As the implications of the General Data Protection Regulation sink in, Paul Brennecker examines its impact on the Gambling Industry and explains how it is not simply a compliance exercise but an industry-wide altered mind-set that is the key to effective data security.
The gambling industry has always been a target for criminals, both in reality and in fiction. From The Sting to Ocean's Eleven and Lock, Stock and Two Smoking Barrels, the world of cinema has long relished the idea of cunning criminals taking on the casino and winning. There is something inherently satisfying about attractive and engaging rogues beating seemingly anonymous gambling enterprises in what is perceived to be an almost victimless crime. In the fictional world of Hollywood, the inevitable sequels roll out reflecting, probably unintentionally, the reality of the situation: that repeated breaches are increasingly experienced by casinos and gaming enterprises. What they do not necessarily show, however, is the other reality: that in the new era of online gambling the victims are very real. They are the individuals whose personal data is stolen.
Cyber-attacks come in many forms but they can broadly be categorised into those that disrupt operations, such as distributed denial of service (DDOS) attacks, where infected computers flood the network with traffic. There are also those that are aimed at data theft, targeting customer data, especially financial information like credit card details, which can be sold on the dark web or used for identity fraud, and ransomware attacks. This type of credential abuse is particularly concerning in the gaming industry because it leads to loss of reputation and clients transferring their online business to other providers.
Although the adversarial threat is significant, the threat posed
by insiders, often trusted employees, can pose an even greater risk to a business. With privileged access employees can intentionally or unintentionally be involved in a targeted breach of data. Staff in the Gambling Industry have a tendency to switch roles between competitors, requiring a robust 'Joiners, Movers, Leavers' process. It also necessitates a heightened awareness of data leakage from within each organisation.
GDPR & PCI DSS
Under the new GDPR framework which became EU law in May of this year, in the event of a data breach, firms can be fined up to 4% of revenue (or 20m Euros, whichever is higher). Since the terms of GDPR were first known, much has been written about it and the impact it has on the way companies manage their data. Yet, there is an important misconception which need to be addressed.
Contrary to current public perception, there is actually no such thing as GDPR compliance. It is a Regulation which requires data systems to be safe but it is open to interpretation and provides nothing in the way of detailed guidance. Nor is there an annual review to validate compliance.
On the other hand, the Payment Card Industry (PCI) Data Security Standard (DSS), which regulates the gaming industry to ensure that payment card details are used with best practice and kept secure, does provide a detailed framework which specifies what needs to be done and how. PCI DSS even provides regular updates and guidance on reviews. Those who are PCI DSS compliant are therefore well on the way to meeting the requirements of GDPR. It is the role of Chief Information Security Officers (CISOs), Data Protection Officers (DPOs) and their advisers to work out where the gaps exist to ensure that an organisation adheres to GDPR in practice.
While the PCI DSS compliance process is undeniably useful, it must be likened to an MOT; it only applies to a given moment in time. One ill-conceived change of control request or alteration to the process can render that compliance invalid. Ongoing testing and maintenance is essential and this is best managed through an altered corporate mind-set which embeds Data Security at every level of the organisation.
A Board Level Approach To Effective Data Security
GDPR and PCI DSS complement one another and, if managed holistically, can deliver immense benefits to efficiency and reputation, while also mitigating the potential damage of a breach. But given the fact that PCI DSS compliance simply provides validation of compliance at a given moment in time, the key to Data Security is not to focus on specific compliance targets, following a tick box exercise once a year, but to develop a corporate mind-set which features a 'compliance out of the box' approach and has ongoing updating and maintenance built in. This altered mind-set requires a company-wide strategy which is developed at board level and then disseminated in practical, simple form to each and every employee or partner of the business. For this to be a realistic goal, the responsibility for data security cannot simply be devolved to the CISO or DPO; nor should it be seen as something which is only in the scope of the
IT department. To be truly effective, it is the responsibility of the each and every member of the board to drive and oversee the organisation's data security responsibilities. Data security should be on the agenda at every board meeting.
