In this lesson, we're going to discuss audits
and compliance.
Now, audits and regulatory compliance are critical aspects
that organizations must navigate to ensure data integrity,
confidentiality, and availability.
These days, our enterprise networks are not just confined
to a single location or region,
and instead they span across various geographical borders,
and this makes them subject to many different laws
and regulations that you may need to be aware
of when you're working in the field.
So in this lesson, let's take a quick look at the concept
of data locality and how it relates to audits
and compliance due to contractual requirements
like the Payment Card Industry Data Security Standard
known as PCI DSS,
and regulations like the General Data Protection Regulation
known as GDPR.
First, let's take a look at data locality.
Data locality refers to the geographic location
where data is stored and processed.
The significance of data locality
really arises from the various legal
and regulatory requirements that dictate
how data is going to be handled in different regions
of the world.
It's important for you to realize that every country
has its own laws that govern data protection, data privacy,
and data sovereignty.
For example, some countries mandate that certain types
of data must be stored
and processed within their own country's borders,
and that their citizens data cannot be stored on servers
outside of their national boundaries.
I actually ran into this myself when working
as an IT director a few years ago over in Europe.
When I was working for a large organization,
we had one small email server
that was running locally in Greece
to support a few hundred employees who worked there.
In my role, I was responsible for all the network access
across Europe from my organization,
and we had recently gone through the process
of migrating most of our company's email servers
into the cloud and consolidating them into one region.
But this one little exchange server
was still required to remain inside of Greece
because of their own data sovereignty laws
in regard to the storage of personally identifiable
information for their citizens.
So even though I was able to migrate the other 10
or 20 countries into our cloud-based environment,
I was still required to maintain a small on-premise network
solution to support this single email server in our Greek
office to meet the regulatory requirements
under their national laws.
Now, another concern with data locality is determining
where the data should be stored since storing data
closer to where it will be used could reduce latency
and improve your performance.
This is particularly important
for real-time applications and services.
So in those cases, you may opt
to use a cloud-based data center
that's closer to your end users.
In the example of this European network I used to run,
we actually did this when we migrated into the cloud.
We could have put our servers into the AWS cloud
over in the United States where our organizations
headquarters was located, but we found that using
the European data centers was actually a better
option for us because about 95% of our users were located
inside of Europe, and this increased our speed
and performance by using data centers that were closer
to our end users.
Another important aspect
of data locality is focused on risk assessments
and risk management because we have to understand
and identify any potential legal
and compliance risks that are associated with data storage
and transfer, which is then going to be determined mostly
by the location of where the data is being created,
where the data is processed,
and where the data is being stored.
Second, let's take a look at the Payment Card Industry
Data Security Standard.
Now, the Payment Card Industry Data Security Standard,
more commonly referred to simply as PCI DSS, is a set
of security standards designed to ensure that all companies
that accept process, store
or transmit credit card information
maintain a secure environment to do so.
Well you'll hear many people call PCI DSS a regulation.
This is technically not a true statement.
Now a regulation is a law that must be followed,
but PCI DSS isn't a law
because it wasn't created by a governmental organization.
Instead, PCI DSS is considered a contractual requirement
that's being imposed on any companies
that want to accept, process, store,
or transmit credit card information.
Now, due to this contractual requirement,
any organization dealing with cardholder data must comply
with the requirements set forth
in the Payment Card Industry Data Security Standard.
This includes measures for network architecture,
software design, and other protective measures.
To validate that organizations are meeting
these requirements, audits and compliance checks
are routinely performed to ensure a secure network
is being maintained,
that cardholder data is being protected,
that a vulnerability management program exists,
that strong access control measures have been implemented,
that regular monitoring and testing
of your networks is occurring,
and that your information security policies
are being properly followed.
Whenever you're designing an enterprise network,
you should ensure that it's designed to segment
and protect cardholder data environments through the use
of firewalls, intrusion detection, and prevention systems,
and robust access controls.
Third, let's take a look at the General Data
Protection Regulation.
The General Data Protection Regulation,
more commonly referred to simply as GDPR, is a regulation
or law created by the European Union
that is focused on data protection and privacy
in the European Union and the European economic area.
GDPR is used to address the transfer of personal data
outside the European Union and the European economic area.
Now just because this is a European Union law
doesn't mean that those of us working outside
of Europe can simply ignore it.
In fact, GDPR applies to all organizations
that are operating within the European Union,
and for those outside the European Union
that are offering goods or services to individuals
inside of the European Union as well.
The General Data Protection Regulation provides individuals
with greater control over their personal data,
including the right to be informed, the right of access,
the right to rectification, the right to erasure,
and the right to restrict processing.
Your organization has to implement measures that comply
with the General Data protection regulation principles
like data minimization, accuracy, storage limitations,
integrity, and confidentiality.
This includes conducting data protection impact assessments,
appointing data protection officers,
and implementing effective data breach response plans.
Now, when it comes to auditing
and compliance, it's really important that you realize
that compliance is not just a one-time activity,
but it's more of an ongoing process.
Your organization needs to implement a continuous monitoring
and auditing program that implements the proper tools
and processes to continuously monitor data flows
and access within your networks.
Additionally, you should consider regular audits to ensure
compliance with relevant standards and regulations
like PCI DSS and GDPR.
Your employees will also require training on the auditing
and compliance process, including a specific requirements
for those standards and regulations
that may apply to your organization.
Part of this training should also be focused
on the implications of non-compliance,
including the potential legal
and financial penalties that could apply to the organization
and its employees if compliance is not fully achieved
within these standards and regulations.
Finally, it's important that your organization takes
the time to develop clear policies
and procedures for data handling, access control,
and incident response.
These policies should be consistently enforced
across your organization to ensure
that you can pass any future compliance audits too.
So remember, our organizations span across geographic
boundaries, and this means our organizations are now
required to follow new and different standards
and regulations based on the locality of your data.
Data locality refers to the geographic location
where data is stored and processed.
Depending on your organization's industry
and location, you may be required
to follow things like PCI DSS and GDPR pretty closely.
The Payment Card Industry Data Security Standard
or PCI DSS is a set of security standards designed
to ensure that all companies that accept process, store
and transmit credit card data
are going to maintain a secure environment.
The General Data Protection Regulation,
or GDPR is a regulation of law created by the European Union
that is focused on data protection
and privacy inside the European Union
and the European economic area.
It's important to understand the requirements
of data locality, PCI DSS, and GDPR,
so you can maintain data integrity,
protect your customer's information,
and avoid potential legal and financial penalties as well.