As you may already know, Data Privacy Day, also known in Europe as Data Protection Day, is globally recognized each year on January 28th. Some have now even extended this to a weeklong celebration. The event's purpose is to raise awareness and promote privacy and data protection best practices. 

VMblog has spoken with experts from a number of companies, and they had a lot to say about this very timely and important topic.

--

Aron Brand, CTO of CTERA

"2022 has brought about a quantum leap in the capabilities of generative AI algorithms, with the ability to create media such as images, videos, and text that are easily passable for real. This technology has the potential to revolutionize industries and change the way we consume media.
 
However, it also brings about powerful concerns surrounding the ability of these models to generate fake voice, images, and footage. As we move forward, it's important to consider the privacy implications of this technology and work towards solutions to prevent its abuse. This may include government regulations, industry standards, and the development of technology to detect and remove fake content. It's also important to educate the public about the potential privacy dangers of deepfakes and other forms of generated content."

++

Carl D'Halluin, CTO, Datadobi

"A staggering amount of unstructured data has been and continues to be created. In response, a variety of innovative new tools and techniques have been developed so that IT professionals can better get their arms around it. Savvy IT professionals know that effective and efficient management of unstructured data is critical in order to maximize revenue potential, control costs, and minimize risk across today's heterogeneous, hybrid-cloud environments. However, savvy IT professionals also know this can be easier said than done, without the right unstructured data management solution(s) in place. And, on Data Privacy Day we are reminded that data privacy is among the many business-critical objectives being faced by those trying to rein-in their unstructured data. 

The ideal unstructured data management platform is one that enables companies to assess, organize, and act on their data, regardless of the platform or cloud environment in which it is being stored. From the second it is installed, users should be able to garner insights into their unstructured data. From there, users should be able to quickly and easily organize the data in a way that makes sense and to enable them to achieve their highest priorities, whether it is controlling costs, CO2, or risk - or ensuring end-to-end data privacy."

++

​​Don Boxley, CEO and Co-Founder, DH2i

"The perpetual concern around data privacy and protection has led to an abundance of new and increasingly stringent regulations around the world. According to the United Nations Conference on Trade and Development (UNCTAD), 71% of countries now have data protection and privacy legislation, with another 9% having draft legislation. 

This increased scrutiny makes perfect sense. Data is being created and flowing not just from our business endeavors, but countless personal interactions we make every day - whether we are hosting an online conference, making an online purchase, or using a third party for ride-hailing, food delivery, or package transport. 

Today, as organizations endeavor to protect data - their own as well as their customers' - many still face the hurdle of trying to do so with outdated technology that was simply not designed for the way we work and live today. Most notably, many organizations are relying on virtual private networks (VPNs) for network access and security. Unfortunately, both external and internal bad actors are now exploiting VPN's inherent vulnerabilities. However, there is light at the end of the tunnel. Forward looking IT organizations have discovered the answer to the VPN dilemma. It is an innovative and highly reliable approach to networking connectivity - the Software Defined Perimeter (SDP). This approach enables organizations to build a secure software-defined perimeter and use Zero Trust Network Access (ZTNA) tunnels to seamlessly connect all applications, servers, IoT devices, and users behind any symmetric network address translation (NAT) to any full cone NAT: without having to reconfigure networks or set up complicated and problematic VPNs. With SDP, organizations can ensure safe, fast and easy network and data access; while ensuring they adhere to internal governance and external regulations compliance mandates."

++

Steve Santamaria, CEO, Folio Photonics

"It is no secret that data is at the center of everything you do. Whether you are a business, a nonprofit, an educational institution, a government agency, or the military, it is vital to your everyday operations. It is therefore critical that the appropriate person(s) in your organization have access to the data they need anytime, anywhere, and under any conditions. However, it is of the equal importance that you keep it from falling in the wrong hands. 

Therefore, when managing current and archival data, a top concern must be data security and durability, not just today but for decades upon decades into the future. The ideal data storage solution must offer encryption and WORM (write-once, read-many) capabilities. It must require little power and minimal climate control. It should be impervious to EMPs, salt water, high temps, and altitudes. And, all archive solutions must have 100+ years of media life and be infinitely backward compatible, while still delivering a competitive TCO. But most importantly, the data storage must have the ability to be air-gapped as this is truly the only way to prevent unauthorized digital access."

