SOLUTION BRIEF (TRIPWIRE)

Tripwire and GDPR

Achieve Compliance Using Foundational Controls
The recently-enacted European Union General Data Protection Regulation

MAKING COMPLIANCECOMPELLING(GDPR) requires organizations to take adequate measures to ensure thesecurity and privacy of personal data of any European citizen. This supersedes
the previous Data Protection directive. As a regulation—as opposed to amere directive—it directly imposes a uniform data security law regime onorganizations that need to comply.

Who Needs to Comply?

The GDPR is explicit on who needs to comply: the regulation states anyorganization touching and managing (collects, stores, processes and/or shares) the personal data of EU individuals. Personal data includes “anyinformation relating to an identified or identifiable natural person (‘datasubject’); an identifiable natural person is one who can be identified, directly
or indirectly, in particular by reference to an identifier such as a name, anT h e h e f t y f in e s a n d p enal ti es
f o r in f r in g e m e n t n o t onl ye n c o u r a g e a c c o u n t a b i l i ty,t h e y m a y b e t h e s in g lem o s t e ye - c a t c h in g f e a tureo f t h e R e g u la t io n , c a u si ng
m u lt in a t io n a ls a n d lo cal
c o m p a n ie s t o in v e s t more i nc o m p lia n c e .
— I A PP- T o p 1 0 O p e r a t i onal
I m p a c t s o f t h e G D PR : P ar t
1 0 — C o n s e q u e n c e s for
G D PR V i o l a t i o n sidentification number, location data, an online identifier or to one or morefactors specific to the physical, physiological, genetic, mental, economic,
cultural or social identity of that natural person.” This is an extensive definition.
For IT professionals, this could include MAC or IP addresses. Essentially, those who must comply are any data owners (“DataControllers”) and data processors. This has a global reach, for affected organizations do not need to be located in Europe.

Why Should You Care?

Data breaches alone can impact your customer base and drive negative publicity with long-lasting effects. The financial
consequences of failing to comply with the GDPR are also steep, with fines of up to 20 million euro or 4% of global annual turnover.
Interestingly, in the Ovum research report, Data Privacy Laws: Cutting the Red Tape, two-thirds of the respondents say they expect
the legislation to force changes in their European business strategy.

Planning for Compliance

While organizations have some controls in place to secure their data, many are not prepared for GDPR. In research from before
implementation and enforcement, over two thirds of IT professionals surveyed say they need to invest in new technologies orservices to help prepare their business for the impact of GDPR. This compliance standard touches across all departments andpersonnel. Planning for GDPR compliance should start right away by assessing the current situation and the gaps that exist. For more
advice on how to get started, read Tripwire white paper “Getting Up to Speed on GDPR.”

Fortra.com

Fortra Solution Brief

Tripwire and GDPR

How Tripwire Can Help

Tripwire can do so continuously, so you’re always prepared

Tripwire is a leading provider of foundational controls forcompliance, security and IT operations. GDPR requires thatorganizations implement adequate security measures
to protect EU citizens’ data. Tripwire’s comprehensive
foundational security controls deliver capabilities that areessential to the standard of adequate protection, including
automation and integration to enhance the operational
efficiency of these controls and maintain a high integrity
state.

for an audit. Organizations can be confident, knowing thatTripwire already has a solid compliance track record withstandards like PCI DSS, NERC, NIST and many others. Tripwire’s
integrated solutions portfolio includes file integrity monitoring,configuration management, asset discovery, vulnerability
management, and log collection. These capabilities support
popular industry-standard frameworks like the Center forInternet Security (CIS) Controls and ISO/IEC 27001/27002.
Much of GDPR requires visibility and monitoring of assets.

Tripwire makes demonstrating compliance with GDPR
easy. Implementing the controls isn’t enough. You also
have to be able to continuously demonstrate compliance.
Tripwire can assess compliance of systems against
these standards, and provide audit-ready reporting.

Tripwire delivers continuous monitoring of cyber assets.
Tripwire offers the ability to discover data that is notencrypted or identify unknown assets and their vulnerability
and risk levels. Tripwire also offers audit trails to assist withinvestigations and to remediate back to pre-attack status.

Tripwire Responds to GDPR Requirements
ArticleTripwire Response

Article 25 (page 48) Data protection by
design and by default "2. The controller
shall implement appropriate technical andorganisational measures for ensuring that,by default, only personal data which arenecessary for each specific purpose of theprocessing are processed."

Tripwire can support this requirement byidentifying and alerting on system changes
that might affect what data is processed.

