sharondpex

[sharondpex]

Understanding Data Protection Laws - Building a Strong Foundation

Nowadays, organisations need to have robust security policies and practices to ensure data security breaches are effectively avoided. Solid data protection policies and practices can also keep regulatory investigations and potential lawsuits involving data security at bay.

In countries like Singapore, the International Association of Privacy Professionals (IAPP) offers the most sought-after, up-to-date, and encompassing global training and certification program for data protection and privacy. 

The Certified Information Privacy Professional (CIPP) also helps organisations the world over bolster compliance and risk mitigation practices. One of the globally acknowledged certification programs around information privacy is the CIPP Certification.

The CIPP Certification is also designed for the “go-to person for privacy regulations, frameworks, and laws in the organisation.” This audience can include more than security professionals with IT backgrounds. It can also involve people from the governance, legal, or management team.

An International Effort

Europe has taken the lead in data privacy and protection. The GDPR (General Data Protection Regulation) is imposing stiff fines on organisations for non-compliance such as the unlawful disclosure and processing of personal data. 

Building a Strong Foundation

Building a strong foundation starts with creating a great framework. A good framework that guarantees data protection and privacy for employees and clients should have the following components:

Overall Compliance Strategy

Many organisations don’t have an integrated, centralised, comprehensive, and measurable strategy for attaining data privacy compliance. Data privacy compliance is achieved when there is documentation defining measures and a high-level set of principles the organisation takes in terms of personal data. All areas of the organisation and all key stakeholders should be represented.

Compliance Subject Matter Experts (SMEs)

Training and assigning SMEs to be experts in specific regulations such as the GDPR is considered ideal. This strategy can help ensure only one source of expertise will develop legally compliant practices and policies. Dedicated SMEs can also be the drivers of all the documentation of compliance.

Inventory and Assessment of Personally Identifiable Information (PII) or Sensitive Personal Information (SPI)

When collected, personal data needs to be identified and tagged. Companies and organisations should also provide a method of tracking them. By using this strategy, organisations can ‌ protect ‌ personal ‌ ‌ data ‌ ‌ properly ‌ ‌ and ‌ in accordance with ‌ ‌ recommended ‌ legal ‌ ‌ ‌standards.

Establish Data Protection Procedures and Policies

Privacy compliant organisations provide robust administrative, technical, and physical safeguards to warrant integrity, availability, and confidentiality of data. This also covers the ability to prevent and detect inappropriate or unauthorised access to data. 

Information security should also be constantly monitored, assessed, and updated to counter new threats. In addition, there should be a strict set of policies and controls when it comes to data sharing.

Creating a Response Plan and Strategy

Despite strict adherence to compliance policies, no data protection system is perfect. Data breaches and cyberattacks will always try to outsmart even the best of systems. To mitigate the impact of an intrusion, an effective escalation process and data breach response plan should be created.

Employees that are responsible for any breach response must be properly trained on the escalation channels and the data breach response plan. Also, the corrective actions in the response plan has to be documented and implemented and treated as a proactive preventive measure against any repeat incident.

Guarantee Proof of Compliance

Knowing you are data privacy compliant and you have data protection practices in place won’t suffice. You have to also be ready to present conformance for internal or external inquiries. Compliance should also be readily accessible and clearly verifiable through documentation and reports.

[sharondpex]

A Guide to CIPP Certification

By owning a Certified Information Privacy Professional (CIPP) certification, practitioners put privacy laws and policies in action. With this certification, organizations are identified as having the best in compliance and risk avoidance procedures. Each professional that receives the CIPP certification has the knowledge and insights that are needed to be an elaborate part of privacy protection.

 What is CIPP Certification?

 The CIPP recognizes you as having a comprehensive understanding of all laws and policies related to both the public and private sectors. As a practitioner or as a whole organization, this certification gives a competitive advantage in obtaining a working partnership with the country's administration.

 To pass the test for this certification, you will need to be skilled on these topics:

 ●     Why the government agencies use privacy;

●     Government privacy laws;

●     Managing and organizing privacy programs;

●     Government privacy practices

 It also covers government auditing, records management, and department reporting standard practices as it coincides with some privacy laws.

 Who Should Consider CIPP Certification?

 First and foremost, all individuals who currently work for the city or local governments in data privacy will benefit greatly from getting this certificate. The CIPP certification is not just for government employees, though. It is also open to contractors, manufacturers, and consultants who work with government agencies, as the only publicly available privacy credential.