++

Surya Varanasi, CTO, Nexsan

"Digital technology has revolutionized virtually every aspect of our lives. Work, education, shopping, entertainment, and travel are just a handful of the areas that have been transformed. Consequently, today, our data is like gravity - it's everywhere. 

On Data Privacy Day, we are reminded of this fact, and the need to ensure our data's safety and security. Fortunately, there are laws and regulations that help to take some of the burden off of our shoulders; such as the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and Health Insurance Portability and Accountability Act (HIPAA).

However, some of the responsibility remains on our shoulders as well as those of the data management professionals we rely upon. Today, it would be extremely challenging to find an organization (or an individual for that matter) that isn't backing up their data. Unfortunately however, today that just isn't enough. Cyber criminals have become increasingly aggressive and sophisticated, along with their ransomware and other malware. And now, the threat isn't just that they will hold your data until payment, cyber criminals are now threatening to make personal and confidential data public, if not paid. It is therefore critical that cyber hygiene must include protecting backed up data by making it immutable and by eliminating any way that data can be deleted or corrupted. 

This can be accomplished with an advanced Unbreakable Backup solution, which creates an immutable, object-locked format, and then takes it a step further by storing the admin keys in another location entirely for added protection. With an Unbreakable Backup solution that encompasses these capabilities, users can ease their worry about the protection and privacy of their data, and instead focus their expertise on activities that more directly impact the organization's bottom-line objectives."

++

Andrew Russell, Chief Revenue Officer, Nyriad

"Data Privacy Day serves as a great reminder of the value and power of data. In addition to your people, data is without question the most strategic asset of virtually any organization. Data and the ability to fully leverage, manage, store, share, and protect it, enables organizations to be successful across virtually every facet - from competitive advantage, to innovation, the employee experience, and customer satisfaction, to legal and regulations compliance competency. 

Consequently, savvy data management professionals recognize that while a storage solution that is able to deliver unprecedented performance, resiliency, and efficiency with a low total cost of ownership is priority number one to fully optimize data and intelligence for business success; they likewise need to ensure they have the ability to protect against, detect, and restore data and operations in the event of a successful cyber-attack in order to protect their data, for business survival." 

++

Brian Dunagan, Vice President of Engineering, Retrospect

"Every organization, regardless of size, faces the real possibility that they could be the next victim of a cyberattack. That is because today's ransomware, which is easier than ever for even the novice cybercriminal to obtain via ransomware as a service (RaaS), strikes repeatedly and randomly without even knowing whose system it is attacking. Ransomware now simply searches for that one crack, that one vulnerability, that will allow it entry to your network. Once inside it can lock-down, delete, and/or abscond with your data and demand payment should you wish to keep your data private and/or have it returned. 

As an IT professional, it is therefore critical that beyond protection, steps be taken to detect ransomware as early as possible to stop the threat and ensure their ability to remediate and recover. A backup solution that includes anomaly detection to identify changes in an environment that warrants the attention of IT is a must. In order to ensure its benefit,, users must be able to tailor the backup solution's anomaly detection to their business's specific systems and workflows; with capabilities such as customizable filtering and thresholds for each of their backup policies. And, those anomalies must be immediately reported to management, as well as aggregated for future ML/analyzing purposes."

++

Tomer Shiran, CPO and co-founder, Dremio

"Data privacy is a fundamental human right and is becoming increasingly important in the digital age as more personal information is collected, stored, and shared online. Organizations have a responsibility to protect the data privacy of individuals and ensure that personal information is handled in a responsible and ethical manner. Data privacy laws, like GDPR in the European Union and California’s CCPA, have been put in place to give individuals more control and to hold organizations accountable for data breaches and mishandling of personal information, but data privacy is a constantly evolving field. A data lakehouse should be designed with privacy in mind, processing organizational data on the customer's premises and never storing it anywhere in the lakehouse’s infrastructure. This reduces data proliferation dramatically and helps organizations use their existing controls to safeguard their own data and their customers' data."

