultimate goal: ensure the best guest experiences and cultivate guest loyalty.

Here’s some of the ways they do this:

  1. You Get Access to Fully Customisable Solutions – MSPs offer cloud-based infrastructure solutions meaning if you open (or close) a new location, your solutions can be upgraded or downgraded easily to match!
  2. They Improve Your Efficiency and Give You a Competitive Advantage – MSPs have the resources to immediately begin working on specifically tailored solutions that are then deployed and integrated with your existing systems. This process is much faster than it would take to do the research, development, and implementation in-house from scratch. For example, if you wish to update your data storage and improve security systems to keep all guest and consumer data safe, an MSP will do that for you.
  3. They Help You Plan Ahead and Predict Expenses – They help determine peaks in your traffic and help you prepare for it by adjusting your infrastructure to withstand the higher demand. For instance, if you have peak reservations and stays during holidays, your MSP will ensure that your network can carry the increased visitor load and handle billing efficiently.
  4. They Lower Your Business Costs – Instead of using a one-size-fits-all solution that has elements you will never need, you will only pay for services you use and nothing more. In addition to this, they eliminate the costs of hiring, training, and retaining in-house IT staff or hiring emergency or temporary staff only to fix or update your systems. Plus, because they are often on a contract, you get a better rate than if you were to hire an ad hoc IT consultancy firm.
  5. They Eliminate Issues Quickly – Because MSP resolve issues daily, there are a few unknowns left. When your business has an IT issue, they will be able to solve it quickly as opposed to an in-house IT employee who might have never had to deal with that specific issue.
  6. They Help You Focus on Your Business – All businesses have limited resources and focus available, hiring an MSP helps you focus your attention to where it’s really needed – your core business. Leave the IT decisions to them.
  7. They Handle Risk and Compliance for You – Shifting markets and financial conditions make every business decision a risk. MSPs have the required expertise and industry knowledge to choose the best possible strategy. In addition to this, they can help you remain compliant under technological and data protection legislation. .  
  8. They Keep Your Systems and Data Secure – A good MSP will ensure your systems are fully secure and up to date on security patches. They will handle PCI compliance standards for online payments and reservations, ensure your firewall is active, and your guests’ data and sensitive information are safe.

Who A Managed Service Provider Would Suit Specifically 

Managed services are used through a broad range of industries but are particularly effective in the following:

Hospitality Industry

Hotels, resorts, restaurants, and bars have embraced digitalisation and are striving to offer the best online and in-house experience to their guests, from the initial landing page all the way to booking, reservations, and payment options on the day.

The key challenge to success in the hospitality industry is providing the perfect customer experience. And innovative technology helps you get there.

A growing number of hotels and other key players have migrated to cloud software to improve their business operations and get access to data analysis capabilities to detect trends and potential customers. On top of this, in restaurants or hotels where you can’t have large equipment or server racks, it’s an effective space saver too.

Because the hospitality industry handles vast amounts of sensitive guest and customer data, they require the right security solutions and must ensure they are compliant with government regulations (like GDPR.)  Financial transactions play a big role, so having safe IT security is the prime objective.

Smaller hospitality establishments often don’t have fully equipped IT teams available, so complementing their existing team or relying on managed services for all their IT needs improves their IT security and quality, gives them access to newest software, and helps them compete with big players.

Small Business Owners and Start-Ups

Small and medium businesses, as well as start-ups, often struggle with keeping up to date on newest IT solutions. It takes a lot of time and money to keep their IT professionals on top of the newest trends and solutions which are often things that a startup doesn’t have.  

Managed Service Providers help SMBs and start-ups with a full suite of IT services that are customised to their needs, goals, and preferences. This brings down overall costs and distributes them evenly throughout the year thanks to fixed monthly fees. Plus, business owners and start-ups get access to the latest tech and software solutions, as well as security options.

Companies With Unfavourable Opening Times

Any company working 24/7 knows that IT costs can run high because you have to hire a team to rotate so you have someone on site. Telephone support only goes so far and hiring emergency IT professionals when something goes wrong can be difficult and costly to fix if they don’t know your business or setup.

