Ensuring GDPR Compliance & Preventing Data Breaches

Harrisons Chartered Surveyors is an independent RICS Regulated firm of Property and Development Consultants, Agents and Valuers established in 1984.

The customer needed to ensure information security and data governance in order to address GDPR compliance requirements. As part of this, it was important that the risk of a cyber-attack was minimised .

In order to address the challenges, we recommended the implementation of Microsoft Enterprise Mobility + Security. This software has been specifically designed to help organisations with a mobile workforce to manage the security of data and users.

To manage mobile devices Microsoft Intune was deployed across laptops, mobiles and tablets. This allowed for the customer to roll out group policies across devices regardless of their location, and for compromised devices to be remotely wiped. It also allowed devices with out-of-date operating systems and other non-conformities to be marked non-compliant and create an alert, ensuring that only secured devices can access the corporate network.

BitLocker was also enabled across all Windows 10 Professional devices to encrypt hard drives and protect company data. By using BitLocker and Intune it allowed for the remote wiping of devices in the event of theft/loss to protect confidential data. Email encryption was setup to ensure communications containing confidential information was not susceptible to being intercepted

To prevent the accidental/intentional sending of sensitive data to external parties, data loss prevention policies were implemented. These policies automatically detect and warn when sensitive information (such as a credit card number, or national insurance number) is being sent outside of the organisation. In addition to this document classification was applied to document libraries within SharePoint to prevent unauthorised sharing externally and watermark confidential documents.

Finally, multi-factor authentication with conditional access was setup to provide an added layer of security when logging in from outside the office. This ensured that users logging in from remote locations needed to use an MFA app to confirm their identity and reduce the risk of hacking.

The end result was an enterprise class solution that ensured the security of sensitive data both internally and externally.