Tribute

Ransomware Attack: How a PDP law compliance can be of any help

By: Sonny Zulhuda

Ransomware

No! We are not talking about how to cure a ransomware attack such as “WannaCry” after it happens. That is not going to happen. Legal compliance is, from the perspective of business continuity and data disaster management, always at the “preventive” side rather than “curative” or “recovery” domain. Just like how technically a data backup is more preventive rather than reactive.

Then, are we saying that complying with Personal Data Protection law is going to prevent incidents like ransomware attack? Not necessarily true. But obviously, by keeping yourself updated about legal requirements pertaining to personal data protection, you will activate a “standby” mode.

Complying with the legal requirements on data protection such as Data Security and Data Retention standards, for example, people in your organisation are made aware that some security measures had to be put in place to protect the personal data system, which often overlaps with other database or information systems in your organisation: payroll system, human resources system, financial system, CRM system, and so on, because in each of those there are personal data of data subjects that you or your organisation process/processes.

That is why, a compliance with PDP law such as the Malaysian Personal Data Protection Act 2010, can be a gateway to better data protection in your organisation from unwanted attacks or other risks to the data integrity and security. In fact, the PDPA 2010 hints that a data due diligence

In fact, the PDPA 2010 hints that a data due diligence such as your data risk management that you conduct in your organisation will not only mitigate the risk to data attack but also will be your “legal defence” in case such attack takes place despite your mitigating measures. This is what transpires from the provisions of the PDPA 2010.

So, the equation is not complicated:

Data due diligence = legal compliance + risk management = legal defence

Good luck! 🙂

When Ransomware “WannaCry” Attacks

By: Sonny Zulhuda

Alkisah aplikasi tebusan (Ransomware) “WannaCry” melanda dunia cyber global…

150 negara dilanda ributnya, ribuan dolar uang tebusan diminta, ratusan ribu komputer terinfeksi, jutaan data terancam musnah, dan pastinya kesusahan yang tiada ternilai menghantui para korbannya.. “princeless” – istilah sebuah iklan komersial.

Apa yang harus dilakukan?

Menghadapi bencana digital seperti ini, berlakulah prinsip yang sama upaya “Penanggulangan Bencana” yang baru-baru ini saya pelajari dalam kursus Disaster Management bersama MDMC. Penanggulangan bencana dibagi kepada tiga fase:

Fase pra-bencana
Fase saat bencana
Fase pasca bencana.

Ketika seseorang atau sebuah instansi sudah menjadi korban malware WannaCry ini, maka hal pertama adalah penanggulangan saat bencana.

Langkah-langkah yang diambil harus cepat, tepat dan bertujuan menghentikan bencana atau meminimalisirnya baik dengan cara teknis seperti menghentikan koneksi Internet sementara, menyetop aplikasi perkongsian data, atau mengoreksi setting sistem informatika sebuah organisasi. Selain itu, langkah non-teknis harus segera dibuat: notifikasi kepada segenap jaringan tentang masalah ini, dan mereduksi aktivitas yang memerlukan aplikasi jaringan. Kalau perlu bekerjalah menggunakan laptop lain yang tidak terinfeksi. Jangan lupa sampaikan ke jaringan kerja atau teman-teman di media sosial bahwa anda sedang menghadapi masalah ini sehingga komunikasi kemungkinan menjadi terhambat.

Saya jadi teringat adagium klasik “sebaik-baik obat adalah dengan menjaga kesehatan” yang sangat relevan dalam dalam dunia teknologi informasi. Dari segi teknis, langkah-langkah preventif seperti penggunaan aplikasi yg standard, anti-virus yang selalu ter-update, dan penyediaan back-up data menjadi keharusan. Karena jika piranti kita sudah diserang dengan berbagai “unsur jahat”, maka kadang-kadang upaya kuratif yang reaktif menjadi tidak bermakna.

Dalam perspektif hukum dan kebijakan, upaya preventif juga menjadi sebuah keharusan. Jika tidak ingin terjerat masalah cybercrime, misalnya.. maka jangan bermain dengan apinya. Jangan terpancing dengan rekayasa sosial (social engineering) yang menawarkan hadiah, romantika cyber, teman virtual atau sekedar promosi-promosi yang menggiurkan.

Jika sudah terpedaya dengan pancingan itu, jika sudah terkontaminasi komputer kita oleh virusnya, jika sudah diambil data-data penting kita.. maka langkah reaktif menjadi tidak berguna.

Masih inget Bang Napi? “Waspadalah!!”