Employing an MSP gives them access to IT monitoring and support around the clock, which eliminates overtime pay or shift costs for internal IT staff. MSPs can complement and manage on-site  IT staff as a standalone solution.

Things To Look For In A Managed Service Provider

A good managed service provider will have the required industry knowledge, qualifications, and certifications to back up their expertise. When choosing an MSP, look out for the following:

  1. Qualifications and Certifications – The MSP of your choosing should be up to date on industry-specific knowledge and have experience working in your field. For example, those working in the hospitality industry should look for an MSP who provides cybersecurity solutions that are compliant with GDPR (if you or your customers are in Europe.) Ensure that the IT professionals who handle your infrastructure have the required certifications, but also experience working with your frameworks.
  2. Partnerships – For example, an MSP who is a senior Microsoft partner will suggest they have the knowledge, expertise and vetting of Microsoft to work with their systems. Meaning you have peace of mind that they know what they’re doing.
  3. Pricing, Range of Services, and Customisation – Depending on your needs, you will be able to choose what services you need and which ones you don’t. The right MSP will be flexible and understand your specific needs. They will listen to your goals and get to know your business before offering their services. The pricing options should reflect the services that you will use, and those that you won’t should be excluded from the price. Most commonly, you will be offered a monthly retainer based on the service and level of support that you need.
  4. Service Level Agreements – A good MSP will offer a service level agreement (SLA) that determines all the details, such as quality and performance metrics that should be met, details about liability in case of performance issues or outages, a list of services and responsibilities offered by the MSP, and a framework to resolve service issues.
  5. Availability – Always choose an MSP who provides flexible assistance that includes remote monitoring and emergency support. If possible, opt for one with a local presence so that their professionals can visit your office if needed.

If you’re looking for a managed service provider in hospitality, Contact us HERE today.

Posted on by

The Different Tactics Hackers Use to Gain Access to Your Computer

We’d all like to think that hackers are spending weeks on end planning their every move to attack a business but the truth of it is nowhere near as exciting. Although this could happen to a big target, for most people it’s a lot more boring and they get ‘accidentally’ caught in the net as hackers looking to make a quick buck send out malware or ransomware hoping someone will fall into the trap.

That doesn’t mean the effects aren’t any less devastating!

So, to make sure you can protect yourself, let’s look at the various different tactics hackers use to try and steal your business’ data.

1. Relying on Human Error

We’re sorry to say that lack of education in businesses and human error by employees account for a large portion of breaches in our experience. For example, employees attempting to access internal systems from unsafe locations, using personal (infected) devices on the network, or clicking malicious links in an email. Hackers cast their net far and wide, and the likelihood is someone will click something and open the door. And that’s all they need. 

Hackers also pray on the lack of oversight from business owners on their employees. According to Keeper Securities’ State of Cybersecurity in Small & Medium-Sized Businesses (SMB) report from 2017, 59% of small businesses do not have insight into the types of passwords employees use. This means that although the company is liable for a breach, they aren’t enforcing or even aware of the security standards of the passwords in use. 

2. Phishing

Phishing is one of the most common tactics hackers use. This is usually in form of an email that is spoofed to look like it’s coming from another sender, like your bank, or ISP. It will urge you to act immediately or you might lose your account, money, or face infractions. 48% of hacks on companies last year found that phishing or social engineering were the result.

Here are the warning signs you need to look out for in a phishing email

12 Warning Signs Of A Phishing Email

3. Public/Free Wi-Fi

Public computers and Wi-Fi networks are notorious for being plagued with malicious software that “sniffs” for data packets while you are using them. You risk losing your account data as soon as you type in your password. 

4. Phone Calls

Surprisingly these still work and is still one of the tactics hackers use! Hackers have been known to ring you claiming to be your bank or an organisation you’re affiliated with and ask you to confirm details over the phone. For example, banking pins or passwords as well as talking to you about family data or information, like your mother’s maiden name to get the ‘security question’ answers or take a stab at your password. If you feel a phone call is suspicious, never hand over your data, simply tell them now isn’t a good time and hang up.

