TopPodcast.com
Menu
  • Home
  • Top Charts
  • Top Networks
  • Top Apps
  • Top Independents
  • Top Podfluencers
  • Top Picks
    • Top Business Podcasts
    • Top True Crime Podcasts
    • Top Finance Podcasts
    • Top Comedy Podcasts
    • Top Music Podcasts
    • Top Womens Podcasts
    • Top Kids Podcasts
    • Top Sports Podcasts
    • Top News Podcasts
    • Top Tech Podcasts
    • Top Crypto Podcasts
    • Top Entrepreneurial Podcasts
    • Top Fantasy Sports Podcasts
    • Top Political Podcasts
    • Top Science Podcasts
    • Top Self Help Podcasts
    • Top Sports Betting Podcasts
    • Top Stocks Podcasts
  • Podcast News
  • About Us
  • Podcast Advertising
  • Contact
Not in our directory?
Add Show Here
Podcast Equipment
Center

toppodcastlogoOur TOPPODCAST Picks

  • Comedy
  • Crypto
  • Sports
  • News
  • Politics
  • True Crime
  • Business
  • Finance

Follow Us

toppodcastlogoStay Connected

    View Top 200 Chart
    Back to Rankings Page
    News

    State of Cybercrime

    Join us for State of Cybercrime, where experts discuss the latest trends and developments in the world of cybercrime and provide insights into how organizations can protect themselves from potential threats.

    Sponsored by Varonis

    Advertise
    • Apple Podcasts
    • Google Play
    • Spotify

    Latest Episodes:
    How Infosec Can Implement Diversity & Inclusion Programs to Address Workforce Shortage and Make More Money Too Jun 15, 2018
    Show notes