++

Sreedharan K S, Director of Compliance, ManageEngine (Zoho Corporation)

"The privacy environment has undergone significant upheaval worldwide, the watershed moment being the adoption of GDPR by European Union. Data is a valued resource for making crucial business decisions. However, regulators and data subjects are both demanding robust data privacy frameworks to prevent the misuse of personal information. The momentum in this rapidly evolving privacy landscape will continue to gain pace in 2023.

Data privacy laws give customers more control over their data, requiring organisations to get customer consent before using their personal information and provide transparency on how data will be processed, and it's vital for organisations to comply with these legal requirements. With data privacy regulations gaining prominence following the implementation of the GDPR, privacy laws have been implemented in many regions. This has led to greater awareness among individuals about their data privacy rights, and organisations are facing more legal scrutiny when processing personal data.

This is why businesses need to ensure they are in compliance with their respective data privacy laws and are protecting the rights of data subjects. However, the data protection laws which are territorial in nature face unique challenges when data moves across boundaries. This has resulted in governments coming up with enhancements related to transfer of data to the existing data protection laws. Data protection laws will continue to be adopted by more countries and will evolve to better protect individuals' rights. Privacy laws such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) regulate data storage, sharing, and disclosure practices for consumer data in today’s digital economy, and are disrupting business models and the way data transfer works."

++

Hayley-Jayne Cone, VP Customer, Snowplow

"In 2022, discussion of data protection laws has increased on a global scale, such as with the General Data Protection Regulation (GDPR). Specifically, many countries are seeking clarity on how and when data may be used so that technology companies can remain compliant. This issue has resurfaced in 2022 after Google Analytics was found to be not in compliance with GDPR in several countries, such as Austria, France, Italy and Denmark. Many organizations find themselves looking for alternative analytics options for their tracking.

We’re also seeing more focus on data privacy in the U.S. at the state level in California, New York, Virginia, and Colorado. Many more states are considering drafting privacy laws. It's a real struggle for businesses to navigate these new legislations, especially when new laws are being enacted at the state level rather than the national level every year. In 2023, we will see more organizations reckoning with how to effectively comply with the new data privacy regulations while continuing to provide the best possible customer experience."

Chris Lubasch, Chief Data Officer (CDO) & RVP DACH, Snowplow

"One of the hot topics in Europe and beyond will continue to be data privacy and compliance. Whether it’s because customers are increasingly aware of how brands use their data, or regulatory bodies are significantly increasing scrutiny and de-facto banning Google Analytics in some countries, it’s never been more important for organizations to consider how data compliance and ongoing data management form a critical part of their business and data strategy. 

Privacy regulations are here to stay, no matter how they look in detail. Instead of continuing to exploit datasets to the maximum, often without proper knowledge, consent or understanding of their customers, organizations need to embrace this unique opportunity before their competition. It’s a chance and necessity to enter into a new relationship with users and customers, one that is guided by getting something back in return for sharing private data. It will continue to play an essential role in learning what works and what doesn’t, or data-empowering decisions made across the board. But the days to exhaust all data points possible are finally over. Less is more, deliberately creating and using what you need will become the new status quo down the road."

++

Meggie Giancola, Senior Vice President of Sales Solutions & Strategy, Vericast

"Data privacy is evolving as a balancing act between personalization and privacy, and companies will need to stay on top of the rapid pace of regulatory and subsequent ecosystem changes in this area. In terms of the bridge between adtech and martech, while consumers want to have their brand engagement personalized to them, they also want personal privacy and security of their information. To keep up with the paradox of personalization without sacrificing privacy, advertisers need to focus on creating direct engagement with consumers and gain their consent in order to safely capture their information and deliver customized messaging in accordance with legislative and regulatory changes. It is increasingly becoming an opt-in world vs. an opt-out world."

Lance Hayden, Vice President, Chief Information Security Strategist, Vericast

"Cybersecurity and privacy are rapidly converging as organizational challenges are to be met. Where they were separate disciplines, often managed by different teams with unique tools, today's data-centric society is demanding more coordinated solutions. Growing awareness among businesses, governments, and the public about the risks to our technologies and information has resulted in new expectations and requirements for data protection. This includes new laws and regulations that focus on privacy principles and information security best practices.