5. Weak Passwords

Lazy, generic and consequently weak passwords are the easiest way for hackers to get access to your accounts. Many small business owners admitted that, while they still have password strength policies, 68% do not enforce them. A generic or commonly used password like 12345, makes it easy for hackers to gain access to your email or computer.

Check out our article below on protecting your password from hackers:

How To Protect Your Email Password From Hackers

6. An Out-of-Date OS

While nobody likes how long OS updates take, they exist for a reason: to address flaws within the code that can potentially be exploited. Without regular updates, you enable easy access to hackers who are aware of the weak points.

7. Infected Attachments

It’s not just the links you should be wary of in an email. Masked to look like images or documents, they often carry viruses, malware, or spyware, like a keylogger that will install to your device and record your every keystroke to get your passwords that way.

8. Dodgy Devices

Be wary of those free devices being handed out to you as “freebies” in many cases, hackers can load malware or keystroke loggers on them so that when they are entered onto the computer they immediately infect it.

9. Pineapples – Spoofed Wi-Fi Points

A Wi-Fi pineapple is a fake Wi-Fi access point that has been purely set up to steal your data but it masks as public Wi-Fi. From the hacker’s point of view, they have multiple programs and software running to gain access but to the unsuspecting user, they just jump on as usual and voila, instant access to your data.

10. Unsuspecting Accessories

Your new smart lock, phone controlled thermostat, camera that is enabled to a network, card reader or any other online accessory all have access to your network. Hackers can use these as easy points of entry if they aren’t protected correctly to access your network and get to your data that way!

Unfortunately, we’ve only just scratched the surface of tactics hackers use to access your data and your files, and this is why we are firm advocators for using file protection as part of your cyber security strategy. That way, hackers can’t access the data from your files once you’ve been breached, therefore protecting the data stored within them.

To get automatic file and email encryption for small businesses using Microsoft’s Azure Information Protection, click the image below to get half off our course on udemy:

file and email encryption course image. click to take you to the course
Posted on by

How “At Risk” Small Businesses REALLY Are to Cyber Attacks

busy coffee shop as a small business

Running a small business comes with a very specific set of challenges, like having limited resources, and often cyber security falls to the bottom of the list. But, the cost of a data breach, no matter the size of your organisation can be huge and the bad PR or image alone could be crippling as small businesses have to rely on reputation! 

Why Would Anyone Target Small Businesses?

Many small business owners don’t understand why their company would be an appealing target for hackers. They are small, don’t have vast funds or sensitive secrets that anyone would care about. They believe they are not big enough to be a target, so they don’t invest as heavily in cyber security as larger businesses do.

Some hackers do not target small businesses specifically but try to infect as many devices as possible, and without protective measures, backups in place, or the education, small businesses can very quickly become victims too.

The most common type of tactic that casts a wide net are ransomware attacks and more recently, cyber-attacks are becoming more targeted and specific.

The top 3 reasons why small businesses are targeted specifically by hackers are:

  1. The lack of investment into security makes it too easy for those looking to make quick money by selling details. 
  2. Small businesses often work with larger enterprises and if they’re not careful can serve as a point of entry for a large data breach.
  3. A small business is more likely to meet the hacker’s demands, such as a ransom, to get their data back because without it, their business is at a standstill. 

Cyber-attacks against Small Businesses are on the Rise

According to Keeper Securities’ State of Cybersecurity in Small & Medium-Sized Businesses (SMB) report from 2017, attacks against small and medium business owners are on the rise. A staggering 61% of small businesses that were interviewed reported they were affected by a cyber-attack. The most common type of attack included phishing or social engineering, with web-based attacks and general malware following closely behind.

What Small Businesses Should do to be Safe from Cyber Crime

Change of stance is the most crucial thing.

