Please enable JavaScript.

Coggle requires JavaScript to display documents.

Cyber secutiry, Cyber security - collections of measures that can be used…

- - - - Increasingly depend
        on technologies:
        IoT, Cloud, ...
    - - Dual nature
        of AI
  - - - From Top-management
        to back office staff
  - - - block access to our device,
        until some money is paid.
    - - Target an employee and try
        him to do some actions that
        will lead to cyber breach
    - - Link to download viruses
        which block the computer
    - - DDOS, etc
  - - - Obligations
    - - Data breach notification
- - - - In US and China - yes
      - Patchwork of acts and
        regulatory guidelines
    - - Accountability.
        Obligations to be respected
        
        Compliance with reqs.
        GDPR Art 5§2
        
        Controller: able to demonstrate
        compliance. GDPR, Art 24
      - Associated Liability
        
        Administrative
        GDPR art 83. FDPA 29.1
        
        Civil. GDPR, Art 82.
        FADP Art 15
        
        Criminal. FADP 34.
  - - - FINMA guidelines
      - Ordonance on DPA.
        Art 8-12
    - - Define more precisely measures
        to be taken to comply with security
      - ISO norms 27001, related to information technology
        Increase the level of security
    - - Each company must implement adequate security measures against unauthorized or unlawful processing of personal data
  - - - Requirements for the consent (GDPR 7)
      - Information to be provided to the data subject (GDPR 13-14)
      - Access right (GDPR 15)
      - Security measures (GDPR 32)
      - Data transfer (GDPR 49)
- - - - New DPA Art 22:
        Without undue delay
      - within 72 hours.
        GDPR Art 33
      - FINMA: 24 hours
    - - If there is high risk for rights
        and freedom of individuals
      - Swisscom 2018 : 800 000 customers data breach.
        Eve no duty to notify
    - - Threshholds
        
        No Quantitative
        
        Even single data lost
        triggers notification duty
        
        Qualitative
        
        Only to personal data
        and if risk for individual
        
        No notification for raw data
        or trade secret
      - Notification due to
        contractual obligations