May 15, 2017
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment

Ketahanan Digital

By: Sonny Zulhuda

BIG-DATA

Jika ingin sukses di era digital ini, Indonesia mesti memiliki ketahanan digital yang kuat. Apa maksudnya? Artinya ruang cyber kita harus memiliki resistensi yang cukup terhadapa potensi serangan cyber yang bisa melumpuhkan integritas bangsa.

Ya, integritas bangsa Indonesia tidak bisa hanya dipertahankan melalui pengamanan darat, laut dan udara. Namun juga pengamanan ruang cybernya! Saya kasih contoh diantaranya sebagai berikut:

1. Tentang keamanan piranti (lunak dan keras) dari ancaman pengrusakan: Apakah sistem komputerisasi yang digunakan oleh berbagai sektor publik dan swasta dilengkapi dengan standardisasi pengamanan? Apakah sudah cukup SOP bagi individu yang terlibat dalam penggunaan piranti tersebut?

2. Tentang integritas sistem komunikasi kita dari ancaman penyusupan; Apakah sistem telekomunikasi kita aman dari penyadapan pihak-pihak yang tidak bertanggungjawab?

3. Tentang ketahanan data publik dan privat dari ancaman pembocoran; apakah kita memiliki sistem teknologis dan perundangan yang cukup untuk mencegah pencurian data, pembobolan rahasia negara dan pembajakan rahasia dagang kita?

4. Tentang keamanan dan integritas data pribadi warga Indonesia dari ancaman penyalahgunaan; apakah sistem data e-KTP kita aman dan baik-baik saja? Siapakah yang menyimpan data serta mengontrol server back-upnya?

Tak ayal, insiden aplikasi jahat “WannaCry” baru-baru ini menjadi cambuk pedih yang mengingatkan kita, bahwa ketahanan digital menjadi sebuah keniscayaan.

Mari berbenah!

May 15, 2017
Categories: Uncategorized . . Author: Sonny Zulhuda . Comments: Leave a comment

“Can my lecturer access my personal information?” – And Other Issues of Data Protection at the Higher Learning Institutions

By: Sonny Zulhuda

In the past week alone, I spoke about the personal data protection law at two Malaysian public universities; Universiti Sultan Zainal Abidin (UniSZA) Kuala Terengganu and Universiti Malaysia Pahang (UMP) Pekan. While the former was an internal programme, the latter talk was attended by other public universities’representatives who were members of Majlis Tatatertib dan Disiplin Universiti-universiti Awam Malaysia (MATDUM).

In this post, I would like to note some discussions we had on the implementation of the Personal Data Protection Act 2010 at the University environment.

IMG_20170319_095449

The education industry is indeed among those where personal information is highly processed. The data subjects include students (prospective, actual and graduates), university’s employees, as well as any individuals involved in the data processing.

Continue reading →

March 19, 2017
Categories: data privacy, My Speaking Engagement, Uncategorized . Tags: access, BAC, campus, CCTV, consent, Data privacy, data protection, data retention, education, graduate, higher learning institution, IIUM, lecturer, Malaysia, notice and choice, PDP principles, PDPA, PDPA 2010, personal data, Personal Data Protection Act 2010, personal information, school, students, students information, UKM, UMP, UniSZA, university, USIM, UTM, UTP . Author: Sonny Zulhuda . Comments: Leave a comment

Data Sovereignty vs Data Localisation Law

By: Sonny Zulhuda

Transferring personal data beyond national boundaries has been a point of contention under many data protection laws across the globe. The European Union adopts this restriction that such transfer beyond EU boundaries cannot be done unless to the countries or places which have adequate protection on personal data of individuals.

Cloud-Data-Security This rule is associated with the concept of “Data Sovereignty” which says that a country shall not lose a control or sovereignty over the processing of personal data pertaining to data subjects from that country. It also imposes that information which has been stored in digital form is subject to the laws of the country in which it is located. Therefore, a control over trans-border data flow is a form of upholding data sovereignty.

The concept of Data Sovereignty is reflected in the EU Data Protection Directives 1995 recitals whereas:

cross-border flows of personal data are necessary to the expansion of international trade;
the protection of individuals guaranteed in the Community by this Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection;
the transfer of personal data to a third country which does not ensure an adequate level of protection must be prohibited.

As much as we are concerned with personal data transferred beyond our border, we also appreciate that personal data is inherently needed for the International trade and International cooperation. Hence, when a personal data is subject to trans-border flow, there shall be no discriminatory treatment to the citizen’s personal data despite where it is processed.

