• About
  • Archive
  • Contact
  • basefarm.com
Basefarm Blog
  • Big Data blog
  • Cloud blog
  • Security blog
  • DevOps blog
  • Menu

See what many overlook in GDPR data processing agreements

Most likely, by now you have signed data processing agreements with your suppliers of managed IT services. But, are you prepared if your suppliers’ subcontractors move outside Europe and you are in breach with the GDPR?

May 25, 2018 was the deadline for GDPR compliance in most parts of Europa. A few countries including Norway and Luxembourg will catch up soon.

Hard GDPR work has been performed, which most of us have witnessed in our email inboxes. Almost everyone has explained how they process personal data and asked for permission to keep sending you information about products and services.

Maybe you are among those who have been working late hours to get everything ready in time within your own organization? And you feel pretty happy about taking care of other concerns for a while?

Long term GDPR joy

If so, pardon us for addressing GDPR issues again and spoiling the fun of being through. But we have some questions to ask. They might not lead to short term pleasure but rather to long time joy.

The questions concern subcontractor responsibilities.

Most companies controlling and owning data have signed data processing agreements with their managed IT service suppliers which have turned to public cloud service providers like Google Cloud, AWS and Microsoft Azure for back-to-back agreements.

Basefarm compliance advisor Patrick Tahiri has guided several organizations into the GDPR regime. He explains:

“When managed IT service providers such as Basefarm applies public cloud subcontractors as part of their hybrid cloud services, they need back-to-back agreements to secure your responsibilities as data controller through the entire value chain.”

What if subcontractors move?

What is paid less attention to is that public cloud subcontractors provide services from their own subcontractor. If so, Tahiri advises subcontractor agreements to be secured also on this level.

“Be aware that such subcontractors of subcontractors might move their service production out of Europe. Then, you might be in breach with the GDPR. Through recent work, we in Basefarm have witnessed many customers overlooking this potential security problem,” says Tahiri.

A likely scenario? Not what you would expect regularly, but still something to prepare for through contracts and access to skills for moving your services from one cloud to another.

GDPR subcontractor check list

1. Expect most subcontractors to handle GDPR professionally. Still, in the end you are responsible as data controller. Assess risks proactively when evaluating subcontractors. Check if they understand their responsibilities and have GDPR compliance capabilities.
2. See to it that agreements include early warning regulations if a subcontractor moves its services out of the European GDPR zone.
3. Routinely control if the subcontractors actually follow up your agreements. You might perform such controls yourself through questionnaires or team up with others to share GDPR audit work and costs. Basefarm will perform audits on behalf of several customers.
4. Be prepared to move your entire cloud installation to another cloud services provider. Connect appropriate skills. And, as with any backup/restore routine, test that you are able to perform a movement procedure.

Share this entry
  • Share on Facebook
  • Share on Twitter
  • Share on Google+
  • Share on Pinterest
  • Share on Linkedin
  • Share by Mail
Image by Glenn Carstens-Peters from Unspalsh

0-days in Microsoft exchange servers

March 3, 2021/in Security blog /by Rebecca Mybrand

Published: 2021-03-02CVE-2021-26855CVE-2021-26857CVE-2021-26858 CVE-2021-27065  “Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to […]

Read more
https://blog.basefarm.com/wp-content/uploads/2021/03/glenn-carstens-peters-npxXWgQ33ZQ-unsplash-scaled.jpg 1703 2560 Rebecca Mybrand https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Rebecca Mybrand2021-03-03 14:33:042021-03-03 14:34:190-days in Microsoft exchange servers
Image by David Mark from Pixabay

Centreon IT monitoring software and Russian Sandworm hackers

February 16, 2021/in Security blog /by Hans-Petter Fjeld

Basefarm has become aware of published news telling of Russian-accredited advanced persistent threat actors, given the name of Sandworm, having exploited Centreon IT monitoring software. Basefarm is aware that some news report mention Orange as on the customer-list of Centreon and while Basefarm is owned by Orange Business Services we would like to make it […]

