itSMF Switzerland - Blog #Cyber Security

Key features of an effective data assessment platform for compliance and flexibility

Wed, 13 Nov 2024 07:00:00 +0100

Reading time: ~ 4 min.

In our previous article, «Data Assessment in Cybersecurity: A Strategic Pillar for Compliance and Risk Management», we explored the essential role of Data Assessment in Cybersecurity and data privacy. We discussed how aligning a Data Assessment strategy with international standards – like NIST 2.0 and ISO 27001 – as well as privacy frameworks (e.g. GDPR; Swiss FADP aka LPD-DSG-LPD; Bahrain’s Data Protection Law), can help build a strong compliance foundation.

But in reality, even starting with the best methodological approach, many SMEs, and even larger enterprises, find the costs and effort of Data Assessment a barrier to implementing effective data management policies, despite recognizing the risks of non-compliance and low quality data assets.

Why not consider automated tools to streamline the initial data assessment phase?

From data chaos to compliance: retrospective assessment of unorganized data

Over time, many organizations accumulate data without a clear structure or strategy, making retrospective data assessment a complex and costly endeavor. Typically, this involves sorting through years of data across various systems and data format.

An effective data assessment platform should identify, organize, and secure both structured data (like databases and spreadsheets) and unstructured data (such as emails, documents, and multimedia files).

Finding the best fit: core considerations for data assessment platforms

The diagram in Pic.1 illustrates how a well-integrated data governance framework, supported by a data assessment platform, enables comprehensive Data Management. At the center of this framework is a core repository that organizes metadata from various structured and unstructured sources, such as Databases, Emails, File Shares, SaaS Applications, and Cloud storage.

Following the NIST 2.0 RDaF model, data moves through each stage of its life cycle – planning, generating/acquiring, processing/analyzing, sharing/using, preserving/discarding, and envisioning – within a controlled environment (for more information, refer to our «Data Assessment»).

Surrounding this central repository are essential data management functions that a data assessment platform should support Data Management Policy, Data Discovery, Data Classification, Data Profiling, Data Risk Assessment, and Data Consolidation.

When integrating, data assessment platforms should be designed to offer direct APIs or, where necessary, customizable interfaces that facilitate integration with other data governance tools (note: data assessment platforms don’t always include some data governance features like Access Management).

As data management systems evolve, certain capabilities might become critical:

Data access governance: integrates with access control systems to enhance security;
Business intelligence tools: enables seamless data transfer for analytics purposes;
Data transformation tools: prepares data for application across various platforms;
Data cataloging: syncs with data inventories to maintain consistency;
Remediation tools: supports automated issue detection and resolution.

Essential criteria for a robust data discovery platform

To guide the selection of an effective data assessment platform, we’ve summarized the critical features that support comprehensive data assessment projects:

Multi-source scanning: as data often resides in various locations such as cloud storage, on-premises servers, network drives, emails, and numerous SaaS applications, an effective platform should be able to scan and gather data from both structured and unstructured sources across these diverse environments, ensuring cross-platform compatibility that suits a range of system setups.
Non-intrusive scanning: the platform should be capable to perform its tasks without disrupting the performances of the existing systems or, if requiring additional hardware, to be implementable without major changes to the existing infrastructure. For small and medium-sized businesses, this can be of strategic relevance.
Scalable Architecture: a robust data discovery platform should adapt to increasing data volumes, supporting everything from small networks to expansive multi-location setups. This flexibility ensures that the platform remains effective as your data needs evolve, enabling continued management of both structured and unstructured data.
Cloud data repository or on-prem data storage? The decision between cloud storage and on-premises storage depends largely on an organization’s security needs and budget. Both options have advantages and limitations, which can vary based on country, industry, or specific legal requirements. Since there isn’t a single best answer, managed service providers should ensure they have a flexible tool to support both setups. If you’re the end client, start by reviewing your company’s requirements to choose the option that best aligns with your regulatory and operational needs.
AI-powered data classification: an effective platform should classify data based on type, sensitivity, and compliance needs using advanced AI rather than simple keyword matching. This approach minimizes false positives and misplaced content or classification, allowing teams to concentrate on protecting sensitive data rather than manually sorting it.
Integration with other third parties solutions: Data Assessment is just one side of integrated data policy framework implementation, and not all the products the market offers have built in policies for data access, monitor data usage, internal workflows and comprehensive reporting.
Browser-based access: with a browser-based interface, your data discovery platform can be securely accessed from any device with an internet connection, eliminating the need for specialized software. This feature ensures that team members can manage and monitor data from virtually anywhere, on any device.
Managed service options functionalities: Companies with limited resources often seek to outsource services, such as CISO-as-a-service or even entrusting an external provider with the entire data assessment project. Platforms with Managed Service Provider (MSP) capabilities offer remote monitoring, automated updates, and dedicated support, all managed by a third-party team. This option is especially advantageous for smaller organizations, as it provides professional data management without the cost and effort of in-house support.
Open IT architecture: a robust platform should integrate smoothly into your existing infrastructure, avoiding the need for complex server setups or additional software licenses. Compatibility with open-source software is an advantage, especially for small businesses with simple IT configurations. Such flexibility allows even SMEs with modest IT setups to manage substantial amounts of data effectively, supporting compliance without excessive expense or complexity.