As even more of our daily lives are conducted online through networked technologies, and our individual personal data becomes an important commodity of immense value to organizations of all kinds, we must ensure that data is used appropriately and securely. And emerging technologies like big data, artificial intelligence, and blockchains/cryptocurrencies bring with them completely new opportunities and challenges regarding managing and controlling information. Fortunately, partnerships between privacy and security teams are increasingly apparent across organizations of all kinds. These experts will need to continue to work together, adopting holistic approaches to their respective disciplines and creating converged strategies to address mutual threats and risks across this new landscape."

++

Mark Guntrip, senior director of cybersecurity strategy at Menlo Security 

"Data privacy has never been more difficult than it is in today's threat landscape. We live in a world where it's no longer enough for companies to implement security measures in hopes of keeping their employee or users' data safeguarded. Instead, increasingly sophisticated and personalized threats have resulted in need for better education around data privacy and the role consumers and end users can play in keeping their personal data protected. 

The added complexity around ensuring data privacy and security is that applications now reside anywhere around the world, in data centers, private clouds and public clouds. The days where data security could be put in place to prevent sensitive data from leaving the walls of the company are gone. Today, policy and security needs to be able to not only detect private or personal data, but also understand where that data is being moved to, and if that application and infrastructure is secure for the level of private data.

Menlo Security ran a survey that found 77% of consumers are confident in their ability to identify and report malicious cyber activity but at the same time consumers fail to utilize even the most basic best practices when it comes to data protection. Our findings revealed only 20% use a password manager and only 28% don't repeat passwords, placing their data at risk. 

Despite the confidence people have in their abilities to protect their data, there's a misalignment between this and the actions being taken. We're seeing a knowledge gap between the reality of data privacy and how people hold themselves accountable in securing personal data, causing a need for more conversations around data privacy and how individuals should take a more proactive role in data privacy."

++

Fiona Campbell-Webster, Chief Privacy Officer at MediaMath

"The latest in data privacy is usually reactive in response to legislation, so this Data Privacy Day it's important to prepare for potential new policy. As more states introduce privacy laws, organizations must be aware of, and able to manage, the varying provisions which can make cross-state compliance complicated.

Regarding global privacy controls, it is important for marketers to continue to monitor developments on opt-out preference signals, which are addressed in greater detail in the CPPA's draft regulations. The first step in data privacy is to ensure your technology team fully recognizes the new opt-out requirements. The "frictionless" opt-out approach (recognizing opt-out signal preferences) may have challenges, and companies should take time to understand how the business can practically implement this approach or the alternative approach of including links to allow consumers to opt-out.

With the focus on privacy policies, privacy notices and cookie policies, it is incredibly important that companies start reviewing and updating disclosure documents on their sites and digital properties, as the new US State privacy laws and rules will require many changes, such as what are the categories of data disclosed to third parties."

++

Lesley O'Neill, Chief Compliance Officer, Prove

"In a world where identity theft is no longer an "if," but a "when," privacy professionals are faced with the challenge of protecting consumers while simultaneously supporting organizations that conduct fraud analytics on behalf of clients. Additionally, data protection laws have largely not addressed the friction between these two interests. As a privacy professional, explaining this conflict of interest to product and data analytics teams, such as setting short data retention policies to comply with GDPR or preventing the further processing of personal information due to lack of consumer consent, is a challenge, to say the least. 

While data protection laws continue to evolve alongside technology and real-world threats, the key to addressing this challenge is education. In the cases where I know a policy will not be popular, I make it a goal to not just simply set policies and demand compliance, but to explain why it exists. I also work to partner with other parts of my organization and help them to achieve their goals (i.e., developing the best fraud products in the market) while I simultaneously work to achieve mine (i.e., protect consumer privacy and comply with data protection laws)."