 Why You Should Consider CIPP

 The CIPP has become the gold standard in the privacy policy of a government, so anyone seeking a role in this sector is an ideal candidate. You'll be much more marketable after receiving this certification.

 For example, you'll have demonstrated a thorough understanding of principles-based structures around the concepts of privacy by getting this cert. In fact, employers are even using the CIPP as a guide for opportunities to employ and promote.

 CIPP  Requirements

 There are no specific criteria for registration with CIPP. In any case, you should have a clear understanding of data privacy and not just the government. It would be to your benefit to have real-world experience designing or operating privacy applications, but it is not mandatory.

Before you take the CIPP certification exam, you will need to study and prepare for it. The examination consists of 60 scored and 20 noon scored multiple-choice questions that are supposed to be used in later exams. The rule for this ranges from 100 to 500. You have to score a 300 to pass.

 It is likewise a good idea to take a course given by a well-established training company. The sessions will go over the fundamentals, but also put you in real-world circumstances as it relates to privacy. This course of training enables students to enhance their chances of passing.

 Experts have determined that about 30 hours of preparation time is adequate for this type of exam. Remember, there have been some variations in how the government considers data privacy. Confirm that this is covered in the class you prefer.

 Several training providers now also offer an Exam Pass Guarantee, which can surely make your investment in the course feel better. You should also consider your preferred method of learning. Some prefer the comfort online while others want to experience in the classroom. See a provider that offers a variety of platforms for learning, the learning material so that you are not in any way limited.

 After passing the exam, you will get two years of certification. You will need to take 20 hours of continuing privacy education (CPE) to retain it. Such hours can be received in different ways, either through the IAPP or through approved partners. These hours also help to keep your skills sharp, so you can quickly incorporate any new requirements into the privacy policy of government data.

[sharondpex]

How to Hire a PDPA Officer

The PDPA is a highly sophisticated set of requirements, and it is vital to ensure data security compliance. Knowledge of the implementation of data protection measures is extremely important for this process. A Personal Data Protection Act officer is a skilled professional who can be responsible for carrying on data protection strategies and approaches, in addition to the right implementation of protective measures.

 A PDPA officer assumes the leading role in supervising the implementation of the data security strategy. The major challenge is to ensure PDPA compliance by meeting all the requirements of the newly-imposed regulations.

 Do You Need a PDPA Officer?

 If you own a small business, you may not need to worry about hiring a PDPA officer. Although, it is still vital to have a look at what PDPA rules suggest. You cannot be excused for being unaware. The following are the important factors to determine if your company requires a Personal Data Protection Act Officer.

 Can I Assign the Role of PDPA Officer to an Existing Employee?

 Internal hiring of a PDPA officer is allowed, but you need to consider certain factors in mind before thinking about this choice. First, you need to ensure that the potential PDPA officer meets the mandatory criteria in terms of necessary qualifications and requirements. If you don’t have an existing employee capable of assuming the role of a PDPA officer, then it is better to just go for an external hire.

 The internal hiring of a PDPA officer without meeting the necessary requirements does not ensure legal protection. In the eyes of the law, such officers aren't legitimate to assume the role. In effect, your organization is still missing the privacy officer.

 The external personal data protection officer is a better option for many reasons. First, he/she is a certified expert and joins your organization to facilitate as a service provider. These experts ensure better performance and effective data protection measures.

 Cost

 When hiring an external PDPA officer, the cost is already predetermined on the contract agreement. The organization knows exactly what or how much it has to pay. Additionally, the external officer does not require training.

 In the case of hiring an internal PDPA officer, however, you will have to think about the training and education costs. You will also have to ensure the acquisition of literature, which you will have to pay for aside from the regular salary of that employee.

 In the long run, the lack of proper strategic implementation or mishandling are higher in the case of an internal officer. This could lead to a major PDPA violation and result in hefty fines.

 An external officer, being a well-qualified expert in this field, will minimize the risks of poor planning. You won't have to worry about the heavy penalties because the chances of violation are scarce when the officer is a better fit for the job.

 Liability

 This is arguably one of the most important factors when comparing internal and external data security officers.

 You can't underestimate the possibility of a data mishandling or the violation of any of the PDPA rules and regulations. Here, an organization needs to protect itself. In the case of an internally-hired PDPA officer, the manager is fully liable in the eyes of the law. The officer will only bear limited employee liability. You can't dismiss the internal officer.

However, there is less risk for the organization in the case of an external data protection officer. He/she bears the liability of giving recommendations, and the organization will have someone to blame. You can terminate the agreement or contract without any complications.