Data assessment project strategies: is there a standard approach across sizes and sectors?

Data assessment needs vary widely by business size. Small and medium-sized enterprises often handle significant volumes of unstructured data for compliance, while larger organizations benefit from structured systems and dedicated teams for data governance.

Larger firms also rely on complex infrastructures that support advanced platforms, organizing data across storage systems like SAP or digitization activities.

Sector-specific needs play a role too. Finance, manufacturing, and services face unique regulatory demands, but privacy frameworks are driving a transversal approach to data structuring across industries, regardless of sector.

So, how should we begin a data assessment project? Let’s break it down together...next time!

Author: Michele Roveda

Company: E-Venture Business Solutions (itSMF Advanced Sponsor)

If you want to keep you up-to-date with the most recent post on this topic, don't forget to become itSMF Switzerland member:

BECOME ITSMF SWITZERLAND MEMBER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

Data Assessment in cybersecurity: a strategic pillar for compliance and risk management

Wed, 16 Oct 2024 07:00:00 +0200

Reading time: ~ 4 min.

The role of data assessment in cybersecurity according to NIST 2.0 and ISO 27001

In today's fast-paced digital world, data is everywhere. From the emails we send to the customer data we store, organizations generate and process massive amounts of information daily. But with all this data, how do we ensure that it's safe, secure, and compliant with regulations?Enter data assessment — a key process that helps businesses understand, classify, and protect their information assets.

Let’s break it down. Data assessment involves identifying what kind of data your company has, where it's stored, how it's used, and most importantly, how it's protected. This process isn’t just for large corporations. Even small and medium-sized enterprises (SMEs) can — and should — conduct thorough data assessments to ensure compliance with privacy regulations and safeguard their information.

You might be wondering «Where does data assessment fit into the bigger picture of cybersecurity?» It’s a crucial part of the puzzle, especially when following established frameworks like NIST 2.0 and ISO 27001.

Both NIST's Cybersecurity Framework (CSF) 2.0 and ISO 27001 emphasize the importance of knowing your data. It all starts with the Identify function in NIST 2.0. Before you can secure something, you need to know it exists. Data assessment helps organizations uncover all their data — whether it’s structured or unstructured — and evaluate its sensitivity and risk. RDaF 2.0 in NIST adds another layer, offering structured guidance on how to manage and classify data, reducing risks effectively.

Similarly, ISO 27001 requires organizations to have a clear understanding of their data in order to apply the right security measures. The standard’s Information Security Management System (ISMS) is built around knowing what data is sensitive, how it’s stored, and ensuring the right controls are in place.

In short, data assessment forms the foundation for protecting data under these frameworks, making it a crucial part of your cybersecurity strategy.

Why data assessment is essential

So, why is data Assessment so crucial? Let’s get straight to the core — there are three primary reasons.

First, compliance. Regulations like GDPR, Switzerland's FADP (LPD-DSG-LPD), and many others around the globe — including in regions such as the Gulf Cooperation Council — require organizationsto have a clear understanding of their data and how they are protecting it. Non-compliance can lead to hefty fines and damage to your reputation.