    Data breaches keep on happening, information security professionals are in demand more than ever. Did you know that there is currently a shortage of one million infosec pros worldwide? But the solution to this “man-power” shortage may be right in front of and around us. Many believe we can find more qualified workers by investing in Diversity & Inclusion programs. According to Angela Knox, Engineering Director at Cloudmark, "We're missing out on 50% of the population if we don't let them [women] know about the job." For skeptics: creating a more diverse workplace isn't about window dressing. It makes your company more profitable, notes Ed Lazowska, a Professor of Computer Science and Engineering at the University of Washington-Seattle. "Engineering (particularly of software) is a hugely creative endeavor. Greater diversity — more points of view — yields a better result." According to research from Center of Talent Innovation, companies with a diverse management and workforce are 45 percent more likely to report growing market share, and 70 percent likelier to report that their companies captured a new market. I wanted to learn more about the benefits of a D&I program, and especially how to create a successful one. So I called Allison F. Avery, Senior Organizational Development & Diversity Excellence Specialist at NYU Langone Medical Center, to get the details from a pro. She is responsible for providing organizational development consultation regarding issues such as diversity and inclusion, performance improvement, workforce engagement, leadership development, and conflict resolution. In part one of our interview, Ms. Avery sets the foundation for us by describing what a successful diversity & inclusion program looks like, explaining unconscious bias and her thoughts on hiring based on one's social network. Transcript Cindy Ng: Allison Avery is a senior organizational development and diversity specialist at NYU's medical center. She is responsible for providing organizational development, consultation regarding issues such as diversity and inclusion, workforce engagement, leadership development and conflict resolution. In our interview, Allison demystifies common misperceptions about diversity and inclusion, offers a successful framework and methodology to implement D&I and, yes, confirms that diverse organizations do make more money. Can you define for us what diversity and inclusion means? Allison Avery: The way that I like to define, or the way that I'm going to talk about diversity, is really referring to the richness of human differences. And so, that can mean anything from socio-economic status, race, ethnicity, language, nationality, sexual orientation, religion, all the way to learning styles and life experiences. I know, for the context of this conversation. We're really going to target specifically on a lot with regard to race, and ethnicity and gender because that's really who's primarily underrepresented in the tech field. We're going to talk a lot about that, but diversity in and of itself primarily just means, really, difference, and it's sort of a naturally-occurring phenomenon. And then, inclusion is the way in which we engage that diversity. So, it refers to active, intentional and ongoing engagement with that diversity. It's the way that we foster belonging, that we value and encourage engagement and that we really connect individuals throughout. Whether it's an organization or institution, to leverage their excellence, leverage their skills, leverage their skill sets and promote them to grow into the climate and the culture that we're trying to cultivate within an organization, within an institution and even within an industry. So, it's the way that we intentionally, and ongoingly and actively engage the diversity at hand. Cindy Ng: Describe for us the kinds of diversity and inclusion programs you've implemented and what has been successful. Allison Avery: There are a couple of different arenas that I think diversity and inclusion programming gets parsed into. One is primarily along the lines of recruitment and retention. Now, in medical school, we tend to not have any general issue with retention, but that tends to be in the domain of professional development. And that's pervasive throughout any industry, and I see that within a lot of the articles I was reading in the tech industry. There are some initiatives going on through Google and Twitter of trying to recruit individuals from different industries to companies, and that's just a pervasive element. So, we do a lot of recruiting here at the medical school for students from the educational pipeline. So, we go to undergraduate institutions, we have summer programs for students that are rising juniors and seniors to come and spend the summer to do basic science research, primarily targeted for Blacks and Latinos because those targeted minority groups are underrepresented in medicine. Only about 6% of medical school matriculants are Black-identified and about 4% are Hispanic-identified in the country. About 56% are white-identified matriculants in medical school in 2014. So, there's a huge underrepresentation and, as we see the shifting demographics of the country over time, minorities will become the majority by 2050. That's kind of the projected...and even before, that's kind of of the projected year. So, we see a kind of need for greater representation in a medical school, so we do a lot of recruitment effort. NYU just matriculated its highest composition of diversity this past year or so. The entering class of 2014 was the most diverse ever, and so our efforts were quite rewarded in having a cultivated class of compositional diversity. That was a very successful effort and that is from going schools to having a very diverse group of individuals on the screening committee, on the interview committee. We have multiple mini interviews, so we have, where individuals do not review the full record. When students come into interviews, we try to eliminate aspects of bias. So, there's trainings on unconscious bias for all the interviewers, trainings on unconscious bias for all the screeners. That's another effort that we do. So, recruitment is a really big, targeted effort with regard to any industry for trying to attract and recruit underrepresented minorities. Another area is educational enrichment. And so, there's a lot of efforts to look at how do we ameliorate and reduce health and health care disparities. That's basically looking at cultural competency training for all physicians, because healthcare is something, and rendering appropriate healthcare and rendering it across different cultural lines, is something that every physician needs to have the capacity for, especially when we're looking at the diversity in the pluralistic community of the patient population that all physicians are needing to have the capacity to serve. And so, I think that that's also generalizable to the tech industry when you look at the shifting demographics of the country of users. So, there is a huge pluralistic nation that we have, and people have different needs and there are very different markets that can be targeted and marketed toward. Having different educational initiatives, looking at how do we reduce health and health care disparities, and training students has been a very big initiative within the curriculum. So, how do we basically educate our entire population of students to be able to render care for a huge and diverse patient population? They need to know about things like health disparities, they need to know about things like social determinants of health. They need to know about how bias might impact their decision-making on treating different types of patients of certain races, of certain genders, of certain sexual orientations. And they need to know how, generally, socially disadvantaged groups tend to receive worse quality healthcare. Cindy Ng: Earlier you mentioned unconscious bias. Can you define that term for us? Allison Avery: Unconscious is pretty much anything that's outside of our conscious awareness, which is primarily the main way that we operate, it’s likened that about 90% of our mental processes and the way that we operate is outside of consciousness. So, the unconscious is pretty much any mental process that is inaccessible to consciousness, but it influences our judgments, our feelings and our behavior. It's pretty pervasive. And then, bias is really neutral term. It gets a kind of negative rap and it's something that we cannot do without, nor would we want to. But bias is pretty much, it's just a tendency or an inclination, but it's one that prevents an unprejudiced consideration of a question. So, it has this sort of stigma to it but bias is really, it's just a neutral thing. But the way that we understand unconscious bias and the way that we're talking about it, is in this arena of prejudice, social stereotypes and attitudes that we form about certain groups of people without our intention or our conscious awareness. And that's what we really mean when we're talking specifically about unconscious bias as it relates to certain groups of people and how that influences the way that we engage with people. That's how I'm sort of using the term as it relates to D&I work in our workspace and how it might prevent the hiring of a person, how it might impede diversity and inclusion efforts, and that's been noted as one of a main and contributing barrier to compositional diversity effort. Hiring practices in the recruitment phase, in the interview phase, in trying to really, really have a very, very diverse workplace, unconscious bias has been kinda targeted and denoted as one of a huge area or an impediment to having the diversity that we would like to consciously see. And I think it's really important to make the distinction. It's the distinction between the way that we consciously believe, and we might have these very consciously-held egalitarian views, which I believe that we do if you look at social attitudes in this country over the past 40 years and the evolution of which they've grown, and they've changed and they've evolved very, very drastically. It's more stigmatized now to be a racist in this country than probably almost anything else. It's very, very stigmatized. However, when you look at some of our unconscious attitude and what some of the outcomes, a lot of our actual practices, i.e. some of the health outcomes, some of our housing outcomes, some of the actual behaviors and outcomes have remained unchanged. So, like you were saying, in the tech industry, there have been a lot of things that have remained unchanged for the past 15 years or, you know, two years or 10 years. It's that spectrum or that dichotomy between the way that we consciously believe and, sometimes, the way that our unconscious behaviors and the manifestation of which gets played out. And bridging those two is the space of bias, and trying to bring those two things a little bit more in alignment and a little bit more closer together. So, we have there pretty egalitarian conscious attitudes, but the outcome of which doesn't really reflect that when you look at some of our composition in the workspace, some of our health outcomes and the way that we hope to think of ourselves. You know, look at the composition of our prison system, look at the composition of women in the tech field. Cindy Ng: It's popular in the tech field to hire based on one's social network. What's your opinion on that? Allison Avery: I think on face value and on first flush, that seems like a good idea but I don't think we've tracked the full ramifications of what that means. And I think that there's a way that, on first pass, that seems like a very respectable way to go about doing business, and I think on one level it is. But we need to do a little bit of a deeper dive on what do we mean by things like, how do we define culture fit? How do we define somebody who is aligned with our organization and the diversity that we want? And what are the actual ramifications of just pulling from our social networks? So, when we look at how people's social networks get created and cultivated, they tend to be, like you said, people tend to migrate toward people that are like them. And that tends to also fall within similar social identity categories, socio-economic lines and class status, correct? So, on one level, it seems like a very good...on first pass, if you don't dig any deeper, it seems like a very good idea. Okay. Somebody suggests a friend and that person comes into the organization, and they probably do fit in very well, and they probably get along very well and then you kind of go forward without thinking much further. But then, when you look at the compositional diversity of who, then, you attract, everybody sort of seems to either come from similar schools so you're not getting a diversity of educational experiences, come from similar classes and, potentially, demographics. So, you might have similar social identity categories of composition. When you look at the composition...I was just reading this article called, "What it's actually like to be a black employee in a tech company," and they cited some really, really interesting statistics and I think it's very worthwhile to go over those because the Public Religion Research Institute has some statistics related to people's social networks. And you know, white Americans have 91 times as many white friends as black friends. I think that's really important because three-quarters of whites have entirely white social networks without any minority presence. So, if that's where you're pulling from, what are the odds that you're going to have a huge minority presence if that's the pool that you're pulling from? Clearly, just from a statistical representation, very, very small, correct? But unless you know that and unless you're thinking in those terms, it just seems like a very good idea from first pass. That's why a deeper dive is so much more necessary, and that's why I think that there isn't this intentionally evilness to people who are anti-diversity. It's just that they don't tend to know, nor do they tend to dig, and there's this naiveté of, "Well, invite individuals from their social networks and things should just be fine." But people think that other social networks are much more diverse than they actually are, and that's just not true. And so, once you know that, once you know that, "Okay, if this is our structure, employees are actively encouraged to suggest friends or former colleagues," well, if you also know that your company is comprised of 57% of this, and then you know that those individuals are going to be 91 more times likely to, "Blah, blah, blah," well, then you're going to rethink your methodology. But generally, people don't have that type of statistical awareness or insight into how these social networks are formed or structured, and so they don't understand all the nuance related to recruitment and why it's so difficult to have elements of compositional diversity. Cindy Ng: How would you reshape hiring practices? Allison Avery: So, a couple of different things. One, I would have pervasive unconscious bias training for all hiring managers completely required. I mean, that's just a given and an automatic. Number two, there are some things right at the outset that take people out of the running right away, like affiliate univer…