 Conclusion

 There are hefty fines against the violation of PDPA rules. It may not be a wise move to look for a cheap PDPA officer. It may save you some money for a short while, but you need to avoid those costly fines, and skimping now might end up getting you more expenses and more trouble later.

 Look for highly-professional and skilled PDPA officers, because it is not merely about the protection of online data. You have to ensure the protection of devices, reduce the risk of unauthorized access, and ensure foolproof security against unwanted access to servers. Upon hiring, let the PDPA officer become familiar with the organization’s policies and processes, and give him/her the needed space to produce good results.

[sharondpex]

Do You Need CIPT Certification?

With data breaches a frequent topic of today's headlines and the number of cyberattacks and data breaches on the rise, data privacy and protection has been on the minds of a lot of companies and organizations.

While the risk of sensitive personal data exposure is increasing, at the same time, regulations like IAPP are tightening up requirements for securing consumers' data. As organizations and companies look to build up their data-privacy systems and implement more secure data protection, they need qualified information security experts who have skills and expertise in this field. Certified Information Privacy Technologist (CIPT) certification is a credential that can help IS and IT practitioners to exercise their qualifications and advance in their field.

Who Benefits from CIPT Certification?

In this modern data-driven business world, data privacy issues have implications for about every aspect of the private sector, regardless of the services or products an organization offers. Privacy best practices apply to a wide spectrum of IT roles, not just data security — most especially in those industries that have to follow a range of laws and policies.

The CIPT certification program can greatly benefit those working in software development, engineering, IT audit and risk management areas, among others. If you are looking to want a higher earning potential or advance in your career, widely-recognized industry certification can set you apart from your colleagues and show your commitment to your profession.

The CIPT certification can also benefit employers who understand how critical data privacy is to their organization. Having a certified professional on board means your organization has an expert who understands the current best policies and practices and keeps up with the latest privacy laws and security threats.

CIPT Prerequisites

There are no specified experience requirements or other prerequisites for pursuing the CIPT certification exam. Nevertheless, the IAPP does say that its exams have a reputation for being extremely rigorous and it is not unusual for candidates to have to retake an exam even if they have other certifications.

CIPT vs. Other Privacy Certifications

Just like with any IT certifications, you have several choices for data privacy. IAPP has two more credentials for privacy professionals: Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional (CIPP). Here's a comparison:

CIPP: Designed for those who are given the responsibility for data privacy and protection, as well as legal matters, governance, compliance, and information management. The certification has "regional" versions, and the CIPP/E (Europe) has the most focus specific to GDPR compliance.

CIPT: Designed for practitioners who implement the practices and technical controls related to privacy. Of the three IAPP certifications, CIPT is considered the most entry-level

CIPM: This certification is best for those who manage information privacy programs. In addition to covering privacy law and regulations, it focuses on how to turn that knowledge into practice through policies and procedures.

Preparing for the CIPT

To obtain your certification, you have to pass an 85-question multiple-choice test, with two and a half hours given to finish. The test is done at the testing centre online. A passing mark depends on how many questions were answered correctly. Scores for all tests vary, but they are transmuted to a scale of 100 to 500, with a mark of 300 as the passing. After the exam, it could take up to two months to process.

CIPT Certification is for You

After reviewing the many factors of the CIPT certification, now you know what it is all about and for whom it's best suited. If you're ready to propel your data privacy career, then CIPT is the proper certification for you.

[sharondpex]

Holiday Season Cybersecurity Scams and How to Avoid Them

The holiday season has arrived, and cybercriminals are intensifying their operations in this period to monetize the exposure of shoppers to online fraud and scams.

It is quite easy in this period of the year to be victimized by criminals who take full advantage of the season by using thematic scams in online advertising, phishing emails, misleading sales calls, and text messages.

Scammers may send fake order confirmations to victims via email with malicious attachments or share links to phishing messages promising special discounts to users who provide their data through an online form specifically designed.

Law enforcement agencies and security firms are recommending caution to consumers while shopping online during the holiday season. They can be attacked by fraudsters by intercepting insecure transactions, targeting unpatched systems, creating cloned sites, and using scam emails to harvest their financial and personal information.

Which are the Most Common Holiday Scams?

The types of vacation scams are limited just by the imagination of the criminal. However, some patterns of fraud are well known, and in order to recognize them, it is vital to share information with clients.

Here are just some samples of holiday scams as outlined in the PDPA training:

●     Bogus shipping notifications Users tend to be more active online during the holidays.