Data Localisation Law

This data sovereignty is sometimes confused with the rules of “Data Localisation”, which is totally a different thing. Data localisation laws set forth requirements to keep and store data “locally” (i.e., within national or regional borders), and thus not allowing data users to transfer data beyond borders. Consequently, any foreign party who wishes to collect or process personal data of individuals will be required to establish a local data storage facilities in the country of those individuals. Continue reading →

February 12, 2017
Categories: data privacy, Uncategorized . Tags: cloud service, CMA 1998, Data localisation, Data privacy, Data sovereignty, Data storage, Edward Snowden, EU Directives 1995, European Union, International trade, Malaysia, Ministerial Order, National Cyber Security Policy, NCSP, non-discriminatory, NSA revelation, PDPA 2010, Personal data protection Act, section 129 PDPA, surveillance, trans-border data flow . Author: Sonny Zulhuda . Comments: Leave a comment

Social Media Policy and Regulation: A Network Governance Perspective

By: Sonny Zulhuda

The above is the name of the event in Tsinghua University, Beijing, on December 3-4, 2016, where I came as a speaker to the audience consisted of law, media and Internet governance academia and practitioners. Both Beijing-based School of Journalism and Communication of Tsinghua University and the School of Communication of Hong Kong Baptist University (HKBU) jointly organised this event.

The invitation came to me through Dr. Yik Chan Chin of the HKBU, who is with me at the Global Internet Governance Academic Network (GigaNet). Upon few exchanges of emails, I was then invited to come and present my views on the social media regulations in the Malaysian perspective. I must say that the event was really a rewarding experience; filled with substantial discussions, new perspectives and, of course, new friends and network!

This can be highlighted from the list of the speakers of the two-day workshop: Continue reading →

January 29, 2017
Categories: data privacy, My Speaking Engagement, Uncategorized . Tags: Atma Jaya, China and Internet, CMA 1998, Communications law, Content regulation, cyber crime, Cyber law, Data privacy, data security, Freedom of speech, hate speech, HKBU, Hong Kong, Hong Kong Baptist University, Internet Censorship, Internet Content, Internet Great wall, Malaysia, media law, multimedia, New Media, Offensive content, Open data, Raymond Li, Regulation, Regulatory Framework, self-regulation, Social Media, Tsinghua University, Yik Chan Chin . Author: Sonny Zulhuda . Comments: Leave a comment

Open Government and Cyber Security in Malaysia

By: Sonny Zulhuda

Open government is the notion that allows transparency of governments in running matters pertinent to public interests. According to that concept, the government shall allow its citizens an access to government documents and a right to obtaining information relating to public matters.

In Malaysia recently, the Open Government initiative was represented in the Public Sector Open Data Portal programme which was launched in September 2015 by MAMPU, a Unit under the Prime Minister’s Department. It declares that the aim of such initiative is to open and share government data to public and hence to enhance transparency and efficiency of government and to create a digital innovativeness.

With this background, the question of how the Government deals with the increasing demand of freedom of information and other challenges ranging from personal data to the government data security is worth examining. I was invited to talk about this at an international conference hosted by Sydney Cyber Security Network, the University of Sydney, Australia. In my presentation, I highlighted a recent initiative of open data in Malaysian public sector and the related challenges on data security, privacy and information surveillance.

I was also looking at the recent developments in Malaysia relating to the enactment of personal data protection law and recent policies relating to critical infrastructure protection. Lessons from cases and incidents surrounding information security and personal data breaches were discussed to trigger discussions on relevant solutions and best practice.

Among the key summary of my talk in Sydney was as following:

Open Government is underway, but more economically-motivated and narrowly looked at “open data”. A long way to the “open government”.
Cyber security governance enhances the security of data in the Malaysian cyberspace. However:
There is a striking imbalance in the legal framework between the protection of secret on one hand, and the freedom of information on the other.
The data privacy law boosts the transparency in the private & commercial sector, but it is a missed opportunity for an open government.
The open government initiative needs to be supported as national agenda, to be backed by a stronger law and national policy.

January 22, 2017
Categories: My Speaking Engagement, Uncategorized . Tags: critical information infrastructure, Cyber Security, cyberspace, Data privacy, data protection, data security, good governance, Malaysia, Open data, Open government, Secrecy, surveillance, transparency, University of Sydney . Author: Sonny Zulhuda . Comments: Leave a comment

M	T	W	T	F	S	S
« Mar
	1	2	3	4	5	6
7	8	9	10	11	12	13
14	15	16	17	18	19	20
21	22	23	24	25	26	27
28	29	30	31

Categories

Archives

Meta

Ransomware Attack: How a PDP law compliance can be of any help

Data due diligence = legal compliance + risk management = legal defence

When Ransomware “WannaCry” Attacks

Ketahanan Digital

Open Government and Cyber Security in Malaysia

Recent Posts

Research Centres

Social

Looking for something?

Visitor

Email Subscription