If small business owners continue to believe they are not a good target to hackers and believe they don’t matter, they will continue to be vulnerable to cyber attacks. Small businesses should focus on the following areas:

  • New Technology and Software – Investing in the newest software solutions can give small businesses the edge that they need to catch breach attempts early. Machine learning can detect anomalies in network traffic or credit card fraud attempts so that small businesses don’t have to pay as much attention. 
  • Employee Education – Teaching employees about cyber security lowers the risk considerably. Get them on board about it and teach them about password policies, what makes a strong password, why password sharing is risky, and signs that indicate a possible breach. Check out the TowerWatch Academy for regular courses that you might need for educating staff and using protection software. 
  • Regular Updates and Patching – Ensure all your systems are up to date and patched regularly. New patches are applied to parts of code that could have been used as points of entry before the patch which is why you should always keep up to date. 
  • Use Encryption – Encryption is a precaution in case a data breach happens. If hackers get to your data, having it encrypted will render it useless to them. 
  • Physical Security – Have surveillance in place in areas where you keep your sensitive data to avoid malicious actions from the real world.
  • Two Factor Authentication – In case a cyber attack is successful in getting credentials to log in to your system(s), a two-factor authentication will stop them from getting further than trying to log in and will immediately alert you so you can lock it down and change your passwords. 

If you need any help or support protecting yourself as a small business from cyber security attacks, join our free Facebook community for IT support for your small business.

Posted on by

Get Free IT Support for Small Businesses

We’re constantly looking for ways to use our knowledge and expertise to help others get to grips with their IT. We are offering free IT support for small businesses, particularly with the increased emphasis being placed on cyber security for businesses big and small in the wake of GDPR.

With this in mind, we are offering free IT help and support for small businesses in our Facebook support community. If you’ve purchased a course from the TowerWatch Academy, you’ll already know about the support group, but we’ve decided to open it up to help others too.

As IT consultants and experts with over 10 years’ experience in:

  • Cyber security
  • Online data protection solutions
  • Cloud-based data storage
  • Cyber Security Training
  • Penetration Testing
  • Complete IT Support
  • Large Scale Projects
  • IT Health Checks
  • Local & Global Hosting: Microsoft Azure/Amazon AWS
  • Remote Backup Solutions
  • 365 Implementation
  • Hospitality IT support and project installation

We have an idea of the issues that plague the IT of small businesses. Budget (or lack of) being one of them!

So, if you can’t afford an IT team and need some help or advice for your business. Join our support community below and let us help you by answering any questions you may have.

Posted on by

Are Recruiters Liable for Data Breaches When Sending CVs Via Email?

The ongoing joke of the moment is the amount of unsolicited emails you’re receiving as a result of GDPR, “consent” and the regulations that became effective as of 25th May 2018. But, the new General Data Protection Regulation (GDPR) is a piece of EU legislation that has thrown forward infinite questions about specific processes, particularly those in the recruitment industry. Among these questions is: Are recruiters liable for data breaches when sending CVs via email?

After all, they hold a ton of personally identifiable information (PII) in the form of CVs, application forms and the submissions through their website. But, how much of this are recruiters responsible for and if you’re communicating via email, are you responsible for this data if there is a breach, even when you’ve gotten consent?

We’re looking at the facts from the ICO as well as our take on protecting PII sent via email to limit your chances of a breach.

Liability under GDPR

In short, recruiters are liable for any data breaches resulting from the sending of CVs via email, but to understand why, we must delve a little deeper.

Under GDPR, the data controller holds ultimate responsibility for all personal information collected by their organisation. The data controller must be highly trained to pre-empt and effectively address any potential breaches and it is down to the controller to ensure that the all held data is collected, processed, and stored properly.

The data controller is ultimately responsible for their organisation, but all individuals within it must act in compliance with GDPR. Under this legislation, anyone handling personal data is referred to as a data processor. A data processor acts on behalf of the data controller, and must adhere to the rules of GDPR.

In this instance, recruiters are the data processors when they are working with sensitive data, such as that contained within CVs.

Liability for Recruiters

Recruiters, as data processors, have accountability over the information they collect, handle, and send elsewhere. This includes CVs.