    Full show notes at the publisher

    Core Security Principles Drive Us into The Future Jun 13, 2018
    Show notes

    While reading about our latest technological advances, such as digital license plates and self-driving cars, I wondered about our industry’s core security principles that set the foundation for all our innovation.

    However, what about user agreements? We’re able to create incredible new advances, however we can’t get our user agreements right. Even though the agreements are for the users, it’s rare that they want to read the legalese. It’s just easier to click ‘accept’. As the author suggests, there must be a better way for end users to interact with tech companies.

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Cyber & Tech Attorney Camille Stewart: The Tension Between Law and Tech (Part 1) Jun 11, 2018
    Show notes

    Many want the law to keep pace with technology, but what's taking so long?

    A simple search online and you'll find a multitude of reasons why the law is slow to catch up with technology - lawyers are risk averse, the legal world is intentionally slow and also late adopters of technology. Can this all be true? Or simply heresy?

    I wanted to hear from an expert who has experience in the private and public sector. That's why I sought out the expertise of Camille Stewart, a cyber and technology attorney.

    In part one of our interview, we talk about the tension between law and tech. And as it turns out, laws are built in the same way a lot of technologies are built: in the form of a framework. That way, it leaves room and flexibility so that technology can continue to evolve.

    Frameworks Reign in Law and Tech

    Camille Stewart

    Hi, I am Camille Stewart. I'm a cyber and technology attorney. I'm currently at Deloitte working on cyber risk and innovation issues, so identifying emerging technologies for the firm to work with. Prior to that, I was a Senior Policy Advisor at the Department of Homeland Security working on cyber infrastructure, and foreign policy in the office of policy. I was an appointee of the Obama administration. And then prior to that, I was in-house at a cybersecurity company. I worked in both the public sector and the private sector on cyber issues.

    Cindy Ng

    Today, we're gonna be talking about the tension between law and technology, where a law takes a lot of time and inquiry to create something that makes sense and hopefully is impactful for years to come, whereas technology, it's really about ideation and creating and bringing product and service to market as quickly as possible.

    Tech people, they want law to catch up with technology. Lawyers wished tech people would understand the law a little bit more. And some have even criticized that the law doesn't move as quickly as technology, and you have a lot of experience both as a cybersecurity attorney in Washington and in the private sector.

    And I'm wondering if there's a deeper divide between the two entities, and I'm wondering if you can share your experience with us in working with lawmakers as well as your experience in the private sector.

    Camille Stewart

    Yeah, so, I mean, I think one misconception is you don't want the law to keep pace with innovation. There's no way for you to legislate for future occurrences and for the ideation and innovation we've talked about.

    You want the law to leave room and flexibility so that technology can continue to evolve. And so that's kind of what has to happen. It's frustrating that there are no legal recourses when an issue comes up, but you almost have to test those boundaries to figure out a framework to fit your bill to address issues that are coming.

    So even the laws that we do build tend to be framework because we need to leave room for that innovation and ideation. And part of the tension between technology communities and lawyers and technology communities and the general public or the government is trust. So technologists don't trust the government with the information that they have, and the government wants to build that trust desperately so that we can leverage the resources that are at the disposal of both.

    You know, the government has a lot of insight and intelligence that they can layer over the tools and capabilities in the private sector, and if they came together, it's great, but there's this base level of trust and understanding of what each is trying to do that if we could bridge that gap, so much more could be done.