++

Song Pang, SVP of Engineering at NetBrain

"Organizations looking to better protect customer data should consider how well they can validate their security policies, controls and configurations. Even the best security hardware and software develop vulnerabilities over time, usually as the unintended consequence of other IT activities. And with the larger attack surfaces created through cloud-based services, the need to continuously verify that security profiles are intact is essential.
 
Security teams should look for ways of greatly expanding their capacity to more frequently verify their security footprint without the use of human-centric and manual period reviews. Without a new proactive approach, most organizations will continue to comprehensively test their security attributes only AFTER a breach happens and data and reputation is lost. To really protect user data, organizations need not only a set of strong security controls in place, but they need a scalable means to verify that those controls are doing the job they were designed to do."

++ 

Corey Nachreiner, Chief Security Officer, WatchGuard Technologies
 
"Data Privacy Day provides a yearly reminder that data privacy and data security are inextricably linked. Even as laws around the world increasingly recognize the rights of individuals to control how information about them is collected, used and stored, they are also putting greater responsibility on companies for being good stewards of that data and holding them accountable when they aren’t. But protecting data from malicious actors is everyone’s responsibility. Organizations need the strongest possible cybersecurity defenses. At the same time, individuals need to understand the threats and how to avoid falling victim to them while also taking personal responsibility for, and understanding the impact of, willingly sharing data with services like social networks. If a service seems "free," you should realize you and your data are the product, so act accordingly. Data will not stay private if we don’t all do our part."

++

Almog Apirion, CEO and Co-Founder of Cyolo

"Data Privacy Day aims to increase awareness over the need to protect employee and customer data while adhering to regulatory laws such as GDPR or CCPA. Even if newer regulations are highlighting today's major need for data protection, this is not something new - in fact, the first legally binding international privacy and data protection treaty, Convention 108, was signed well before today’s regulations in 1981. Because of our greater reliance on digital technology to govern most of both individual and organization facets, it is important to reconsider what, when and where as well as with whom it is shared with others. Data Privacy Day is a component of the worldwide "STOP. THINK. CONNECT." campaign for online privacy, security and safety.

Strong data privacy is more critical than ever — particularly in response to the recent growth of cyberattacks and the expansion of data perimeters due to hybrid work. One way of mitigating today's vulnerabilities is to provide rigorous identity-based access control. To safeguard themselves, enterprises' collaboration and communications tools require a robust zero-trust framework to protect all forms of user data. Identity-based access control enables businesses to strengthen their security posture while also gaining visibility and control over their most critical systems. The reality is that hackers today don’t break in, they log in. Enterprises can get complete control and visibility of their entire IT infrastructure while mitigating against advanced threats by implementing a modern zero-trust solution and adopting stringent authentication requirements. As more risks emerge, organizations will be more prepared than ever to counter threats and safeguard data and business-critical infrastructure."

++

Grayson Milbourne, Security Intelligence Director at OpenText Cybersecurity

"Data privacy week is intended to serve as a reminder for organizations to safeguard data and maintain compliance. It is also an ideal time to check response plans in the event the bad guys get in.

Despite a businesses’ best efforts, it’s impossible to guarantee a breach won’t happen. Having a documented plan to detect, contain and respond to attacks can greatly minimize the time it takes to recover critical data and maintain operations. Identifying a businesses’ most valuable data assets and ensuring these assets are secured is an essential starting point. Access control is the biggest business vulnerability for most companies, therefore, following a zero-trust mentality and limiting access to only those employees that need it greatly minimizes damage in the event an employee is breached. Recovery plans should be specific and rehearsed periodically as during a ransomware attack, time is money. Attackers will increase the ransom amount the longer it takes to pay.

Because even carefully built backup-and-recovery plans can be compromised in an attack, additional safeguards are important. Keep multiple copies of backups in different domains (e.g., local and cloud). Likewise, consider backup solutions that do not allow an attacker to rewrite, encrypt, or modify previous backups. Lastly, keep a history of restored points and backups that cannot be compromised, this will allow access and restore from a good copy of an earlier snapshot.

Most importantly, implement ongoing security awareness training. Education goes a long way in preventing an employee from making a costly mistake."