They need to ensure that the CVs and the data within them are:

#1 Sent only to the intended recipients

#2 Are used solely for a specific purpose

#3 Are removed correctly when no longer required.

A recruiter must know exactly where the CV is going and how it is being used by the recipient. This is because, under the rules of GDPR, any EU citizen has the right to erasure, otherwise known as the right to be forgotten. If such a request is received, the recruiter (and their organisation’s data controller) are duty bound to honour and complete the request.

But, if they aren’t keeping records or control of the transmissions of personal data they send, this task becomes more difficult, if not, impossible.

In order to protect themselves and their organisations, recruiters are likely to be encouraged to seek a disclaimer with each individual before they receive any of their personal data. The language of the disclaimer will vary between each organisation, but most will contain an acknowledgment that the individual will surrender some control of their data whilst it is being processed.

Note that whilst individuals may give their consent to allow the data processor and data controller access and processing of their personal information, they are still protected by GDPR and retain custodianship of their own data, including the right of erasure.

Tools such as Data Subject Access Requests (DSARs) provide individuals with the authority to obtain all of the data held about them by another individual or organisation. These are commonly used during employment-related disputes.

Whilst UK legislation dictates that any DSAR is fulfilled within 40 days of receipt, GDPR goes further. If a DSAR is not honoured, it could incur a fine of up to 4% of an organisation’s annual global turnover, or a fine of €20 million, whichever is greater. Although the maximum is unlikely to be enforced, except in extreme cases, the potential severity of punishment in response to breaches clearly demonstrates the importance placed on the rights of individuals to retain authority over their data. Plus, that’s not the only cost a business can incur in the event of a data breach.

What steps can recruiters take to protect themselves from GDPR-related penalties?

Now that we’ve explored GDPR legislation and potential penalties that can be incurred as a result of non-compliance, we’ll take a look at five steps recruiters specifically can take to prevent a breach and protect themselves.

  1. Encrypt emails and Attachments

In order to avert unauthorised access to CVs and other personal data, a simple and effective solution is to encrypt emails and attachments. Encryption prevents data from being intercepted with malicious intent, and it ensures that only the intended recipient has access.

Encryption is easily managed through settings within some existing email client, or via third-party specialist services such as My Protected Mail. For large organisations, or smaller companies that routinely deal with a bulk of highly-sensitive data, the third-party approach is encouraged.

It is also worthwhile to ensure that all data processors (and controllers) are trained in the optimal use of encryption. After all, there’s no point in having a tool if it is not being used correctly.

  1. Only send CVs to the intended recipient (and prevent forwarding)

When sending a CV by email, recruiters should select only the essential recipients. If the CV is not directly relevant to a recipient, it should not be sent to them. By keeping the pool of recipients as small as possible, it helps to prevent potential breaches.

It’s also worth clarifying, within the body of the email, that the CV should not be forwarded to any other recipient without the permission of the recruiter. Forwarding of attachments, particularly without the knowledge of the original sender, makes it almost impossible to track where the data has gone. Keep in mind that the individual to whom the CV belongs may make a right to erasure request at any time. Failure to keep track of their data can jeopardise an organisation’s ability to do this.

  1. Provide extra information in your disclaimer

Make it clear to candidates, and all other individuals, precisely how their data will be collected, processed, and removed. Transparency at this stage helps to prevent issues further down the line. Use your disclaimer to present all possible scenarios, and ensure that consent is obtained before a CV is collected.

  1. Keep sensitive data secure within internal systems

We’ve discussed the procedure for sending CVs to external recipients, but what about internal record-keeping? This is equally critical, and organisations must ensure that their internal systems are secure enough to manage and protect stored data.

  1. Ensure that third parties are also compliant

Before a recruiter sends any information to a third party, it is worthwhile to sign an agreement regarding their respective data responsibilities. An organisation must ensure that all third parties are also compliant with GDPR, and will honour any future erasure or DSAR requests. This helps to prevent any potential problems in the future.

