How to prevent and report data breaches

Dear Colleague,

We would like to draw your attention to a crucial aspect: protecting and securing personal data¹ and company information.

Hacker attacks are a known threat, but it is important to remember that information security can also be compromised by human errors or due to incorrect configuration of the applications and improper data management.

For example, incorrectly setting the visibility cone of an application can result in a data breach², because it allows unauthorized individuals to access personal data they should not view.

Therefore, it is particularly important to:

1. Adopt the highest diligence and attention in handling clients and corporate personal data and confidential information, to limit human errors
2. Develop application code following secure development best practices and paying close attention to the functionalities that may compromise personal data, in adherence to Group policies and procedures
3. Set up access control and log management
4. Configure access to personal data according to the principles of need to know, least privilege, and data minimization
5. Conduct periodic Penetration Tests and Vulnerability Assessments on systems, both at the factory exit and during operation.

We remind you that, in case of a suspected or confirmed data breach, you must send an email with the subject line “Suspected personal data breach” including a brief description of what happened or suspected, to:

• dpo.privacy@eng.it
• security@eng.it
• csirt.eng@cybertech.eu

The prompt activation of the designated company functions is essential to receive support aimed at minimizing the impacts of the event.

The protection of Engineering Group and customer data is the responsibility of each Team and each person in Engineering, and every little bit can make a difference in the pursuit of continuous improvement.

Thank you for your cooperation
Kind Regards
Group Data Protection Office
Group Information Security Office

¹A personal data is any information relating to an identified or identifiable natural person.

²A data breach is a security violation that results – accidentally or unlawfully – in the destruction, loss, alteration, unauthorized disclosure, or access to personal data transmitted, stored, or otherwise processed. A data breach can compromise confidentiality, integrity and availability of personal data.