Data Driven Cyber Security

According to the UK data protection legislation, each controller and each processor must implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks arising from the processing of personal data. In the rapidly advancing digital landscape where cyber security has become increasingly complex, ensuring the security of data is crucial for data controllers and processors. It is important for data controllers and data processors to acknowledge and address new arising risks in order to comply with the data protection regulations in light of cyber security.

The UK National Cyber Security Center (“NCSC”) highlights the usefulness of a data-driven approach in addressing this challenge[1]. Data-driven cybersecurity (“DDC”) is an approach to cybersecurity that uses scientific method and data analysis to make evidence-based decisions. It involves leveraging high-quality data to generate actionable insights that can help organizations to better understand their cybersecurity posture and make informed decisions. By using big data to analyse cybersecurity practices, data-driven cybersecurity seeks to improve outcomes, transparency, and trust. DDC can be implemented in different ways based on an organization's priorities, resources, and risks.

To facilitate the DDC journey, NCSC has developed a maturity model that helps organizations assess their level of data-driven cybersecurity maturity. It can be used to:

• assess the current level of DDC maturity in an organisation ('As is')
• decide what level of maturity will be required in future ('To be')
• determine which steps could be taken to reach the desired maturity level (‘Gap analysis’)

This model takes into account various factors such as communication, people, security and compliance, platform and data processing tools, integration, and data structure. By asking key questions related to these pillars, organizations can identify gaps and take steps to improve their cybersecurity posture.

• Can you list all your assets (like devices) and report on their status?
• Can you list all your RDP ports? Can you see which ones are open?
• Can you show a diagram of the segmentation of your network? If part of it was affected by ransomware, would you be confident the other parts would be unaffected? Could you check to be sure?
• If you were told there was a specific vulnerability on at least one device on your network, would you be able to identify it from the versions of software products on each device?
• Do you know which vulnerabilities your organisation has, how widespread they are, and on which devices?
• Do you receive threat intelligence? How do you determine if it is relevant to your organisation? Can you quickly determine how many (and which) of your devices and networks are affected?
• Is your cyber security data analysis posture sustainable? Do you have skilled staff working on it? Can you maintain the team?

[1] https://www.ncsc.gov.uk/blog-post/data-driven-cyber-transforming-cyber-security-through-an-evidence-based-approach

Tagged with: Kavlak Law Firm, Ayşe Aybüke Çilingir, Özge Keskin, Data Protection & Privacy, Cyber Security