Article 30 (page 50) Records of processing
activities "Each controller and, whereapplicable, the controller's representative,
shall maintain a record of processing
activities under its responsibility."

Tripwire® LogCenter® can collect logs from thesystems processing data to comply with thisrequirement.

Article 32 (page 52) Security of processing "1.
.....shall implement appropriate technical andorganisational measures to ensure a levelof security appropriate to the risk, includinginter alia as appropriate: ...... (b) the ability toensure the ongoing confidentiality, integrity,availability and resilience of processing
systems and services"

Tripwire's suite of products provides theability to measure and manage risk, ensuringconfidentiality, integrity and availability. Whenapplied to processing systems, Tripwire canmonitor systems against security policies,
identify and track vulnerabilities, and provide theability to investigate activity through log data.

(a) the pseudonymisation and encryption ofpersonal data;

Fortra.com

TripwireEnterprise

Tripwire
IP360

Supports

Tripwire
LogCenter

Supports

ProvidesProvidesProvidesProvidesValidates

Page 2Fortra Solution Brief

Tripwire and GDPR

Tripwire Responds to GDPR Requirements
TripwireEnterprise

Tripwire
IP360

Tripwire
LogCenter

Tripwire's suite of products provides theability to measure and manage risk, ensuringconfidentiality, integrity and availability. Whenapplied to processing systems, Tripwire canmonitor systems against security policies,
identify and track vulnerabilities, and provide theability to investigate activity through log data.

ProvidesProvidesProvides(c) the ability to restore the availability andaccess to personal data in a timely mannerin the event of a physical or technicalincident;

By baselining systems and tracking theirchanges, Tripwire Enterprise can be used tomore effectively bring systems back online
after an outage. Tripwire Enteprise customers
can review how a deployed system haschanged in production in order to ensurethat restored backups meet operational
requirements.

Supports(d) a process for regularly testing, assessing
and evaluating the effectiveness of technicaland organisational measures for ensuring
the security of the processing.

Tripwire IP360™ can be used to identify
vulnerabilities in processing systems. Tripwire
Enterprise can be used to identify security
related misconfigurations in processing systems.

ProvidesArticle 35 (page 53) Data protection impact
assessment "7. (d) he measures envisaged
to address the risks, including safeguards,
security measures and mechanisms toensure the protection of personal data
and to demonstrate compliance with thisRegulation taking into account the rights
and legitimate interests of data subjects andother persons concerned."

By identifying where data exists using
asset tags, Tripwire Enterprise can assist
organizations efforts to assess the impact ofsecurity mechanisms and measures.

Article 39 (page 56) Tasks of the dataprotection officer "1. The data protection
officer shall have at least the following
tasks: ... (b) to monitor compliance with thisRegulation, ..."

Tripwire Enterprise and Tripwire LogCentercan provide data and reports to validate thatappropriate security measures have been put
in place and continue to operate.

Article 57 (page 68) Tasks “Without prejudice
to other tasks set out under this Regulation,
each supervisory authority shall on its
territory: ... (h) conduct investigations on
the application of this Regulation, including
on the basis of information received fromanother supervisory authority or other publicauthority;”

Tripwire products can provide a wealthof information for investigations. Tripwire
Enterprise can provide detailed data about
how assets have changed. TripwireIP360 candetail how assets are and were vulnerabile,
as well as software inventory information.
Tripwire LogCenter can provide a history ofan assets activity in log events for detailedinvestigations.

Article 59 (page 70) Activity reports "Eachsupervisory authority shall draw up anannual report on its activities, which may
include a list of types of infringement notified
and types of measures taken in accordancewith Article 58(2). ..."The results from Tripwire's suite of products
can be used to contribute to an annual
report. Contributions would include evidence
of infringements, supporting data forinvestigations, and validation of compliance.

ArticleTripwire Response(b) the ability to ensure the ongoing
confidentiality, integrity, availability andresilience of processing systems andservices;

Fortra.com

ProvidesSupports

Validates

Validates

Supports

Supports

Supports

Supports

Supports

Supports

Page 3Fortra Solution Brief

Tripwire and GDPR

About Fortra
Fortra is a cybersecurity company like no other. We’re creating a simpler, stronger future for ourcustomers. Our trusted experts and portfolio of integrated, scalable solutions bring balance andFortra.com

control to organizations around the world. We’re the positive changemakers and your relentless ally toprovide peace of mind through every step of your cybersecurity journey. Learn more at fortra.com.

Copyright © Fortra, LLC and its group of companies. Fortra™, the Fortra™ logos, and other identified marks are proprietary trademarks of Fortra, LLC.

(tw-ds-1123-r1-hm)