General Data Protection Regulation (GDPR) covers a wide range of data security issues, including data protection, accountability, data processing, consent from subjects, and privacy. Because your organization does business in Europe, you have to ensure that the way your company handles data is in compliance with all parts of GDPR. The fines for non-compliance are extremely high, so you have little room for error.
How to use Splunk software for this use case
You can use Splunk to manage GDPR in-scope systems to ensure compliance. You can monitor who accesses what systems, what connections occur in your environment, whether systems are patched appropriately, and a number of other key indicators to guarantee compliance with GDPR and facilitate your ability to prove compliance.
- Access to unencrypted resources
- Activity from expired user identity
- Detecting brute force access behavior
- Expected host not reporting events
- Geographically improbable access detected
- Device with outdated anti-malware
- System with the update service disabled
- New connection to device
- Unauthorized connection through firewall
- Unauthorized access to Splunk indexes
- Unauthorized access to systems
Measuring impact and benefit is critical to assessing the value of compliance operations. When implementing this use case, you should track the number of out-of-GDPR-compliance incidents detected over time. In addition, review compliance office requirements and reporting policies, and have a method of developing and maintaining an asset and identity catalog with in-scope attributes.
- These additional Splunk resources might help you understand and implement this use case:
- Finally, if you'd like a more efficient way to comply with GDPR, consider upgrading your deployment. Splunk Enterprise Security helps you ingest, monitor, investigate/analyze and act (IMIA) on security data and insights. Click here and here to see how this use case can be accomplished in Splunk Enterprise Security.