●     In this period of the year, the number of gifts and products purchased online spikes, and people receive a lot more shipments.

●     Criminals are aware of this, and send

●     Phishing emails posing as notifications of shipment.

The fake shipping information may use a malicious attachment or have links to a phishing page intended to trick victims into providing their personal information (e.g., login credentials for a fake login page). The malicious attachments are armed Office documents that pretend to be details of the order.

Bogus Coupons and Gift Cards

Another popular scam involves sending fake coupons and gift cars to victims and tricking them into delivering personal and financial information. Lure emails might include links to downloaders of malware or redirect victims to phishing pages.

Charity Frauds

Charity fraud is about getting money from people who think they make donations to charities. Attackers send messages or make unsolicited phone calls to people, pose as members of a charity organization, and ask donors for contributions to non-existent charities.

During this period, high-pressure tactics are adopted by groups of criminals to trick victims into making immediate donations. Scammers send phishing emails with links pointing to websites of fake charity organizations. Other scenarios of attacks see the criminals calling and tricking the victims into providing financial data to make a donation. 

A list of signs that could be connected with a scam:

●     The organization does not provide proof of its tax-deductible status.

●     The organization declines to give clear details about its mission, identity, associated costs, or how the donations are used.

●     Users receive thanks for donations that you do not remember giving.

●     The organization uses a name that is substantially similar to a reputable, better-known organization.

●     The organization demands cash-only donations or a money wire.

●     The organization uses high-pressure schemes to urge recipients to donate quickly without giving you ample time to research.

●     Fake service listings and fake plane tickets bought online.

During the holiday season, the number of travel-related scams increases, from fake discounted flight ticket prices to fake advertisements for private residences and luxury villas for rent.

In the latter case, the criminals are offering properties that don't exist or are owned by people unaware that never offered them for rent. These properties are also available on popular platforms such as Airbnb; therefore, Airbnb prohibits hosts from asking users to pay them using anything other than the built-in payment page on the site. In some cases, scammers have been asking users to wire money not using the Airbnb platform.

Cybercriminals are also trying to monetize their efforts by offering discounted flight tickets purchased using stolen payment card details.

Recently, a law enforcement-led international operation to fight fraudulent online purchases of flight tickets has resulted in the arrest of 79 individuals as part of the Global Airline Action Days (GAAD).

According to the PDPA training manuals, the website may be suspicious if: there are only a few details and pictures of the online property or hotel reviews that are not favorable or do not exist at all. You are asked to pay in cash; by bank transfer, such as with MoneyWise or Western Union, or even virtual currencies such as Bitcoin.

[sharondpex]

Security Awareness & Training for Small Business

While the attacks on well-known companies are the headlines, the threat is just as worrying for small businesses. And the issue is made worse by many small business owners who do not believe they will be attacked, considering cybersecurity to be a lower priority than other business issues. In reality, they are seen as a soft target for cybercriminals and a more natural way to get to the more prominent destination of criminals: small business corporate clients.

The financial cost of disruption and damage to reputation, leading to the loss of the customer, can be as serious as it could threaten the existence of a business. This makes it even more remarkable that many have not made cybersecurity part of their everyday business operations.

However, even for those who understand its importance, protection is expensive — the recruitment of the right technical skills and the purchase of expensive training programs — and the whole subject is complex and hard to understand. Most will deploy basic tech tools like firewalls and antivirus programs, but they are not necessarily a good thing: the most common threat to small businesses is that their employees are targeted by attacks such as phishing, ransomware, watering holes, and drive-by downloads. And the best way to approach them is through data protection courses and regular awareness-raising and training activities.

Here are tips to keep your small business secure.

Appoint Awareness Champion

Find someone within a business who can take the lead in communicating awareness and delivering or coordinating basic training. They are just going to spend a few hours a week on it, too little time to fit their normal activities.

Using an insider also means that you know and trust them, they know your business, and they are already on the payroll and considered for in the business plan.

Make Use of Free Resources

There is a large number of free resources available, so look at those before you spend anything.

A few hours of reviewing what is out there is enough to compile a list of dos and don'ts that are most relevant to your business and to find the basis for awareness and training materials. It is time well spent, and it means you are not buying anything you do not need.

Local chambers run lunch-and-learn sessions, and webinars are available on YouTube, vendor, or government sites if you prefer to watch and listen.

Concentrate on the most common threats: password management, phishing, and other email-based scams, file and data sharing, remote work, and physical security (preventing theft devices and securely storing documents). If you can cover all of them, you are going to take care of the basics.