Read more
https://blog.basefarm.com/wp-content/uploads/2021/02/beach-1751455_1920.jpg 1277 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2021-02-16 12:32:292021-02-16 12:45:05Centreon IT monitoring software and Russian Sandworm hackers
Image by Peter H from Pixabay

Microsoft Windows Multiple Security Updates Affecting TCP/IP | CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086

February 10, 2021/in Vulnerability bulletin /by Hans-Petter Fjeld

Published: 2021-02-09MITRE CVE-2021-24074MITRE CVE-2021-24094MITRE CVE-2021-24086 “Microsoft released a set of fixes affecting Windows TCP/IP implementation that include two Critical Remote Code Execution (RCE) vulnerabilities (CVE-2021-24074, CVE-2021-24094) and an Important Denial of Service (DoS) vulnerability (CVE-2021-24086). The two RCE vulnerabilities are complex which make it difficult to create functional exploits, so they are not likely in the […]

Read more
https://blog.basefarm.com/wp-content/uploads/2021/02/luggage-3297015_1920.jpg 1236 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2021-02-10 13:53:312021-02-10 13:53:32Microsoft Windows Multiple Security Updates Affecting TCP/IP | CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086
Mikael Karlsson

Don’t get caught in the cold with ransomware

February 8, 2021/in Security blog /by Hans-Petter Fjeld

Ransoms is sadly the trend these days. We want to share a cheap and effective way to enable prevention that most probably fail to consider. Using the ransomware simulator from KnowBe4, RanSim, we could see that our endpoints did no prevention previously. An easy way to minimize the attack surface for ransomware is to use […]

Read more
https://blog.basefarm.com/wp-content/uploads/2021/02/8474B4E3-52AA-4E37-A9E2-1205A48E6669_1_105_c.jpeg 768 1024 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2021-02-08 17:35:152021-02-08 17:35:17Don't get caught in the cold with ransomware
House in winter wonderland.Image by Hermann Schmider from Pixabay

CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo

January 27, 2021/in Vulnerability bulletin /by Hans-Petter Fjeld

Published: 2021-01-26MITRE CVE-2021-3156 “The Qualys Research Team has discovered a heap overflow vulnerability in sudo, a near-ubiquitous utility available on major Unix-like operating systems. Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host.” This is especially bad for multi-user environments where some users have login access, but […]

Read more
https://blog.basefarm.com/wp-content/uploads/2021/01/house-5914171_1920.jpg 1282 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2021-01-27 11:26:022021-01-27 11:26:03CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo
Image by Ervin Gjata from Pixabay

SolarWinds Supply Chain Attack to Compromise Victims With SUNBURST Backdoor

December 16, 2020/in Security blog /by Hans-Petter Fjeld

There is an ongoing news-story concerning SolarWinds and a supply chain attack used by an advanced threat actor to compromise victims with a rather advanced backdoor. Basefarm does not use this affected product, but are aware of at least one of our customer who do. We are working with the customer in question to mitigate […]

Read more
https://blog.basefarm.com/wp-content/uploads/2020/12/snow-5759500_1920.jpg 1280 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2020-12-16 11:09:462020-12-16 11:10:27SolarWinds Supply Chain Attack to Compromise Victims With SUNBURST Backdoor
Image by adege from Pixabay

CVE-2020-17095 | Windows Hyper-V Remote Code Execution Vulnerability

December 11, 2020/in Vulnerability bulletin /by Hans-Petter Fjeld

Published: 2020-12-08MITRE CVE-2020-17095 “A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit this vulnerability, an attacker could run a specially crafted application on a Hyper-V guest that could cause the Hyper-V host operating system to […]

Read more
https://blog.basefarm.com/wp-content/uploads/2020/12/hoarfrost-4739176_1920.jpg 1076 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2020-12-11 11:49:082020-12-11 11:52:00CVE-2020-17095 | Windows Hyper-V Remote Code Execution Vulnerability
Windows update