    Cindy Ng

    Is there a think tank or a non-profit or some kind of institution that can bridge that gap that you've seen develop over the past few years?

    Camille Stewart

    Yeah, so there are a number that are working on this, whether it's issue-specific, right, "So let's talk about surveillance and bringing people together around that." "Let's talk about a given issue and discuss that." Also the government is trying that.

    Organizations like DHS that work with the private sector quite a bit are trying to build those bridges and find ways to share information in a way that's valuable to both the private sector and the government through things like AIS, the Automated Indicator Sharing system. And it's gonna be a slow process.

    Those trusts are bolted tight.

    Private sector has coalesced together to build trust circles with their peers and people that they know doing work that they understand, and they're sharing information that way. And those mechanisms have become pretty robust and helpful, but the government has to be able to be a part of that for us to really complete the picture, and that's the work that's being done, some through non-profit organizations, NGOs, but also through the government and the private sector starting to get into a room.

    And then, as people move back and forth across lines, right, traditionally people were govies for life, or they were in the private sector. Now there's more movement back and forth, and that'll help build the trust as well.

    Bridging the Gap between Law and Tech

    Cindy Ng

    What would you say to lawyers who need to understand technology and technologists that need to understand the law?

    Camille Stewart

    I would say at a base level, do the work to understand the content. Lawyers need to take the time to understand the technology, to ask the questions, understand what the end goal is, and understanding what the technologist is building and for what end user. And the nice thing is that a lawyer is likely the end user of many of the products that they're speaking to understand, so they can easily understand that perspective. And then do the to work to understand how we got there, how the technologists built that.

    And then technologists, on the other hand, need to be willing to have those conversations and those explanations and understand that lawyering of the past, there was the perception that lawyers were just gonna say no. Right? They're risk averse, they aren't gonna let you ideate and innovate, they're just gonna shut it down. And that's not really true.

    My job as a lawyer and the jobs of lawyers at companies today, especially if they deal with technology and cyber issues, is to lay out the risk, understand the organization’s risk calculus, and to put the information in front of leadership so that they can make an informed decision and then help to build a cast-forward that calculates those risks, that mitigates those risks to the best of their ability and be ready to support the company in what they've done.

    So, with that base level understanding and the willingness to do the work to understand, lawyers can be great assets to technologists because they can be translators, different communities, as well as the company builds out and understands what the risk posture is. It's important to have all key stakeholders as part of that discussion, and lawyers are definitely part of that group.

    Cindy Ng

    So you talk about trust and doing your homework having a baseline knowledge of the other's concepts and principles. What have you seen in your work that has worked that you've seen others reach over the aisle, and are you able to provide an example? And also, what doesn't work?

    Camille Stewart

    I think the biggest catalyst for change is that things happen, right? So, a breach occurs, and you watch this organization scramble to figure out how to right itself after this big occurrence and realizing that the stakeholders that you were encouraged to have in the room initially were essential when this thing exploded.

    And had you accounted for more perspective on the front end in a proactive way, it would have mitigated some of the risk on the back end or you would have been able to right yourself more quickly.

    And so I think watching that occur has started a number of organizations and built a number of frameworks to help organizations get the right people in the room and encourage people to do the work to figure out where different players fall in the conversations that they're having as an organization about how the security is evolving and how technology will be used and integrated in the organization. But I think that outside factors in this area of law and cyberspace evolving has done a lot of the work to encourage the collaboration that's needed.

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    I’m Sean Campbell, Systems Engineer at Varonis, and This is How I Work Jun 04, 2018
    Show notes

    In April of 2013, after a short stint as a professional baseball player, Sean Campbell started working at Varonis as a Corporate Systems Engineer.

    Currently a Systems Engineer for New York and New Jersey, he is responsible for uncovering and understanding the business requirements of both prospective and existing customers across a wide range of verticals. This involves many introductory presentations, proof of concept installations, integration expansion discussions, and even the technical development of Varonis channel partners. Sean also leads a team of subject matter experts(SME) for our innovative DatAlert platform.

    According to his manager Ben Lui:

    Sean Campbell is one of the most talented engineers on my team. He is the regional DatAlert SME and bridged valuable feedback from both customers and the field back to product management. Sean is also an excellent team player and excels at identifying critical data exposure during customer engagements. Overall, Sean is a key contributor to the Varonis organization.”
    The fast paced environment, challenge of data security, and the fact that the sales cycle is far from “cookie cutter” is what Sean enjoys most about his role here. He also values the relationships he has been given the ability to build up over the years on both the Varonis and customer side.

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Data Protectionism: Friend or Foe? May 31, 2018
    Show notes

    Data protectionism - restricting the movement of data between countries - will be an option that governments will elect to implement in the upcoming months and years. As the world economy become more data-driven, impacting global GDPs, they will soon find their way into trade deals, requiring data to be held in servers inside certain countries.

    It’s not just a business decision. Exporting data on individuals is also heavily restricted because of privacy concerns. And we saw a Belgian legislator voice this concern during a discussion with Facebook’s CEO on his value as a user.

    Other articles discussed:

    • CISOs are still cloud skeptics
    • Orlando police and Amazon partner up
    • Junior infosec professionals want promotions
    Tool of the week: Dark Surgeon

    Panelists: Cindy Ng, Kilian Englert, Mike Thompson, Mike Buckbee

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Turning People into Devices May 17, 2018
    Show notes

    Outsourcing tedious tasks is a dream of many and at the latest Google Developer’s conference, the audience beamed when Google Assistant booked an appointment. However, attendees were quick to worry about potential exploits those devices might face.

