GDPR Now!

GDPR Now! is a data security and privacy podcast from Data Protection 4 Business, hosted by the firm's owner, Karen Heaton. She introduces episodes from her office in south-west London, and the conversations that follow deal with what a company should switch on, back up, monitor and write down. The title suggests regulation. The recent episodes spend their time on security practice instead. Most of them belong to Getting to Grips with Data Security, a five-part series made in collaboration with Provision IT that Karen describes as running from strategy and decision making through implementation and ongoing monitoring. Stuart and Darren join her for every part. The strategy episode rests on a blunt point: any device that is connected to the internet and holds data has something to protect. There, Windows update prompts become one front in a constant contest between bad actors and the makers of software such as Microsoft, Adobe and Google Chrome. The cloud episode is about responsibility. OneDrive holds deleted files for 30 days, the discussion notes, and after that the liability for lost data sits with the business unless it keeps a backup of its own. The same reasoning is extended to software-as-a-service providers, with one contributor recalling a prospective client's worries about a large provider in the care sector. The human error episode turns to audit trails: who logged in, when, from which device, and whether multi-factor authentication was in place. Karen singles out Darren's impassioned plea for organisations to find the time and money for training. In the episode on existing tools, Microsoft Secure Score becomes a yardstick. One contributor describes a customer whose score sat at 19.6 percent and has since been pushed close to 60. The same speaker argues against aiming for 100, because piling hoops on users can make the business unworkable. A financial institution, the speaker suggests, belongs in the 80s or higher. The last part of the series pulls the threads together and insists that standards and controls have to be written down and demonstrable to a third party, not just discussed. It also looks back on a quick-fire round in which the two contributors explained how they would turn on each technical control and which Microsoft product would do it. Away from the series, returning guest Andrew Alston, founding director at Breach Aware, appears in 'Cyber Security Tips for businesses'. That episode belongs to a run of updated episodes on security and privacy concerns raised by the coronavirus pandemic and the shift in working practices. His advice is to always patch and to watch suppliers closely. He illustrates it with a ransomware attack on Kronos's private cloud and the knock-on effects for its customers, down to workers going unpaid. Karen keeps the tone warm and practical throughout, and she signs off one episode by asking listeners to stay data security safe.