NSA publishes advisory on 25 vulnerabilities used by Chinese state sponsored hackers

October 23, 2020/in Basefarm SIRT, Security blog, SIRT /by Raymond Aarseth

The National security Agency in the United States recently released an advisory warning of the threat of Chinese state sponsored attacks and detailed 25 vulnerabilities used. The advisory gives detailed information about the vulnerabilities, what it affects and how to remediate them. Most of them are remotely exploited and can be used to gain initial […]

Read more
https://blog.basefarm.com/wp-content/uploads/2020/01/upgrade-3727076_1920.jpg 1153 1920 Raymond Aarseth https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Raymond Aarseth2020-10-23 15:40:482020-10-23 15:40:50NSA publishes advisory on 25 vulnerabilities used by Chinese state sponsored hackers
Remote beach accessPhoto by Caleb George on Unsplash

CVE-2020-16891 | Windows Hyper-V Remote Code Execution Vulnerability

October 14, 2020/in Vulnerability bulletin /by Hans-Petter Fjeld

Published: 2020-10-13MITRE CVE-2020-16891 “A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system.” This is especially bad for “hotel” environment with multiple different tenants that should not be able to influence each other, but it is also bad […]

Read more
https://blog.basefarm.com/wp-content/uploads/2020/10/caleb-george-vz4C-noFOOI-unsplash-scaled.jpg 2560 1920 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2020-10-14 17:57:472020-10-14 17:57:49CVE-2020-16891 | Windows Hyper-V Remote Code Execution Vulnerability
Road giving access to remote areaPhoto by Ricardo Esquivel from Pexels

CVE-2020-16898 | Windows TCP/IP Remote Code Execution Vulnerability

October 14, 2020/in Vulnerability bulletin /by Hans-Petter Fjeld

Published: 2020-10-13MITRE CVE-2020-16898 “A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets.” This vulnerability affects Windows 10, Server 2019 and Server Core versions (see full Security Advisory for proper details). It can be mitigated by disabling a network feature or blocking ICMPv6 Router Advertisement packets. Basefarm and […]

Read more
https://blog.basefarm.com/wp-content/uploads/2020/10/pexels-ricardo-esquivel-3041347-scaled.jpg 2560 1707 Hans-Petter Fjeld https://blog.basefarm.com/wp-content/uploads/2018/03/basefarm-logo-blue-1.png Hans-Petter Fjeld2020-10-14 17:41:352020-10-14 17:45:49CVE-2020-16898 | Windows TCP/IP Remote Code Execution Vulnerability
Page 1 of 61123›»

Recent Posts

  • 0-days in Microsoft exchange servers
  • Centreon IT monitoring software and Russian Sandworm hackers
  • Microsoft Windows Multiple Security Updates Affecting TCP/IP | CVE-2021-24074, CVE-2021-24094, and CVE-2021-24086
  • Don’t get caught in the cold with ransomware
  • CVE-2021-3156 | Heap-Based Buffer Overflow in Sudo
Subscribe via RSS

Recent Comments

  • kuncham on Oracle fixes vulnerabilities
  • Oracle Appications on Oracle Patch Update April 2013
  • Anudeep on How to install Logstash on Windows Server 2012 with Kibana in IIS.
  • Kumar on How to install Logstash on Windows Server 2012 with Kibana in IIS.
  • Øyvind Dyrnes on December 2 – Regularly download security updates and “patches”

Archive

  • 2021
  • 2020
  • 2019
  • 2018
  • 2017
  • 2016
  • 2015
  • 2014
  • 2013
  • 2012
  • 2011
© Copyright - Basefarm Security Blog
  • Facebook
  • Twitter
  • Instagram
  • Mail
BF-SIRT Newsletter 2018-25 Photo by Charles Deluvio ???????????????? on Unsplash BF-SIRT Newsletter 2018-26
Scroll to top