    Medical devices are a good example of what computerized assistants might face in the future. Yes, medical devices can save lives and certainly serve a more noble cause than outsourcing tedious tasks, but the security aspect of these life-saving pacemakers and defibrillators still require firmware updates.

    Seems that we still haven’t learned our lesson: embed security at the initial stages of design.

    Other articles discussed:

    • Scammers find an opportunity with startups without phone numbers
    • Smartphones can soon determine if you’ll get a loan
    Panelists: Cindy Ng, Kilian Englert, Mike Buckbee, Forrest Temple

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    I’m Brian Vecci, Technical Evangelist at Varonis, and This is How I Work May 14, 2018
    Show notes

    If you’ve ever seen Technical Evangelist Brian Vecci present, his passion for Varonis is palpable. He makes presenting look effortless and easy, but as we all know excellence requires a complete devotion to the craft. I recently spoke to him to gain insight into his work and to shed light on his process as a presenter.

    “When I first started presenting for Varonis, I’d have the presentation open on one half of the screen and Evernote open on the other half and actually write out every word I was going to say for each slide,” said Brian.

    From there, he improvises from the script.

    “I’d often change things up while presenting based on people’s reactions or questions, but the process of actually writing everything out first made responding and reacting and changing the presentation a lot easier. I still do that, especially for new presentations.”

    According to Varonis CMO David Gibson:

    Brian's high energy, curiosity, and multi-faceted skills - technical aptitude, communication skills, sales acumen, and organizational capabilities -make him an exceptional evangelist.

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Attorney Sara Jodka on GDPR and Employee Data, Part II May 09, 2018
    Show notes