Second, it’s about risk mitigation. When you know which data is the most sensitive — whether it’s customer information, financial records, or intellectual property — you can prioritize your security measures where they will have the greatest impact.

And finally, data management. Conducting a proper data assessment helps keep your operations smooth by ensuring that your data is clean, organized, and easily accessible when needed.

Challenges in conducting data assessment for privacy regulations

Of course, data Assessment comes with its own set of challenges, especially when it comes to privacy regulations. One of the biggest hurdles organizations face is something we call data sprawl.Data isn’t always neatly stored in one place — it’s often scattered across different systems, devices, and locations. Tracking all of that down can feel like searching for a needle in a haystack.

Another major challenge is mapping data flows. Understanding how data moves through your organization — from collection to storage to processing — can be complex, particularly in companies with older or decentralized systems.

And let’s not forget the resource issue. Many SMEs simply don’t have the time, manpower, or expertise to carry out detailed data assessments. This can leave them vulnerable to compliance failures and security breaches.

How NIST RDaF 2.0 helps solve these challenges

Here’s where NIST RDaF 2.0 comes to the rescue. The risk data framework offers organizations a structured way to assess and classify data, making the process easier and more manageable.

With RDaF 2.0,companies can standardize how they classify sensitive data. This not only helps in staying compliant with regulations but also ensures that the right security controls are applied where they’re most needed. Additionally, the framework encourages a risk-based approach, helping you focus on protecting the most critical data first.

Automation and AI: the future of data assessment for SMEs

If you're running an SME, you might be thinking, «This sounds great, but where do I start?» The answer lies in modern software platforms that leverage integrated AI functionalities to make data assessment easier and more efficient. Instead of relying on manual methods —which are often time-consuming and prone to human error — these AI-powered tools can automate the entire process, from data discovery to classification.

With advanced AI algorithms, these platforms can scan both structured and unstructured data, identify sensitive information, and classify it according to your organization’s specific compliance requirements. This automation significantly reduces the risk of overlooking critical data and ensures that classification is done consistently across the board.

Moreover, platforms equipped with AI-driven solutions enable SMEs to stay up to date with evolving regulations like GDPR and FADP (LPD-DSG-LPD), even without a large in-house team dedicated to data governance. These tools can adapt as regulations change, ensuring continuous compliance without requiring constant manual intervention.

The benefits don’t stop there. By integrating AI functionalities into software platforms, SMEs gain access to a cost-effective solution for data assessment. This allows smaller organizations to focus on their core business activities while maintaining robust data security and compliance.

Final thoughts on data assessment

In today’s cybersecurity landscape, data assessment is no longer merely a best practice — it’s a necessity. Whether you're part of a large enterprise or a smaller organization, having a comprehensive understanding of your data and ensuring its protection is essential for both compliance and risk mitigation.

By leveraging frameworks such as NIST 2.0 and RDaF 2.0, along with the power of AI and automation, addressing data security challenges becomes not only achievable but also more streamlined and scalable.

In our next article, we’ll dive into the must-have features of a software platform designed to automate data assessment, ensuring scalability and flexibility as your business evolves. Stay tuned!

Author: Michele Roveda

Company: E-Venture Business Solutions (itSMF Advanced Sponsor)

If you want to keep you up-to-date with the most recent post on this topic, don't forget to follow us on our social media channels or subscribe to our newsletter.

SUBSCRIBE TO OUR NEWSLETTER

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

Our sponsors

A special thanks to our Advanced Sponsors:

The Interbank communication in financial services according to ISO 20022

Wed, 31 Jan 2024 07:00:00 +0100

Reading time: ~ 2 min.

ISO 20022: a series of standards for Interbank communication in financial services

The ISO 20022 series of standards provide a support for an effective worldwide Interbank communication in financial services industry, where the accuracy and reliability of data are critical on building a trusthworty International financial system.

The ISO Technical Committee TC68 Financial Services is in charge of the preparation of the multi part International Standard ISO 20022 and this documentation provides a description of a common platform for the development of messages as follows:

a modelling methodology to capture in a syntax-independent way financial business areas, business transactions and associated message flows;
a central dictionary of business items used in financial communications;
a set of XML and ASN.1 design rules to convert the message models into XML or ASN.1 schemas, whenever the use of the ISO 20022 XML or ASN.1-based syntax is preferred.

