Jean-Philippe Deby

News of cyberattacks seems constant these days. Recently, Equifax, a US-based consumer credit reporting agency, announced that a private customer data breach impacted 143 million people. Earlier this year, 1.5 million connected cameras around the world were hijacked in an unprecedented DDoS attack. As cyber-attacks become more rampant, it’s hardly surprising that governments are stepping in to hold organizations more accountable. One of the most recent examples of this is the European Union’s General Data Protection Regulation (GDPR) which is set to come into effect on May 25, 2018. New GDPR Legislation Mandates Essentially, the GDPR mandates that businesses adhere to specific governance and accountability standards in the processing and protection of data. A big focus of this new legislation is that individuals have greater control over their personal data. Contrary to legislations in the United States, the personal data captured by organizations will remain the property of each EU citizen, entitling them to access their own data and have greater decision power over how it is used or distributed. Should a breach occur, companies are mandated to report it to the supervisory authority within 72 hours. Failure to comply with these new regulations could result in up to $20 million euros in penalties, or 4% of the company’s global annual turnover. Territorial Scope Of GDPR So why should North American companies and security directors be concerned? The territorial scope of the GDPR is global. Any business that is collecting or storing personally identifiable information (PII) of EU citizens will be held accountable, regardless of where the organization is based or operating from. This includes any business collecting information from EU residents, or organizations with offices, stores, warehouses or employees in the EU. With the deadline nearing, these North American organizations are seeking strategies that will keep them compliant across all their data collection processes. With a focus on physical security sensors and solutions, below are five steps that North American companies can start taking to become GDPR-compliant. Step 1: Conduct A Data Risk Assessment To better understand the implications of the GDPR, an organization must fully assess the level of risk that its data processing operations pose to the rights of EU citizens. A business should map out how data is collected, where it is stored, how long it is kept, and who has access to it. Identifying and categorising the various types of data is also critical to this evaluation. That’s because according to the GDPR, there is a clear distinction between the high, medium and low-risk data. Through authorization, organizations can define how specific users or groups can use the security system For instance, data derived from a video surveillance system that shows who a person is and where they are is considered high-risk. This could be a retailer that is monitoring video of people coming into its stores or an EU subsidiary office that is recording publicly-facing video footage. Step 2: Hire A Data Protection Officer In cases of high-risk data processing, organizations may need to appoint a data protection officer (DPO). This person must be independent of any IT, risk or VP-level functions and will be responsible for monitoring the organization’s compliance with respect to their GDPR obligations. The DPO will act as the main point of contact for all communications with the GDPR supervisory body. This means that at any point in time, the DPO should also be able to show the steps taken by the organization to protect any collected information. Step 3: Implement Privacy By Design The GDPR mandates that businesses with ‘high-risk data operations’ implement systems that protect privacy and secure data by default. It is therefore critical for these organizations to start talking to system integrators and suppliers about what they can do to harden their systems. After all, cyber security should be a shared responsibility. Organizations should work with partners and vendors to better understand cyber security risks and streamline internal processes such as outlining who has access to the data and identifying why and how long it should be kept. With this understanding, companies can justify adding varied lines of defense such as encryption, multi-layer authentication and authorization. For instance, through authentication, organizations can determine if an entity—user, server, or client app—is who it claims to be, and then verify if and how that entity is allowed to access a system. Through authorization, organizations can define how specific users or groups can use the security system. Finally, encryption protects an organization’s information and data by using an algorithm to make text indecipherable. From device to client application, these security measures help organizations safeguard against cyber threats and unauthorized access. Step 4: Address Data Transparency At any point in time, an EU citizen has the right to request a copy of information pertaining to them from an organization. Upon receiving this request, the company would be required to securely and remotely share video and data files with the individual. A problem could surface if other individuals are visible in this footage. Security solutions that not only facilitate information sharing but also protect privacy can help companies quickly adapt to these new laws. Blurring out faces transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy One example is having video redaction capabilities to blur out people’s faces in video. This feature transfers high-risk data to the low-risk category, allowing organizations to monitor or share video while still protecting privacy. Companies will also need to provide greater transparency by making points of contact accessible and clearly outlining data management policies. Step 5: Engage Data Processors According to the GDPR, any company that collects and controls private information is a Data Controller. To properly manage the collected data, companies may choose to outsource some of the responsibility to service providers, known as Data Processors. For instance, a retailer could decide to implement a Video-Surveillance-as-a-Service (VSaaS) solution. Some advanced VSaaS providers offer numerous logs and, more importantly, strong reporting platforms that can help Data Controllers and DPOs monitor the state of their video surveillance systems. In some capacity, Data Processors are equally responsible for adhering to laws. Considering the failure to report a breach in 72 hours could result in massive penalties, implementing a VSaaS is a great way to stay on top of potential breaches and decrease compliance upgrade costs. However, it is not a full transfer of risk. The retailer would still be responsible for issuing and managing system access privileges, ensuring password choices are robust, and essentially, limiting data to those who can view or extract it. Counteracting Emerging Threats Through GDPR Compliance With heavy fines looming, it is imperative that North American businesses collecting or processing any EU citizen data begin working on GDPR compliance immediately. Those filming in high-trafficked public spaces are at an even greater risk of penalty if compliance has been ignored. Starting with a comprehensive risk assessment, hiring a qualified DPO, upgrading technology with built-in privacy and security mechanisms, and in some cases, working with data processors can help North American businesses get on track to full GDPR compliance. Regardless of these new laws, these practices will ultimately benefit the organization as a whole, as new threats emerge globally.

