The EU is Taking Cybersecurity More Seriously. Are You?

by Nov 21, 2019

Categories

Tags

Administration agent-based monitoring Agentless Monitoring alert responses alert thresholds alerting Alerts Amazon Aurora Amazon EC2 Amazon RDS Amazon RDS / Aurora Amazon RDS for SQL Server Amazon Redshift Amazon S3 Amazon Web Services (AWS) Analytics application monitoring Aqua Data Studio automation availability Azure Azure SQL Database azure sql managed instance Azure VM backup Backup and recovery backup and restore backup compression backup status Backup Strategy backups big data Blocking bug fixes business architecture business data objects business intelligence business process modeling business process models capacity planning change management cloud cloud database cloud database monitoring cloud infrastructure cloud migration cloud providers Cloud Readiness Cloud Services cloud storage cloud virtual machine cloud VM clusters code completion collaboration compliance compliance audit compliance audits compliance manager compliance reporting conference configuration connect to database cpu Cross Platform custom counters Custom Views customer survey customer testimonials Dark Theme dashboards data analysis Data Analytics data architect data architecture data breaches Data Collector data governance data lakes data lineage data management data model data modeler data modeling data models data privacy data protection data security data security measures data sources data visualization data warehouse database database administration database administrator database automation database backup database backups database capacity database changes database community database connection database design database developer database developers database development database diversity Database Engine Tuning Advisor database fragmentation database GUI database IDE database indexes database inventory management database locks database management database migration database monitoring database navigation database optimization database performance Database Permissions database platforms database profiling database queries database recovery database replication database restore database schema database security database support database synchronization database tools database transactions database tuning database-as-a-service databases DB Change Manager DB Optimizer DB PowerStudio DB2 DBA DBaaS DBArtisan dBase DBMS DDL Debugging defragmentation Demo diagnostic manager diagnostics dimensional modeling disaster recovery Download drills embedded database Encryption End-user Experience entity-relationship model ER/Studio ER/Studio Data Architect ER/Studio Enterprise Team Edition events execution plans free tools galera cluster GDPR Getting Started Git GitHub Google Cloud Hadoop Healthcare high availability HIPAA Hive hybrid clouds Hyper-V IDERA IDERA ACE Index Analyzer index optimization infrastructure as a service (IaaS) infrastructure monitoring installation Integrated Development Environment interbase Inventory Manager IT infrastructure Java JD Edwards JSON licensing load test load testing logical data model macOS macros managed cloud database managed cloud databases MariaDB memory memorystorage memoryusage metadata metric baselines metric thresholds Microsoft Azure Microsoft Azure SQL Database Microsoft PowerShell Microsoft SQL Server Microsoft Windows MongoDB monitoring Monitoring Tools Monyog multiple platforms MySQL news newsletter NoSQL Notifications odbc optimization Oracle PeopleSoft performance Performance Dashboards performance metrics performance monitoring performance schema performance tuning personally identifiable information physical data model Platform platform as a service (PaaS) PostgreSQL Precise Precise for Databases Precise for Oracle Precise for SQL Server Precise Management Database (PMDB) product updates Project Migration public clouds Query Analyzer query builder query monitor query optimization query performance Query Store query tool query tuning query-level waits Rapid SQL rdbms real time monitoring Real User Monitoring recovery regulations relational databases Releases Reporting Reports repository Restore reverse engineering Roadmap sample SAP Scalability Security Policy Security Practices server monitoring Server performance server-level waits Service Level Agreement SkySQL slow query SNMP snowflake source control SQL SQL Admin Toolset SQL CM SQL code SQL coding SQL Compliance Manager SQL Defrag Manager sql development SQL Diagnostic Manager SQL Diagnostic Manager for MySQL SQL Diagnostic Manager for SQL Server SQL Diagnostic Manager Pro SQL DM SQL Doctor SQL Enterprise Job Manager SQl IM SQL Inventory Manager SQL Management Suite SQL Monitoring SQL Performance SQL Quality SQL query SQL Query Tuner SQL Safe Backup SQL script SQL Secure SQL Security Suite SQL Server sql server alert SQL Server Migration SQL Server Performance SQL Server Recommendations SQL Server Security SQL statement history SQL tuning SQL Virtual Database sqlmemory sqlserver SQLyog Storage Storage Performance structured data Subversion Support tempdb tempdb data temporal data Tips and Tricks troubleshooting universal data models universal mapping unstructured data Uptime Infrastructure Monitor user experience user permissions Virtual Machine (VM) web services webinar What-if analysis WindowsPowerShell