This is indeed a flexible framework useful when it comes to find a solution that can help to match the needs of organizations developing messaging systems as well as the communities of users according to an international approach, international business semantics and common syntaxes (XML or ASN.1).

The ISO 20022 multi-part standard table of contents

The ISO 20022 series is made up of the following chapters:

📘 Part 1: Metamodel

📘 Part 2: UML profile

📘 Part 3: Modelling

📘 Part 4: XML Schema generation

📘 Part 5: Reverse engineering

📘 Part 6: Message transport characteristics

📘 Part 7: Registration

📘 Part 8: ASN.1 Generation

The ISO 20022-1 standard: Part 1 about Metamodel

In the ISO-20022-1:2013 «Financial services – Universal financial industry message scheme – part 1» we find a global description of the model:

✅ 4. Type Library

✅ 5. Metamodel packages

✅ 6. Repository

✅ 7. Registration

✅ 8. Repository access

✅ Annex A – Type Library

✅ Annex B – Metamodel

To better figure out the «big picture» about what we just described in these last lines, we can bring as usual our infographic:

As we outlined in our post, the ISO 20022 is a standard made up of several parts and our focus is only about the «Part 1».

If you want to keep you up-to-date with the most recent news on this topic, don't forget to follow us on our blog, social media channels and newsletter. Don't miss out our next updates on the brand new YouTube Channel!

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

ITIL et la protection des données personnelles

Wed, 11 Jan 2023 00:00:00 +0100

Temps de lecture: ~ 3 min.

L'importance de la protection des données personnelles

La protection des données personnelles est une partie de la securité de l'information qui concerne le traitement des données personnelles incluant les aspects de consentement, droits des personnes concernées et autres obligations légales.

Les fournisseurs de services doivent concevoir leurs services en prenant en compte la protection des données personnelles.

Même si le fournisseur opère dans un pays sans législation stricte en la matière, il doit avoir une politique de protection des données personnelles dans le cadre de ses opérations.

Éléments clefs d’une organisation conforme à la législation en matière de protection des données personnelles

Nous verrons dans les paragraphes suivants plus de détails sur les éléments clefs d'une organisation qui agit en conformité avec la législation sur la protection des données personnelles.

Politiques de rétention des données

Toute donnée personnelle traitée par une organisation devrait être traitée dans un but spécifique.

Quand le consommateur fournit ses données personnelles à une organisation il s’agit d’un prêt de données aux fournisseurs de services dans un but particulier.

L’organisation ne doit donc pas conserver ces données personnelles indéfiniment.

Le droit à l'oubli

Les consommateurs ont surtout les droits suivants concernant leurs données personnelles :

Accès aux données
Modification (rectification) des données
Suppression des données (droit à l’oubli)

À tout moment les consommateurs doivent pouvoir contacter le fournisseur de services pour faire valoir un ou plusieurs de ses droits. Des législations comme le RGPD Européen donnent des droits supplémentaires aux personnes concernées. Les organisations doivent donc s’informer sur la législation applicable dans leur(s) pays afin de prendre les mesures nécessaires.

Quand les consommateurs contactent l’organisation pour faire valoir un de ses droits concernant les données personnelles alors l’organisation doit utiliser la gestion des demandes services pour répondre à la demande.

«Privacy by default»

Les données personnelles doivent être traitées de la façon la plus sécurisée possible. C’est un engagement de l’organisation vis-à-vis des consommateurs.

La pratique ITIL4 de gestion de la sécurité de l’information peut être utilisée pour protéger les données personnelles. Cette pratique permet aux organisations de définir des mécanismes pour analyser les domaines ou les données personnelles sont le plus exposées à des risques de sécurité afin de réduire ces risques.

Cette pratique inclut des analyses de vulnérabilités de l’infrastructure utilisée pour traiter les données personnelles. Ces analyses sont utiles aux organisations pour définir précisément leurs engagements vis-à-vis des consommateurs sur la protection des données personnelles.

La pratique de conception des services

Si un des objectifs de l’organisation est garantir un certain niveau de protection des données personnelles – «privacy by default» – alors la pratique de conception des services peut aider à intégrer les activités correspondantes dans les opérations de l’organisation.

