Procrastination

GDPR: Advice for Every Small Business

Posted by

2

According to every statistic I’ve read, there is still a huge chunk of business owners who have not even read the GDPR yet, let alone done anything about it. To be clear; no matter the size of your business, you have to comply.

For example, Core Concept Security Ltd. (my company) is very small, but even I have to pay a ‘Data Protection Fee’ and sort out my contracts and privacy notices. What I DON’T have to do is:

  1. Designate a data protection officer (DPO) – Article 37, because I meet none of the criteria in 37(1)(a-c); or
  2. Produce a ‘record of processing’ – Article 30 because my company is under 250 employees and I do not meet any of the 30(5) criteria.

I know all of this because I HAVE read the GDPR, I HAVE sorted out my contracts and privacy notices, and I HAVE paid my data protection fee. There is no excuse I have heard to date for EVERY other small business not to do the same.

Follow these steps, and you’ll have done the most important thing imaginable; something: Continue reading →

You’re Not Hiring People, You’re Trying to Solve a Problem

Posted by

2

5 years ago, when I was still smarting from being laid off [fired, cough], I found myself back in the job market looking for …something.

After 12+ years in the same organisation, I had worked my way up from ‘Firewall Administrator’ to ‘Director of Delivery’ for EMEA and APAC. Through poor planning and various character flaws I was at a complete loss where to start looking for an equivalent position. My safety-net was non-existent as making connections has never been what I would call a strong suit.

So I did what everyone else does; I called some recruiters. And I got what a lot of other people got by doing so; nowhere and frustrated.

But as much as I have criticised recruiters; Cybersecurity Recruiters, The Gauntlet Is Thrown!, they are doing an almost impossible job. I have even tried to help; How to be a GREAT Cybersecurity Recruiter, but this still leaves them addressing only the symptoms. The root cause of all our woes is, of course, the hiring organisations themselves.

Continue reading →

Skills Gap

Cybersecurity Skills Gap? You’re Clearly Looking in the Wrong Place

Posted by

6

Like every other independent security consultant out there, I have to ask; “Cybersecurity skills gap? What the Hell are you talking about?”

I’m not even going to quote the plethora of doomsday statistics, but suffice to say the majority of organisations and Governments believe the cybersecurity skills gap is actually a real thing and getting worse. They have no idea that the experts to solve most security issues are out there with dumbfounded expressions thinking; “I’m sitting RIGHT here?!”

How can there be a shortage when I, a cybersecurity professional available for hire, am not overwhelmed with requests for help? How is it that EVERY cybersecurity consulting company in the world isn’t experiencing exponential growth? Why do I see cybersecurity practitioners all but begging for jobs on LinkedIn almost every day?

It can only be because those looking for help are simply looking in the wrong place, and here’s an example;

Continue reading →

GDPR Fines

Does ISO 27001 Certification Give You Immunity From GDPR Fines?

Posted by

4

I was actually chuckling to myself as I wrote that title because I know you were thinking [the equivalent of] one of the following as you clicked on the link:

  • If you have not read the GDPR: “That would be awesome!”
  • If you have read the GDPR: “Don’t be so bloody stupid.”
No, of course ISO 27001 certification won’t give you immunity from GDPR fines, even those related to data security breaches, which is the only thing 27001 actually covers. Data security (as opposed to data processing) is a single Article out of 99, and the fines related to data loss aren’t even the big ones (2%, not 4%). That said, I believe there is a much greater chance of you being fined for lack of security than for any illegalities in your personal data processing. It’s a matter of exposure. Continue reading →
GDPR Expert

Finding the Right GDPR ‘Expert’ to Help Your Business

Posted by

0

I have lost count of the number of times I have included phrases like; “You have to ask the right questions.” into my blogs, or into conversations with prospective clients. One of my primary roles as a consultant is to to either help my clients do just that, or to give them the right answers first if they are just too far behind the curve. This is very easy in security, the ‘basics’ have not changed for generations, nor will they ever. So, for example, the question is never; “What technology do I need?”, it’s; “What function does the risk assessment say I need?” But when it comes to GDPR, asking the right questions involves a significant amount of research and homework. Not only do you actually have to read the damned thing several times yourself, you have to understand it enough to apply it to your unique requirements. You have to be able to take the next step or nothing will happen. Continue reading →