Cybersecurity is an issue that is becoming more important every day. A quick glance at the news is liable to alert you to a new data breach that has put sensitive and personal data at risk. In some cases, millions of individuals are affected by having the information they have entrusted to a third-party compromised, misused or stolen. As society continues its evolution toward more reliance on computer systems and networks, the need to adequately address cybersecurity concerns gains greater importance.

While individual organizations may concentrate more resources on the problem, instituting strong and enforceable cybersecurity regulations has been something that is sorely lacking. But just as they have led the way in enhanced data privacy with the General Data Protection Regulation (GDPR), the European Union (EU) is changing the game regarding cybersecurity standards. The newly enacted EU Cybersecurity Act mandates changes that will impact EU countries and citizens as well as companies that do business with them.

What is the EU Cybersecurity Act?

The EU Cybersecurity Act was adopted on April 17, 2019, and became effective June 27, 2019. Some of its provisions will not be put in place until June 28, 2021.

It is comprised of two parts. The first gives the European Agency for Network and Information Security (ENISA) a permanent role. The agency now has a permanent mandate to perform technical advisory as well as operational activities that revolve around helping EU Member States prevent, detect and react to cyber incidents.

The second part of the Act establishes an EU cybersecurity certification framework focused on information and communication technology (ICT) products, services, and processes. Conformity with the Act and penalties for non-compliance will be handled by bodies formed in the individual EU’s Member States. The purpose of the act is to foster public trust in the digital solutions that impact the privacy and security of an individual’s sensitive and personal data.

The items covered by the Act are broadly defined and essentially encompass all types of hardware and software products.

  • ICT products are any element or group of elements that are part of a network or information system.

  • ICT services are those which involve the transmission, storage, retrieval and processing of information using networks and information systems.

  • ICT processes are any set of activities used to design, develop, provide or maintain ICT products and services.

Those definitions pretty much cover everything that an IT hardware or software company does. The Act will evolve through the adoption of certification schemes that will be introduced to address current laws or policies, the state of emerging cyber threats, and market demand. The European Cybersecurity Certification Group (ECCG) and the Stakeholder Cybersecurity Certification Group (SCCG) fill an advisory role and will make recommendations regarding the standardization and certification schemes that will be enacted.

A five-step process will be used for the development and adoption of a new certification scheme. The steps are:

  1. A certification scheme is suggested by the ECCG or SCCG;
  2. The European Commission requests that ENISA prepares a draft certification;
  3. ENISA prepares a draft of the scheme;
  4. ENISA consults with industry, stakeholders, and standards groups;
  5. The scheme is adopted by the EU.

Certification schemes can specify a basic, substantial or high assurance level based on the risk of the item being certified. The goal of ENISA is to have a consistent flow of certification standards that go through the multi-step process before implementation. Certifications will be prioritized to address high-risk items that have a wide impact on the IT community.

The Impact of the Act on U.S. Companies

Companies outside of the EU that wish to remain competitive will need to comply with specific standards that affect their product or risk being seen as an inferior solution. Businesses should monitor ENISA and EU websites for updates on new certification schemes. Decisions need to be made concerning the viability of non-compliance and any penalties that may be enforced. They may also have to navigate situations where EU and U.S. standards clash.

Remaining Compliant with Cybersecurity Regulations

The risks of noncompliance with any cybersecurity or privacy regulations can be severe. One of the tasks associated with addressing certifications developed by ENISA is to understand the sensitive data that needs to be protected when providing a given service or product. This implies finding where in your systems this type of information is stored.

IDERA’s SQL Compliance Manager offers a comprehensive platform from which to identify the sensitive data in your databases and create reports to provide compliance evidence. The tool includes settings that address many current compliance standards as well as the ability to create customized audit configurations to deal with new and changing standards. It can help your business prepare for the coming wave of EU cybersecurity standards. SQL Compliance Manager enables you to be serious about the security of your data.