In Summary

As we have seen, recruiters and their organisations do have a responsibility to protect all data sent electronically. Recruiters are liable for data breaches since as data processors, they act on behalf of their organisation’s data controller, and are bound by the rules of GDPR.

It is crucial, therefore, that they are trained and equipped with the resources to keep client data safe.

Posted on by

Are Invoicing Companies Leaving Small Businesses Vulnerable?

For the last 2 years, my main focus as a cyber security consultant was/is getting companies, mostly big companies, ready for GDPR. One pressing concern is the GDPR compliance of invoicing companies.

Maybe GDPR is a buzzword for some, but the logic behind it is great for both privacy and proper data security.

The privacy part is somewhat challenging because the definition of PII (personally identifiable information) and SPI (sensitive personal information) is well defined in GDPR and it is very wide by definition.

It COVERS EVERYONE.

From big companies to small companies, and even micro companies. You are obliged to do your maximum to protect PII and SPI.

Many companies have started the shift of changing their work methods and the way that B2C communication is done. For example, basic “client notifications” are now usually protected.

GDPR is first and foremost a methodology change, not a technological one. You change the way you work first and then which technological tools you use.

This change has already “hit” some industries but other industries are preferring to ignore it, for example I am a client of one the biggest online invoicing companies, along with many other small & medium business owners.

Invoices have PII and SPI in them – they have a lot of the info of my clients (their name & postcode), sometimes even the full address, proper identifiable information.

When I send an invoice to my clients I am sending PII and SPI.

Since the GDPR date, my colleagues and I have started to send invoices in a secure way. Is it more “work”? Yes. We are sending a PDF within an encrypted email, not a link, so that we can make sure that only the recipient gets it and not someone else.

As a client of one of the biggest online invoicing companies, I’m concerned about their GDPR compliance, and I have contacted them and asked very clearly,

“What are you going to do about GDPR? Which encryption method are you going to use and how are you going to guarantee that the PII and SPI that are being sent via your system is secure?”

And …

Nothing really.

I got some generic responses, some links to the privacy/GDPR policy, but no real answer.

Then after some more Q&A, I got a strange response,

“We are sending PII BY FUNCTION... so, nothing is really going to change” So I responded with,

“So? GDPR has no “BY FUNCTION” Exclusion” and, of course, since then, it’s been silence.

It seems, at least for that specific company that they are ignoring or excusing not being GDPR compliant by saying that their CORE FUNCTION, and I quote “BY FUNCTION” is … NOT GDPR compliant, I know its sounds crazy but that’s the reality.

So, let’s break it down a bit:

  1. I am using their online invoicing platform – they are my Data Processor
  2. I am storing sensitive client information on their system and I expect them to be GDPR compliant. Which I trust their feedback that it is (regarding the way the store and access information)
  3. But… when I send the invoice to my clients via their system – I am extracting PII and SPI from their system and sending it into the world with no security mechanism at all?!
  4. This specific online invoicing company is sending a link (like many others) – not even a password protected PDF is an option?

Bottom line, you as a user of the system have the option not to send a link, but download the PDF, secure it, and then send it yourself… but why isn’t the invoicing company doing it for you? Why are they putting YOU at risk?

Why? – I don’t know, I presume it’s because it’s easier to ignore the reality than to face it. It’s easier to put everything on your clients than to solve the core issue.

My professional recommendation to you is: Until online invoicing companies GDPR compliance become clear, protect yourself! Don’t send PII and SPI in a non-secure way.

Eli Migdal.

Posted on by

Why Your Emails Need to Be Compliant Under GDPR

Although emails are not specifically referenced in the GDPR, all data contained within them does come under its jurisdiction. To avoid the risk of a breach, as well as to conform to these regulations, it’s important to stay protected and send GDPR compliant emails. 

In this article, we’ll introduce you to points you should consider when sending GDPR compliant emails.

Safeguarding Personal Information

Personally identifiable information, or PII, is data that can be used—either on its own or in combination with other records—to determine an individual’s identity. It is best practice not to provide PII wherever possible, but to use anonymised data instead.