++

Amitabh Sinha, Co-Founder and CEO of Workspot

"Today’s attack surface has expanded exponentially. With cybercrime positioned as the fastest-growing crime in the U.S., attacks are increasing in number, scope, and sophistication. Data Privacy Day serves as a reminder that security posture is paramount for every organization, and a zero-trust security model is a critical line of defense. In this context, a multi-layer approach is needed. Cloud PCs bring an extra level of security to help ensure no one is trusted without verification, either inside or outside the organization.

Many Cloud PC solutions have integrated control and data planes, which can expose customer data. A true zero-trust architecture can be a gamechanger for company security, as it requires separation between control and data planes, which isolates and secures company data from the control elements of the Cloud PC platform. After all, zero trust means trusting no one with your corporate data, not even your Cloud PC vendor! 

As we look beyond Data Privacy Day, enterprises need to implement future-proof end user computing solutions that also fortify security policy. Cloud-native Cloud PCs are the modern way to achieve the agility and security enterprises need today. When evaluating Cloud PC solutions, IT leaders should consider the following:  

• Where will my data live? Who will be able to see it? How is it protected?
• How will my cloud desktop architecture impact information security?
• Where will my Active Directory run?
• What systems will be shared between users?
• What are the regulatory and compliance implications of the solution?
• How quickly can I add Cloud PCs?
• How can I deliver the best performance to my end users?"
  

Dan LeBlanc, CEO of Daasity

++

Terry Storrar, Managing Director, Leaseweb UK

"As more and more businesses turn to the cloud, the priority for 2023 should be ensuring that the data held within - and transferred between - these platforms is secure. However, with the IDC cloud security survey recently revealing that 98% of all companies experienced a cloud data breach within the past 18 months, there is clearly much more work to be done to protect data stored in the cloud.

Although these stats may appear bleak, there are many things businesses can do to help prevent attacks and recover impacted data if a breach does occur. For example, by choosing a trusted hosting provider, customers can gain access to 24/7 security-related support services, standard security training for all employees, and robust disaster recovery solutions.

Data Privacy Day is a great opportunity to take stock of how secure your data really is. And, for those who have entrusted their data to a cloud hosting provider, the day should serve as a reminder to choose carefully and ensure your provider is willing to go the extra mile to secure your data."

++

Rehan Jalil, President & CEO at Securiti

"As cyberattacks continue to evolve – in number, scope and sophistication – Data Privacy Day serves as a reminder to organizations to shore up their security strategies and ensure appropriate privacy controls are in place. To ensure the valuable data that organizations store in their internal ecosystems is properly protected, they must implement a thorough and effective approach to privacy. This starts with an accurate understanding of what personal data is stored across the various data systems within an organization. Next is understanding the privacy laws that apply to their employees and customers in any given region. It is further critical that organizations implement formal policies and procedures to properly govern this sensitive data and honor privacy rights of individuals.

As we reflect on this year’s Data Privacy Day motto - ‘STOP. THINK. CONNECT.’ – organizations must pay special attention to their current cybersecurity controls and ensure their security teams have the tools they need to be successful. Robust platforms that offer sensitive data intelligence, data security posture management, data access governance, data breach management, data subject rights and a full suite of PrivacyOps capabilities are any organization’s best bet for a holistic and unified approach to comply with regulatory requirements."

++

Chris Lehman, CEO, Safeguard Cyber

"SafeGuard Cyber believes the steps that users should take to reclaim their privacy and their data on this Data Privacy Day are:

1. Double down on transparency: Enterprise teams need to prioritize clarity in articulating their plans for monitoring business communications on apps like WhatsApp and Telegram. Where possible, employees should be involved as stakeholders in the planning process. Some companies and employees may agree on managed corporate devices, while smaller, more nimble teams may decide personal devices are fine.
2. Establish clear guardrails: From the planning and buy-in stages, companies need to set clear policies on what can and should be communicated on mobile messaging channels. This should also include clear guidance on what will be monitored and how. Will the information be archived? If so, for how long.
3. Give employees the choice to opt IN. Transparency is the foundation of trust. After articulating the plan, after negotiating the terms, finally employees must be given a choice."
   

##