Realistically, however, given the complexity of data security and compliance processes, specific ownership will be in the hands of these technically qualified individuals. Yet they will not be able to effectively exert influence at board level unless they are provided with the specialist support and resource. Much like the support provided to the financial department by corporate accountants or the support given to the legal department by specialist legal teams, the CISO needs to have access to specialist data security support to provide strategic guidance and technical abilities to enhance the scope of the operation.
The Role of Penetration Testing, Red Teaming and Retained Forensics in Developing a Data Security Strategy
One of the key elements of data security is the development of a robust defence strategy. It is not enough, however, to develop a strategy and build a defence based on what is already known. Cyber criminals are ingenious and exploit not simply known threats and vulnerabilities, but they also have ways to detect those which are not yet known or understood. Those who only use their own understanding to develop a defence will therefore be limited by the extent of their own knowledge. Testing and challenging that knowledge on an ongoing basis is an essential element. This is where a continual programme of Threat Monitoring, Penetration Testing and the use of Retained Forensics comes in.
Threat monitoring is the process of observing the changing nature of cyber-attacks. All commercial websites will be probed for vulnerabilities, initially by automated tools and once something significant is found, a more concerted manual attack may be launched. Having alerts and being set up to monitor the nature of these attacks and countering them is essential for players in the online gaming space.
The next step is regular Penetration Testing, which needs to include both automated and manual elements. After all, the criminal community uses both advanced scanning tools to identify potential areas of weakness as well as the additional sophistication of the human mind to develop and explore these vulnerabilities.
Imagine a room with an almost limitless number of doors. The automated penetration test will identify which doors conceal potential vulnerabilities. The manual tester then prises these doors open and looks at what is behind them.
Taking the analogy a step further, Red Teaming will push the doors wide open and delve and explore into what is behind them. Red Team testers have ethical hacking qualifications from industry respected bodies such as CREST and OSCP and use their sophisticated skills to root around and uncover hitherto unforeseen vulnerabilities.
Armed with this information, the process of closing off potential opportunities for cyber criminals before they are even exposed can begin. In this way a data security strategy can be developed which anticipates vulnerabilities before they are discovered, rather than simply reacting to those which are already known.
These experts will work in partnership with a specialist Retained
Team to manage the defence process. In some specialist consultancies the Red Team will also be part of the Retained Forensic capability to help ensure that the process is be an ongoing one, with regular exposure to testing built in. Engaging a Retained Forensics team not only assists in managing a continually evolving the strategic defence but builds in resilience to potential attack.
Given the unrelenting ingenuity of attackers, it is impossible to ever consider an organisation to be immune from attack. The strategy should therefore include detailed plans if this eventuality occurs, particularly for the prompt reporting in the event of a breach. GDPR requires any breach to be reported to the relevant regulatory authority within 72 hours and failure to do so will result in punitive action being taken.
When it comes to issues of business continuity, disaster recovery and containment, having a Retained Forensics team on hand, with a thorough knowledge of the organisation's systems, means they will be able to manage this process swiftly, thereby limiting any potential damage.
It is also worth noting that not only will the engagement of a Retained Forensics team facilitate the ongoing testing of system security and provide strategic intelligence for effective maintenance and development, it also demonstrates to the relevant authorities that a robust, ongoing process is in place, thereby reducing the level of potential fines.
In Summary
GDPR should not be considered an encumbrance or an onerous chore. It has been developed to build in safeguards to data security systems protecting both the organisations and their customers from cybercrime. Those who embrace it with enthusiasm, building an ongoing test and exercise regime into their systems, will benefit from enhanced reputation and customer loyalty. Those who make data security the responsibility of all members of the board and who develop a constantly evolving defence strategy can demonstrate to both customers and the regulatory authorities that they take security seriously. They are also in the best possible shape to resist potential attacks, or deflect or reduce the impact of one, making an investment in GDPR and cyber resilience a sound business decision.
Leave your review! Your review will be the first.