    Sara Jodka is an attorney for Columbus-based Dickinson Wright. Her practice covers boths data privacy as well as employee law. She's in a perfect position to help US companies in understanding how the EU General Data Protection Regulation (GDPR) handles HR data. In the second part of our interview, Sara will talk about the relationship between HR data and Data Protection Impact Assessments (DPIAs). Most companies will likely have to take the extra step and perform these DPIAs but there are specific triggers that Sara will delve into. Transcript Welcome, Sara. Sara Jodka: Thank you for having me. IOS: I wanted to get into an article that you had posted on your law firm's blog. It points out an interesting subcategory of GDPR personal data which doesn't get a lot of attention, and that is employee HR records. You know, of course it's going to include ethnic, payroll, 401(k), and other information. So can you tell us, at a high level, how the GDPR treats employee data held by companies? Employee Data Covered By the GDPR SJ: Whenever we look at GDPR, there are 99 articles, and they're very broad. There's not a lot of detail on the GDPR regulations themselves. In fact, we only have one that actually carves employment data out, and that's Article 88 — there's one in and of itself. Whenever we're looking at it, none of the articles say that all of these people have these rights. All these individuals have rights! None of them say, "Well, these don't apply in an employment situation." So we don't have any exclusions! We're led to "Yes, they do apply." And so we've been waiting on, and we have been working with guidances that we're receiving, you know, from the ICO, with respect to …. consent obligation, notice obligation, portability requirements, and any employee context. Because it is going to be a different type of relationship than the consumer relationship! IOS: It's kind of interesting that people, I think, or businesses, probably are not aware of this ... except those who are in the HR business. So I think there's an interesting group of US companies that would find themselves under these GDPR rules that probably would not have initially thought they were in this category because they don't collect consumer data. I'm thinking of law firms, investment banking, engineering, professional companies. US Professional Service Companies Beware! SJ: I think that's a very good point! In fact, that's where a lot of my work is actually coming from. A lot of the GDPR compliance is coming from EU firms that specialize with EU privacy. But a lot of U.S. companies didn't realize that this is going to cover their employment aspects that they had with EU employees that are in the EU! They thought, "Well, because we don't actually have a physical location EU, it doesn't actually cover us." That's not actually at all true.The GDPR covers people that are working in the EU, people who reside in the EU, so to the extent that U.S. company has employees that are working in the EU it is going to cover that type of employee data. And there's no exception in the GDPR around it. So it's going to include those employees. IOS: So I hadn't even thought about that. So their records would be covered under the GDPR? SJ: Yeah, the one thing about the definition of a data subject under the GDPR is it doesn't identify that it has to be an EU resident or it has to be an EU citizen. It's just someone in the EU. When you're there, you have these certain rights that are guaranteed. And that will cover employees that are working for U.S. companies but they're working in the EU. IOS: Right. And I'm thinking perhaps of a U.S. citizens who come there for some assignment, and maybe working out of the office, they would be covered under these rules. SJ: And that's definitely a possibility, and that's one thing that we've been looking for. We've been looking for looking for guidance from the ICO to determine … the scope of what this is going to look not only in an employment situation, but we're dealing with an immigration situation, somebody on a work visa, and also in the context of schools as we are having, you know, different students coming over to the United States or going abroad. And what protection then the GDPR applies to those kind of in-transition relationships, those employees or students. With a lot of my clients, we are trying to err on the side of caution and so do things ahead of time, rather than beg forgiveness if the authorities come knocking at our door. GDPR's Legitimate Interest Exception is Tricky IOS: I agree that's probably a better policy, and that's something we recommend in dealing with any of these compliance standards. In that article, you mentioned that the processing of HR records has additional protections under the GDPR … An employee has to give explicit or consent freely and not as part of an employer-employee contract. [caption id="attachment_10803" align="alignnone" width="800"] GDPR's Article 6 says there are only six lawful ways to process data. If you don't obtain freely given consent, then it gets tricky.[/caption] Can you explain this? And then, what does an employer have to do to process employee data especially HR data? SJ: Well, when we're looking at the reasons that we're allowed to process data, we can do it by consent, and we can also do it if we have a lawful basis. A number of the lawful bases are going to apply in the employer context. One of those is if there is going to be an agreement. You know, in order to comply with the terms of a contract, like a collective bargaining agreement or like an employment agreement. So hire/fire payroll data would be covered under that, also if there is … a vital interest of an employee. There's speculation that that exception might actually be, or that legitimate basis might be used to obtain vital information regarding, like, emergency contact information of employees. And there's also one of the other lawful basis is if the employer has a greater, you know, interest in the data that doesn't outweigh the right of the data subject, the employee. The issue though is most ... when we talk about is consumer data, and we're looking a lot at consent and what actually consent looks like in terms of the express consent, you know, having them, you know, check the box or whatever. In an employee situation, the [UK’s] ICO has come out with guidance with respect to this. And they have expressly said in an employee-employer relationship, there is an inherent imbalance of bargaining power, meaning an employee can never really consent to giving up their information because they have no bargaining power. They either turn it over, or they're not employed. The employer is left to rely only on the other lawful basis to process data, excluding consent, so the contractor allowance and some of the others. But the issue I have with that is, I don't think that that's going to cover all the data that we actually collect on an employee, especially employees who are operating outside the scope of a collective bargaining agreement. In a context of, say, an at-will employee where there is that ... where that contract exception doesn't actually apply. I think there will be a lot of collection of data that doesn't actually fall under that. It may fall into the legitimate interest, if the employer has the forethought to actually do what's required, which is to actually document the process of weighing the employer's interest against the interest of the employee, and making sure that that is a documented process. [ Read the UK's ICO guidelines on the process of working out legitimate interest.] [caption id="attachment_10804" align="alignnone" width="800"] When employers claim a legitimate interest exception to getting employee consent, they have more work to do. [Source: UK ICO][/caption]But also what comes with that is the notice requirement, and the notice requirement is something that can be waived. So employers, if they are doing that, are going to have to — and this is basically going to cover every single employer — they're going to have to give their employees notice of the data that they are collecting on them, at a minimum. IOS: At a minimum. I think to summarize what you're saying is it's just so tricky or difficult to get what they call freely given consent, that most employers will rely on legitimate interest. Triggers for Data Protection Impact Assessments (DPIAs) IOS: In the second part of this interview, we joined Sara Jodka as she explains what triggers a data protection impact assessment, or DPIA when processing employee data. SJ: I think that's required when we're doing requirements for sensitive data, and we're talking about sensitive HR data. A DPIA has be performed when two of the following exist, and there's like nine things that have to be there in order for a DPIA to have to be done. But you bring up a great point because the information that an employer is going to have is going to necessarily trigger the DPIA. [See these Working Party 29 guidelines for the nine criteria that Sara refers to.] The DPIA isn't triggered by us doing the legitimate basis ...and having to document that process. It's actually triggered because we process sensitive data. You know, their trade union organization, affiliation, their religious data, their ethnicity. We have sensitive information, which is one of the nine things that can trigger, and all you need is two to require a DPIA. Another one that employers always get is they process data of a vulnerable data subject. A vulnerable data subject includes employees. IOS: Okay. Right. SJ: I can't imagine a situation where an employer wouldn’t have to do a DPIA. The DPIA is different than the legitimate interest outweighing [employee rights] documentation that has to be done. They're two different things. IOS: So, they will have to do the DPIAs? And what would that involve? SJ: Well, it's one thing that's required for high-risk data processing and that, as we just discussed, includes the data that employer has. Essentially what a DPIA is, it's a process that is designed to describe what processing the employer has, assess the necessity on proportionality to help manage the risk to the rights and the freedoms of the national persons resulting from the processing of personal data by assessing and determining the measures to address the data and the protections around it. It's a living document, so one thing to keep in mind about DPIA is they're never done. They are going to be your corporation's living document of the high-risk data you have and what's happening with it to help you create tools for accountability and to comply with the GDPR requirements including, you know, notice to data subject, their rights, and then enforcing those rights. It's basically a tracking document ... of the data, where the data's going, where the data lives, and what happens with the data and then what happens when somebody asks for their data, wants to erase their data, etc. GDPR Surprises for US Companies IOS: Obviously, these are very tricky things and you definitely need an attorney to help you with it. So, can you comment on any other surprises U.S. companies might be facing with GDPR? SJ: I think one of the most interesting points, whenever I was doing my research, to really drill down, from my knowledge level, is you're allowed to process data so long as it's compliant with a law. You know, there's a legal necessity to do it. And a lot of employers, U.S employers specifically, look at this and thought, "Great, that legal requirement takes the load off of me because I need, you know, payroll records to comply with the Fair Labor Standards Act and, you know, state wage laws. I need my immigration information to comply with the immigration control format." You know, they were like, "We have all these U.S. laws of why we have to retain .information and why we have to collect it." Those laws don't count, and I think that's a big shock when I say, well, those laws don't count. We can't rely on U.S. laws to process EU data! We can only rely on EU laws and that's one thing that's brought up and kind of coincides with Article 88, which I think is an interesting thing. If you look at Article 88 when they're talking about employee data, what Article 88 does is it actually allows member states to provide for more specific rules to ensure that the protections and the freedoms of their data are protected. These member states may be adding on more laws and more rights than the GDPR already complies! Another thing is, not only do we have to comply with an EU law, but we also are going to comply with member states, other specific laws that may be more narrow than the GDPR. Employers can't just look at the GDPR, they're going to also have to look at if they know where a specific person is. Whether it's Germany or Poland. They're going to have to look and see what aspects of the GDPR are there and then what additional, more specific laws that member state may have also put into effect. Interviewer: Right! SJ: So, I think that there are two big legal issues hanging out there that U.S. multinational companies... IOS: One thing that comes to my mind is that there are fines involved when not complying to this. And that includes, of course, doing these DPIAs. SJ: The fines are significant. I think that's the easiest way to put it is that the fines are, they're astronomical, I mean, they're not fines that we're used to seeing so there's two levels of fines depending on the violation. And they can be up to a company's 4% of their annual global turnover. Or 20 million Euros. If you'd look at it in U.S. dollar terms, you're looking at, like, $23 million at this point. For some companies that could be, that's a game changer, that's a company shut down. Some companies can withstand that, but some can't. And I think any time you're facing a $23 million penalty, the cost of compliance is probably going to weigh out the potential penalty. Especially because these aren't necessarily one-time penalties and there's nothing that's going to stop the Data Protection Authority from coming back on you and reviewing again and assessing another penalty if you aren't in compliance and you've already been fined once.I think the issue is going to be how far the reach is going to be for U.S. companies. I think for U.S. companies that have, you know, brick and mortar operations in a specific member state, I think enforcement is going to be a lot easier for the DPA. There's going be a greater disadvantage to, actually, enforcement for, you know, U.S. companies that only operate in U.S. soil. Now, if they have employees that are located in the EU, I think that enforcement is going to be a little bit easier, but if they don't and they're merely just, you know, attracting business via their website or whatever to EU, I think enforcement is gonna be a little bit more difficult, so it's going to be interesting to see how enforcement actually plays out. IOS: Yeah, I think you're referring to the territorial scope aspects of the GDPR. Which, yeah, I agree that's kind of interesting. SJ: I guess my parting advice is this isn't something that's easy, it's something that you do need to speak to an attorney. If you think that it may…