But, we know this isn’t always the case and sometimes you need to share data that could become identifiable, so it must be sent securely. Protected emails that contain PII should also not be allowed to be forwarded to unauthorised participants and you should ensure that any data you do send has been pre-authorised by the owner because consent is a key part of GDPR, which must be respected at all times.

Preventing Unauthorised Access to Data

A data breach places sensitive information at risk of exploitation by criminal activity or other unauthorised purposes. A data breach can be prevented by sending attachments securely, tracking the receipt of documentation, sending only essential information, and by double-checking that data recipients are authorised.

File level encryption is one of the best ways to do this (find out more about this in our previous article here) and there are simple ways to send protected emails without having to download special programs. Try using something like My Protected Mail for free and see how you can send and receive protected emails. 

If you do find that your organisation has experienced a data breach, you (or your company’s assigned data protection officer) are duty bound under GDPR to notify affected individuals within 72 hours of awareness of the breach. This provides the opportunity to take corrective measures and prevent further compromise of their information. Of course, your organisation has a responsibility to facilitate and support such action, whilst simultaneously commencing an investigation and completing internal and external reporting.

Protecting Your Brand’s Reputation

Personal data is important to every individual. When we entrust organisations with sensitive information, there is an expectation that this will be respected. Any breach or mismanagement of data reflects negatively on a brand.

That said, if a data-related incident does occur, it is best to be honest about the situation from the start. Not only does the GDPR explicitly require this, but taking swift action helps to protect your brand’s reputation. People understand that even highly secure structures can be compromised, and if your organisation responds quickly, this can help to mitigate the damage. Conversely, a delay or cover-up would be completely unacceptable.

Generating positive PR

If your organisation is shown to be consistently compliant with data protection laws—including GDPR—this gives a positive impression of your information safeguarding processes. It also demonstrates a wider sense of reliability and security and strengthens your brand’s reputation, encouraging potential customers and stakeholders to put their trust in you.

Consider getting help in making you compliant by using My Protected Mail, it works with your exisiting systems and doesn’t require setup or installation! To find out more, visit www.MyProtectedMail.com

Posted on by

5 Ways Your Emails Could Breach GDPR

There’s a lot of confusion in the air currently for small businesses surrounding GDPR!

So let us set the record straight when it comes to sending emails.

If you are sending emails with personally identifiable information (PII) (here’s the ICO’s guide on what actually counts as personal data.) you need to take adequate lengths to protect it.

It’s that simple.

So let’s look at some of the ways your emails could be putting your business at risk when the GDPR regulations come into effect on the 25th May 2018. 

Edit: for the answers to commonly asked GDPR email questions scroll to the bottom of this article. 

*This post may contain affiliate links* 

1. Failing to use BCC (Blind Carbon Copy)

When sending to multiple recipients, unless emailing internally, you’ll need to use the BCC function.

This means that any given recipient will only see their own email address, the sender’s, and any recipients in the carbon copy (CC) section. All other recipients are anonymized. 

Failure to do this means that the name and email address (both PII information) are shared with other recipients without their prior consent! This is a breach of GDPR regulations.

2. Sending Sensitive Data to the Wrong Recipient

So many people are getting in hot water for this one! Not only is the distribution of sensitive data to an unintended recipient contravening the consent element of the GDPR. It is also likely to have a detrimental effect on the trust held between two parties, which can devastate a working relationship.

And, the ICO aren’t allowing the human error defence!

With the likes of UK law firm WilmerHale unintentionally sending details of  whistleblowing investigations at PepsiCo to a Wall Street Journal reporter. The information came from the US Securities and Exchange Commission, as well as internal investigators. This mishandled data had the potential to cause significant damage to PepsiCo’s reputation, and its leak certainly did no favours for Wilmer et al.

Be careful, therefore, to double-check both the data being sent and the email addresses of recipients, to ensure that sensitive information does not fall into the wrong hands, or you could be in a world of trouble. 

