A Practical Guide to GDPR Compliance – Step 3: Analysis

In this series, we’re breaking down the steps to achieving GDPR compliance leveraging tools and processes you already have. If you remember, the first step is: Don’t Panic. That’s right. The fear-mongering around GDPR has sent security practitioners into a frenzy, and it really doesn’t have to be that way. Click here to ready why.

In Step 2, we talked about developing an understanding of the current risk landscape, so you can create a risk-based approach to data protection and security. Click here to read more orienting yourself to risk.

As we look at the additional mandates of GDPR, we can see how evidential confirmation is critical. Well, that’s a long-winded way of saying “documentation.” Let’s take a look at the second mandate to see how we, again, have nothing to fear. After all, we’ve been validating compliance and security for decades.

GDPR Mandate: Establish technical measures to validate data is protected.

Translation: Perform regular analysis. See what you find. If all is well, validated. If not, take action.

GDPR has several provisions for technical measures to protect data. Now, one of the more steadfast characteristics of the GDPR is vagueness. But in Articles 5 and 30, we see the requirement to demonstrate that data is protected (a.k.a. validation). In our translation above, we can see what is needed to validate compliance: regular analysis. Let’s look at some of the analysis organizations can perform to validate their compliance with GDPR.

  • Security Configuration Assessments (SCAs)
  • Attack Simulations
  • Traffic Flow Analysis
  • Quantitative Risk Scores
  • Audits

Security Configuration Assessments (SCAs)

As organizations evolve, so do their networks. It is important to conduct regular assessments of the security configurations designed to meet compliance, including GDPR. During an SCA, you can establish a baseline, understand where you are relative to benchmarks and adjust policies to restore any compliance drift. It’s a fruitful exercise and the first method for using analysis to validate that data is protected and GDPR-compliant.

Attack Simulation

Stand in the shoes of a would-be attacker. By pairing vulnerability data with network policy, you get an ongoing pen-test that regularly validates (or invalidates) your current position. SCAs will reveal your current state, while Attack Simulation analysis will show the paths to non-compliance. No attacker instantly appears somewhere in the network, rummaging around in consumer data records.  They get there through the paths in the network.  Attack simulation shows the outside-in means of exploiting your network, leading to breach and non-compliance.  See something?  Take action.

Traffic Flow Analysis

It is one thing to see the current infrastructure design, it is still more helpful to simulate chaos. Traffic Flow Analysis is the third wave to satisfy technical measures of validation, because it demonstrates the effects of your security controls. What kind of network traffic is produced by this policy? TFA shows you. Is data protected if the traffic looks like this? TFA answers the question. This kind of real-world analysis is standard practice for security professionals and a hallmark of GDPR compliance.

Quantitative Risk Scores

There is no such thing as zero-risk. Now that we all recognize this fact, we can move on to the messy, real world we all inhabit. The best way to validate if data is protected is to analyze the current traffic and network conditions in the context of the GDPR risk-based approach. That is not to say that risk is penalized, only that risks are understood, acknowledged and consulted prior to any data protection measure. Quantifying these risks is the bedrock of technical measures. After all, you can’t measure what you’re not counting.


Finally, we come to a time-tested validation technique: audits. Audits are human activities. Here, we take the role of an investigator to discover what’s happening in the network. Audits are invaluable to think through the counterfactual simulations and what-if scenarios that machines can miss. By carefully scrutinizing the results from SCAs, attack simulations, traffic flow analysis and quantitative risk scores, an audit can yield specific directions to improve your GDPR stance.

If the second mandate of GDPR is to use technical measures to validate data protection, and if we translate that to: “Perform regular analysis, see what you find,” then we can see that GDPR compliance is just a specific instance of what security professional do every day. Again, nothing to fear.