Hack yourself for POPIA readiness

With the Protection of Personal Information Act (POPIA) coming into full effect in July 2021, and bringing with it the threat of financial and reputational damages for organisations that are found to be in contravention, businesses need to take a more proactive approach toward cyber security, including ongoing penetration testing, and continuous refinement of policies and procedures around dealing with personal information.

In a digital age where businesses are more reliant on online and cloud services to interact and engage with customers and even sell their products and services, the impact to organisations and the rewards to threat actors in bringing down or breaching these services are increasing rapidly. Not only are the threats increasing daily, they are becoming more dynamic and growing in complexity. This can leave defence technologies – which are by nature more static than the evolving threat landscape – exposed.

The breaches have been growing in number, with more businesses around the globe being targeted, and the personal information of tens of thousands or even millions of individuals being compromised. In the past, such was often greeted with uproar and indignation from consumers, only for the story to fade away over a matter of weeks. This has been changing locally and abroad; the implementation of data privacy regulations in the US, UK and EU have seen large corporations being penalised for the loss of customer data during breaches, including British Airways, Equifax, Google, Uber and Yahoo, among others.

Similarly, the PoPIA Act states that organisations must take appropriate measures to protect personal information against unlawful access or processing, as well as loss, damage, or unauthorised destruction. In a nutshell, it is all about first getting consent from an individual, and then putting in place policies, procedures and technologies to ensure proper protection and confidentiality of personally identifiable information, from point of capture, to transmission, processing and storing.

Non-compliance can result in the Information Regulator imposing sizable penalties of up to R10-million, imprisonment of up to 10 years, or even both. Worse than the financial impact (which larger companies might be able to cough up), is the reputational damage, with the Act requiring affected organisations to publicly acknowledge breaches, disclose what was affected and more, putting their brand in a bad light.

Considering that network and data breaches now go beyond the realm of technical challenges and into having a financial implication for businesses, what can they do to better protect themselves? Organisations will have to be more diligent in identifying all of their assets, looking at where and how data is stored, discovering what information sits on every system across your organisation (what about confidential data stored on employee laptops and not on secure shared drives?) and more. Systems are also continually changing as updates are rolled out, and controls and policies need to be put in place to keep track of all information.

Making ongoing testing the norm

As such, rather than just implement measures and hope it does the work, it is becoming increasingly important for organisations to carry out regular penetration tests to uncover exploitable vulnerabilities and identify the impact to the business – before a hacker does. Ongoing testing militates against future issues, provides assurance of the security of a system, evaluates how a potential threat actor could gain access, prioritise gaps to be dealt with and to be better equipped to protect themselves against cyber attacks.

Organisations should turn to partners who fully understand the requirements of regulation such as PoPIA, as well as cyber security, data privacy and more, as well as use trusted methodology – tailored to meet the customer’s environment – that takes into account guidelines from sources such the Open Web Application Security Project (OWASP), Payment Card Industry (PCI), METRE Attack Framework and the Technical Guide to Information Security Testing and Assessment. At the very least, these tests should encompass the following:

• Gathering publicly available information – using sources such as search engines and websites to map out an organisation’s public footprint and point out areas of concern
• Network scanning – performing automated sweeps of IP addresses of systems provided and discovered from on-network and off-network sources
• System profiling – identifying operating systems and version numbers running on the system for further testing
• Service profiling – identifying services and applications running on systems, as well as their version numbers for further testing
• Vulnerability identification, validation and exploitation – potential vulnerabilities are identified and validated to minimise errors (false reports of problems). This involves attempts to exploit the found vulnerability

There is also a growing need to drive awareness around PoPIA – as has been stipulated by the act – in order to build familiarity with the regulation, and to ensure that employees working with personally identifiable information are fully aware of what the act requires from them. It goes beyond just one act, however, and organisations need to use non-technical language so that employees are clearly aware of the sensitivities around working with such data, as well as the dangers of storing such data on unsecured personal devices.

This has become especially critical in an age of remote working, so that organisations can ensure that confidential data is only accessible by authorised persons, and put in place the necessary policies and procedures to ensure that such information is only stored in the organisation’s secured and shared storage space – be it a data centre or a cloud service. With PoPIA in full effect, not getting this right has become an exceedingly costly proposition for business.