3. Un-Protected/Encrypted Attachments

It’s essential to encrypt critical information when sending it by email. This prevents interception, either by malicious or accidental means, and ensures that sensitive data is delivered securely.

This also includes making sure that you retain control over how the personal information is used once you have sent it too, by making sure the recipient can’t just copy, forward or blast out the sensitive information after you’ve sent it. You do this by encrypting the file rather than your computer or email system itself (we’ve written a handy guide on disk vs file encryption for small businesses here.)




4. Preventing Opt-Outs/Automatic Opt-Ins

Under GDPR, people have the right to erasure, otherwise known as the right to be forgotten. If any recipient asks for their email address to be removed from a mailing list, you need to do it immediately. Also, if an individual requests that any data stored about them is deleted, you are legally bound to do so.

It’s also important to confirm active consent from the outset, you can no longer ask people to “opt-out” with an automatic opt-in box checked. As well as requesting manual entry of an individual’s email address, provide information about how their data will be stored, and ask them to check a box to confirm they understand and acknowledge this. 

5. Including PII Without Taking Precautions

This isn’t just related to encrypting your one email, be careful with chains, “reply all” and forwarding emails that may contain the original PII on to those without permission. If you add additional recipients to a discussion, perform a check of the email content beforehand, and remove PII if it is present.

Taking the proper precautions beforehand ensures that your business is safe from fines but also that you are taking the responsibility of your clients or customer’s data.

Data Breach Report Blueprint & Template

CLICK HERE TO GET THE TEMPLATE

Common GDPR Email Questions Answered:

We’ve been contacted with many GDPR email related questions so we thought we would share for you the most common ones:

Is sharing an email address a breach of GDPR?

This depends on two things:

Firstly, Is the email a personal one, like your personal Gmail? If no, does your company email address have your full name? e.g. [email protected]? If you’ve answered no, then it’s not a GDPR breach. If yes, answer then next question.

Do they (you) have permission or reasonable reasons to share your email. For example, to perform a service you’ve signed up to where sharing your email address is absolutely necessary? Have you given express consent and forgotten about it?

If someone has shared your email and is now marketing to you without your consent, it IS a GDPR breach and you can respond to them asking for an erasure request (request to get your data deleted).

When is my business allowed to share email addresses?

The short answer is that you’re not. Unless you get express permission from the customer (not automatically opting them in.) The only time you are allowed to share emails is when it is vital to the service you are providing. For example, sending email addresses to a courier for confirmation of delivery.

But even then, you must ensure that any third parties do not market or contact those personal addresses outside of the business need they are providing! Or you could also be liable.

When forwarding emails what do I need to consider with GDPR?

You should always air on the side of caution when forwarding private or sensitive information, even internally. Ask yourself, does the recipient need to see this information or should I remove sensitive PII from the email before I forward? And don’t forget to remove personal email addresses in the replies if they are not needed.

Can I use BCC and be GDPR compliant?

Yes, if you’re sending a mass email, BCC makes sure no-one else sees each other’s emails and therefore reduces the risk of a breach. Of course, if this happens regularly there is more chance of human error being made so it’s always best to use a mailing program.

Are you being GDPR compliant in your marketing? Check out this article on that HERE.

My employer shared my personal email address in the company. Is this a GDPR breach?

It can be. But the likelihood is, it’s more of a privacy issue that you should first discuss with HR. Internal company communications, particularly if you’ve provided your private email to be contacted on is a GDPR grey area and if you’re uncomfortable with this information being shared, you should first contact your HR or legal department to discuss.

I accidentally shared personal email addresses with our sporting group, is this a GDPR breach?

If your sporting (or any other social group) is classed as an organisation, rather than an informal group, then yes, it’s technically a GDPR breach. However, the practicality is that everyone who is part of that team or group has consented to being contacted and know the other members anyway.

If you’re concerned about your privacy, in that case, you should contact the head of the group and request them to use BCC in the future. If you were added to the list and didn’t give your permission, or know the group, then yes it’s a GDPR breach that you can report. But, again, this is a grey area.