    Full show notes at the publisher

    Varonis CFO & COO Guy Melamed: Preventing Data Breaches and Reducing Risk, Part Two May 07, 2018
    Show notes

    In part two of my interview with Varonis CFO & COO Guy Melamed, we get into the specifics with data breaches, breach notification and the stock price.

    What’s clear from our conversation is that you can no longer ignore the risks of a potential breach. There are many ways you can reduce risk. However, if you choose not to take action, minimally, at least have a conversation about it.

    Also, around 5:11, I asked a question about IT pros who might need some help getting budget. There’s a story that might help.

    Do Data Breaches Impact the Stock Price?

    Guy Melamed

    My name's Guy Melamed, CFO and COO for Varonis. I've been with the company since 2011, in charge of all the financial statements and execution of strategic operational plans, in charge of the legal department, and IR as well. And kind of enjoying the ride.

    Cindy Ng

    There's a discrepancy online where there've been studies that say that breaches don't impact the stock price. Sure, a breach will typically lead to a one-time large expense or maybe smaller reoccurring expenses. There might be a potential decrease in revenue, but in the long term, investors tend to look past the breach, and they really just focus on the strength of the business and the value of the company. What do you think about data breaches and their impact on the stock price?

    Guy Melamed

    I'm not so qualified to talk about statistics on stock price and how a breach would affect a stock price in the short term or in the long term. What I can say is that what we've seen in so many events, in so many breaches that have taken place in the last couple of years, is that if you go back to those companies, and ask them would they have rather dealt with a breach or just buy a software, take measures that can help them in protecting or preventing or minimizing the amount and the magnitude of the breach, I think the answer is pretty obvious.

    So we've seen companies that have gone out of business because of breaches. We've seen companies that will have to deal with litigation for years ahead. So where's that factored in? There's just so many components. It's more of a philosophy that if you can do something active to try and minimize risk, then why not do it?

    I think companies, more from a philosophical perspective, should try and actively take action in order to minimize risk. And companies that are under the belief that it won't affect them and that they're going to be okay, I think are acting slightly irresponsible.

    Data Breaches and Breach Notification

    Cindy Ng

    Let's talk about breach notification. It's said that the time to discovery increases the cost of a data breach, and research has said that most companies take over six months to detect data breaches. If you're in the EU, article 31 of the GDPR says that data controllers, they'll need to notify authorities of a breach within 72 hours at the latest upon learning about the exposure, if it results in a risk to a consumer. If you're already protecting or in the process of protecting your data, how do you reconcile the time in figuring this element out? What do companies need to do? How much are we talking about?

    Guy Melamed

    So the surveys that we've been tracking show that 70% of the beaches are discovered within months or years. And I think a great example of a breach that affected a company years later was a Yahoo deal. This was a breach and I don't know if it was four years ago or three or five years ago, but it was discovered as part of an M&A process and had an effect, an actual quantifiable number that impacted the transaction price.

    So a company would obviously rather try and identify breaches as soon as possible, so they can take action, minimize some of the cost and be transparent with both the customers, the investors, and the shareholders.