De même que le modèle d’amélioration continue la conception de services permet des modifications itératives qui aide l’organisation a augmenter en continu sa création de valeur.

Consentement implicite

Les organisations ont souvent besoin d’un consentement explicite des consommateurs pour stocker leurs données personnelles.

Par exemple un consommateur donne son accord explicite pour recevoir de l’information à propos de produits et services sur une base régulière.

Cependant dans certains cas le consentement pour la collecte et le stockage des données personnelles est implicite.

Se mettre en conformité

Afin de gérer les activités de traitement des données personnelles en conformité avec la législation, il est possible d'adopter une stratégie qui implique un «mapping» et une adaptation continue des solutions pour la protection des données.

Processus de mapping

Les organisations peuvent mapper les instances dans lesquelles les données personnelles sont collectées et traitées par les processus métiers.

Cette activité permet de définir quelles données personnelles sont nécessaires pour des activités métiers et quelles données sont inutiles et ne doivent pas être collectées.

Mapper les données aide les organisations à être conformes avec le principe suivant : toute donnée personnelle traitée par une organisation doit l’être dans un but particulier. La pratique ITIL4 de gestion de l’architecture est utile pour réaliser ce mapping des données.

Améliorations itératives

Les organisations qui souhaitent être (et rester) en conformité avec la législation en matière de protection des données personnelles doivent réaliser des changements réguliers en utilisant le modèle ITIL d‘amélioration continue.

Auteur: David Billouz

Vous voulez vous tenir au courant des news de itSMF Switzerland? Inscrivez-vous à notre newsletter ou connectez-vous à notre page d'entreprise sur LinkedIn.

SUIVEZ-NOUS SUR NOTRE PAGE LINKEDIN

Need to know more about it?

Click on one of the options below to enter in the itSMF Enviroment and for being updated the way which is best for you.

Subscribe to itSMF Newsletter

DISCOVER OUR EVENT CALENDAR

Get the benefits of Membership Program

itSMF Switzerland - Blog #Cyber Security

Key features of an effective data assessment platform for compliance and flexibility

From data chaos to compliance: retrospective assessment of unorganized data

From data chaos to compliance: retrospective assessment of unorganized data

@font-face {}@font-face {}p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm; font-size: 12pt; font-family: "Aptos", sans-serif }.MsoChpDefault { }div.WordSection1 { page: WordSection1 }Finding the best fit: core considerations for data assessment platforms

Essential criteria for a robust data discovery platform

Data assessment project strategies: is there a standard approach across sizes and sectors?

Need to know more about it?

Need to know more about it?

Our sponsors

Data Assessment in cybersecurity: a strategic pillar for compliance and risk management

The role of data assessment in cybersecurity according to NIST 2.0 and ISO 27001

Why data assessment is essential

@font-face {}@font-face {}p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0cm; font-size: 12pt; font-family: "Aptos", sans-serif }.MsoChpDefault { }div.WordSection1 { page: WordSection1 }Challenges in conducting data assessment for privacy regulations

How NIST RDaF 2.0 helps solve these challenges

Automation and AI: the future of data assessment for SMEs

Final thoughts on data assessment

Need to know more about it?

Need to know more about it?

Our sponsors

The Interbank communication in financial services according to ISO 20022

ISO 20022: a series of standards for Interbank communication in financial services

The ISO 20022 multi-part standard table of contents

The ISO 20022-1 standard: Part 1 about Metamodel

Need to know more about it?

Need to know more about it?

ITIL et la protection des données personnelles

L'importance de la protection des données personnelles

Éléments clefs d’une organisation conforme à la législation en matière de protection des données personnelles

Éléments clefs d’une organisation conforme à la législation en matière de protection des données personnelles

Politiques de rétention des données

Politiques de rétention des données

Le droit à l'oubli

Le droit à l'oubli

«Privacy by default»

«Privacy by default»

La pratique de conception des services

Consentement implicite

Se mettre en conformité

Processus de mapping

Améliorations itératives

Need to know more about it?

Need to know more about it?

Finding the best fit: core considerations for data assessment platforms

Challenges in conducting data assessment for privacy regulations