Organize Work-based Training

Another way to reduce time and cost is by organizing work-based awareness and training. Different roles possess different skill levels and will be exposed to different threats, so don't waste time telling employees what they already know or don't need to know.

Consider external help. If you still have gaps after you have exhausted the free resources and the capacity or capabilities of your awareness champion, think about outside guidance.

The term "consultant" often discards small business owners because it usually means expensive, but some government-supported agencies have good consultants, at a much lower cost-free rate, in some locations— than the private sector, so recognize that as a first option.

Otherwise, look at the suppliers who specialize in small businesses. Check the costs and references and the consultant's eyeball to make sure they fit your business well.

And do not forget: tech vendors will offer assistance, but only if you buy their products.

Use Online Training Tools

Online data protection courses are user-friendly, easy to access, and cheaper than employing trainers, especially when you have a few offices. They are also modular, so you may buy what you need and cater to different roles and skill levels.

Some products involve phishing simulators to expose employees to real-world examples without inviting real-world problems and learning scorecards and dashboards to make it easy to monitor progress at the individual, team, or organizational level. They are easy to configure and cover metrics such as planned and completed modules, score, pass rate, a number of retakes.

Awareness and training activities should include details of what staff needs to do in the event of an infringement. Your plans should outline how employees should report a breach or near-miss, the roles and responsibilities for recovery, and the arrangements for business continuity.

A business continuity plan is a well-established practice for larger enterprises, but often forgotten for smaller enterprises — now it's time to make sure yours is ready to use.

[sharondpex]

The Advantages of At-Your-Own-Pace Cybersecurity Training

With the dire need for cybersecurity training, such as PDPA training, in today's modern world, a new approach to this crucial method to control cyber-negligence and digital threats is on the rise. This approach is referred to as at-your-own-pace cybersecurity training.

What is At-Your-Own-Pace Cybersecurity Training?

This kind of cybersecurity training is differentiated from live online or in-person training scenarios in a few ways. First, the materials are provided directly — students choose their own pace of study and only move on to the next phase of the course after they are sure they know the current material.

Second, at-your-own-pace training typically doesn't include an actual teacher. Instead, it relies on exercises and quizzes that students are expected to take themselves. Hence, students using this method need to feel confident enough to grasp and understand the material that they won't have to ask for an instructor's assistance.

Third, at-your-own-pace training doesn't have a fixed time limit. The students can work on the material for 15 minutes one day, 3 hours the next, and 30 minutes the next, and take the quizzes only after they are sure they have fully understood the concepts.

Advantages of At-Your-Own-Pace Training

Flexibility

Traditional cybersecurity training, like PDPA training, is generally conducted either during the employee's workdays (sometimes during their lunch break) or in their free time. Whichever way you slice it, this costs the employee. They would have to either reduce the time they have to work on their normal workday tasks or use some of their spare time to accommodate the training course.

Another point of flexibility this kind of training offers is the flexibility of where the training takes place. At-your-own-pace cybersecurity training is done remotely, which means that employees can take their training course anywhere that has a stable Internet connection. This convenience is hard to quantify but easy to appreciate.

Better Retention

Student needs are much better addressed with at-your-own-pace training. The most important way student needs are better addressed is through the increased learning retention associated with the at-your-own-pace approach. Since the effectiveness of cybersecurity training affects the information security environment of organizations, it is important that learning is as complete as possible.

Next, not all people learn at the same pace. Letting employees set the time they take to learn the material will make the training more complete and effective. Since organizations and companies rely on cybersecurity training as one of their most reliable methods of teaching this knowledge and skills to employees, the effectiveness of the cybersecurity training should be given heavier importance than the traditional training methods affords. After all, ineffective training is of no good value to the company.

Improves Learning Ownership

The nature of at-your-own-pace training is that it firmly places the onus of learning on the learner. Those pursuing this method of training need to have a more internal motivation to learn and understand the material, including an increased demand on time management, than the traditional classroom student. This leads to more ownership of the material learned, which will then lead to a better likelihood that the knowledge learned will become the knowledge applied.

Conclusion

Cybersecurity training is, indeed, a very critical part of doing business in today’s modern world. On the other hand, not all approaches to cybersecurity training are similar. At-your-own-pace cybersecurity training offers companies and organizations the reduced cost and staff the enhanced flexibility that they are searching for, even if they do not know it yet. Consider maneuvering your company to the at-your-own-pace cybersecurity training process and gain the advantages that it has to offer.