    GDPR definitely changes the reporting requirement, and if you're breached, you have to provide that information within 72 hours. That's a short period of time, and in order to be able to comply with that regulation, and in order to have better tracking, you really have to have systems, programs, personnel in place to try to identify this.

    And the fines that come from GDPR, I'm talking about, you know, some of the requirements and some of the fines related to those requirements, are 4% of global revenue or $25 million, whichever is greater. That's a huge number that could affect companies in so many ways, definitely something that from our perspective what we see is causing a lot of interest, causing a lot of discussion, and companies are not ignoring the regulation because of its significance.

    Should You Just Pay the Fine?

    Cindy Ng

    So when you've done the risk analysis of viewing the GDPR fines, companies resigned to paying a fine because the fine isn't that costly. And so let's just pay the fine and get it over with.

    Guy Melamed

    My response is that it probably fits with an analysis or an analogy that says if I go through a red light, I know that the fine is probably minimal and I can live with a fine. There's so many other consequences. First of all, there's, the fine is pretty large when it comes to GDPR.

    There're so many other components that thinking that you can be okay, and just by paying the fine and being breached is definitely not the action that I would like to take as the company's CFO and definitely would try and act in a way that would minimize the risk long term and short term.

    A Story that Might Help IT Pros Get Budget

    Cindy Ng

    And what are your tips for IT managers who are trying to get budget to get a data security solution they need to help prevent a breach?

    Guy Melamed

    So I'm not sure I'm qualified to give tips, but I will share a story that I heard from one of our customers.

    And during a discussion, he was asked, "What is the best way to get budget, in order to get the Varonis product or any other product for that matter that can protect the company in the long term?"

    And his response was, "Make sure the risk assessment, the evaluation and whatever you're doing in that demo is done on the finance documents. If the finance personnel, if the CFO can see how many people have access to the financial statements or any other sensitive information within his folders or her folders and have access to information they shouldn't have access to, you'll find the budget, they'll find the budget."

    So that's definitely something that I I could relate because if I would see risk on files that I know team members shouldn't have access to, we could move things around within the budget to have something purchased that wasn't necessarily budget initially when I can quantify the risk in my mind.

    Minimally, You Should Have a Discussion

    Cindy Ng

    And any final thought as CFO as it relates to the cost if you don't invest in security?

    Guy Melamed

    I think no one anymore can ignore the risk. I think three, four, five years ago, we would talk to companies, show them the risk assessment, show how vulnerable they are, how many sensitive files are open to everyone in the company, show them how much data is open to everyone.

    And people could live with the risk. I don't think people, after all the breaches that have taken place and the amount of risks that companies are dealing with, can ignore it anymore. I think they have to take measures, think about it, or at least have a discussion. If they decide that they want to live with the risk, it should definitely be done after discussion with the legal department, the HR department, CEO, CFO, CISO, if all parties agree that the risk is not worth doing any, taking any action, then at least you had a conversation.

    But if it's decided by one person within the organization and it's not shared between the different departments, between the different roles that would eventually be responsible, then I think that's just not good practice.

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Not Everything is a No Brainer May 04, 2018
    Show notes

    When I asked our podcast panelists about the difficulty in discerning real businesses from fake or answering innocuous questions about your first pet, it can be time consuming, mentally exhausting and not naturally intuitive.

    As technology gets even more difficult to navigate, think about how important it is when presenting time-to-value security solutions to C-Suite executives.

    A popular catchphrase amongst IT pros is: “It’s a no brainer.” When an idea presented is expressed as a no brainer, it’s assumed that the idea has obvious value, when processes and strategic decisions are more complicated than it appears.

    So when it comes to cybersecurity, not everything is a no brainer. Far from it. If it was simple, Atlanta wouldn’t have spent two million to recover from a ransomware attack and in 2016, the cyberinsurance market wouldn’t’ have brought in 3.5 billion in premiums globally.

    Other articles discussed: Monkey loses selfie copyright case

    Tool of the week: Algo

    Panelists: Cindy Ng, Kilian Englert, Kris Keyser, Mike Buckbee

    Want to join us live? Save a seat here: https://www.varonis.com/state-of-cybercrime

    More from Varonis ⬇️

    Visit our website: https://www.varonis.com

    LinkedIn: https://www.linkedin.com/company/varonis

    X/Twitter: https://twitter.com/varonis

    Instagram: https://www.instagram.com/varonislife/


    Previous 1 9 10 11 12 13 22 Next

    Related Podcasts

    Inside Strategic Coach: Connecting Entrepreneurs With What Really Matters

    1

    Inside Strategic Coach: Connecting Entrepreneurs With What Really Matters Business
    WSJ Your Money Briefing

    2

    WSJ Your Money Briefing Business
    FORTUNE Unfiltered with Aaron Task

    3

    FORTUNE Unfiltered with Aaron Task Business
    FORTUNE OnStage Presents: The Most Powerful Women

    4

    FORTUNE OnStage Presents: The Most Powerful Women Business
    Slate Money

    5

    Slate Money Business
    In The Dark – The New Yorker

    6

    In The Dark – The New Yorker Business News
    footer-logo

    Contact Us

    Toll Free: 844-670-7747

    Links

    • Home
    • Top Charts
    • Networks
    • Apps
    • Independents Podcasts
    • Podcast Advertising
    • Podcast News
    • Contact Us
    • About Us
    • Analytics & Insights

    Stay Connected

      Privacy, Terms of Use & Our Code of Ethics Protecting Content Creators Copyrights