Has there ever been a better time for a security trade show in Europe? Shifting threats such as terrorism and a volatile political climate serve as reminders every day of the importance of security in our lives, and even the role of technology. IFSEC opened in London on Tuesday at the ExCeL center, covering every aspect of security, from access control and video surveillance to home automation and perimeter security. Amid sweltering heat, attendees came to find the latest-and-greatest innovations to meet changing security challenges. Substance Over Style Many of the technology announcements were "repurposed" news previously unveiled in the United States at the spring ISC West show in Las Vegas. Even so, there was plenty to see, although foot traffic seemed a little slow on the first day. Several people commented on how IFSEC is different from ISC West. The US market, exemplified by ISC West, tends to emphasize superlatives and flashy market claims, while the European market is more about substance. That observation comes from Moti Shabtai, CEO and President of Qognify, who said he has a larger share of conversations at IFSEC about how a solution can address specific needs. "Europe isn't one single market," he reminds us. "There are more different kinds of customers and different approaches, while the US market has a more unified way of thinking." Safe and secure cities applications (and "smart cities") are more prominent in Europe. While in the US, utility applications are higher profile, driven by a need to conform to NERC/FERC standards. The European market has more different kinds of customers and different approaches "The competition in Europe is more varied, with more smaller players, depending on which product and market," adds Kim Loy, Director of Marketing for Vanderbilt. "It makes it a more dynamic landscape." One variable Loy points to is how advanced each European market is from a technology perspective. For example, the Nordic countries -- Sweden, Norway, Denmark and Finland -- tend to embrace technology, and Vanderbilt is already seeing success there with its cloud-based products, the ACT365 cloud access control and video system and SBC Connect for cloud-managed intrusion detection. Current events in Europe add an air of urgency to the show. Several recent terrorist attacks have highlighted the need for more and better security. In emergency situations, often the security industry's contributions come after the fact, notes Shabtai. It took police in Brussels, Belgium, five days to find a suspect in the 2016 terrorist attack there. However, technologies such as Qognify's Suspect Search can now sift through databases to find video clips relevant to an investigation within minutes. More analysis of disparate information can in some cases provide predictive capabilities, or at least help direct investigations aimed at preventing such events. Adapting To Vertical Markets Many exhibits at IFSEC reflect the trend we are seeing of companies expanding their product selection beyond what was previously their core competency. Several video companies, in particular, are displaying an expanding array of products. It's a continuation of the familiar trend of video companies like Genetec, Avigilon, Hikvision and others expanding into access control systems. At IFSEC, Genetec says they are focusing on outcomes rather than technology, highlighting systems designed for specific use cases and vertical markets. Importantly, Genetec's systems provide flexibility to adapt to a variety of issues in various markets, whether a specific vertical or in the United States, Europe, or anywhere in the world. Privacy and  cybersecurity are especially relevant in Europe Privacy and cybersecurity are hot-button issues for Genetec, says Jean-Philippe Deby, EMEA Business Development Director. It's especially relevant in Europe, where the European Union has embraced general data protection regulations (GDPR) that require compliance by May 2018 (The UK has committed to compliance despite the Brexit vote.) It's another element in the industry's growing focus on cybersecurity and systems highlighting "privacy by design." But global business trends are eliminating some of the differences in the security industry around the world, says Dr. Peter Kim, Senior Director of IDIS. Globalisation Trumps Regional Phasing "Perhaps the biggest difference at IFSEC this year is the realisation that there is less of a difference than ever before between the US and European markets," he says. "Globalisation increasingly means access in Europe to brands and their product offerings is more equal than ever before—something you see here at this and all of the major security shows around the world. New technologies are increasingly rolled out globally either at the same time or close together, as opposed to regional phasing." Europe and America have different drivers and priorities at different times, including those influenced by geopolitics and recent crises, which can drive demand for technology to meet specific security requirements, Kim notes. Avigilon dominates the signage and video displays as visitors enter the ExCeL Centre One thing both markets have in common right now is geopolitical churn in various forms—including the threat of terror and a number of significant elections—which can lead to increased uncertainty. "This is especially relevant for government contracts, as public projects, which can be quite substantial from a security standpoint, often stall in such environments," Kim notes. Avigilon Dominates The Show Avigilon is one company that is introducing new products at IFSEC (that were not previously viewed at ISC West). They include the Avigilon Presence Detector (APD), a sensor that combines self-learning analytics with impulse radar technology to accurately detect the presence of a person even if they have stopped moving or are hidden. The sensor is designed for indoor locations such as vestibules within banks, pharmacies, retail stores and health care facilities. Avigilon is also highlighting a new Mini Dome Camera Line, and integration of its Access Control Manager (ACM) system with biometrics, among other products. Avigilon is making a big splash at the show. They dominate the signage and video displays as visitors enter the ExCeL Center. I'm looking forward to seeing more interesting technologies in the remaining two days of the show.