Category: Legal & Regulatory

Seeking to offer award-winning IP Law services, Al-Ajaleen Legal Consultants & Intellectual Property was founded by a group of experienced legal and IP practitioners who have in-depth experience in the Middle East and Gulf region in the field of legal and intellectual property. We profile the firm to find out how these experts have driven the firm to the success it enjoys today.

Established in 2007, Ajaleen works tirelessly to achieve long term representation of corporate clients to form a close working knowledge of its client’s business, long-term goals and competitive position.

Striving towards excellence for every client, the firm is focused on client satisfaction, providing high quality representation in a very timely manner.

As part of this focus, Ajaleen’s dedicated staff are committed to high ethical and professional standards, as well as state-of-theart technology, so as to provide a comprehensive range of Legal and IP services tailored to meet their clients’ needs. All of the firm’s expert team work hard to ensure that clients receive the support they need that is tailored to meet their exact requirements.

Supporting clients from throughout the corporate landscape, the practice can provide a wide range of services, including trademarks, copyright protection, patents, IP watch services and renewal support. As a result, clients know that they are in safe and experienced hands when they work with Ajaleen.

Overall, moving forward Ajaleen’s goal is to build a better future by adopting technology to the legal industry and providing quality services to clients. This will remain the firm’s core focus as it looks towards a bright and exciting future.

Web Address: www.ajaleen.com

By, Nigar Guliyeva, is an Associate at K?l?n’ Law & Consulting and has experience and expertise in corporate and commercial law.

Cyber criminals today are attempting to penetrate your organisation’s network to try to get hold of critical assets with most looking for the valuable personal identifiable information (PII). It is a fact that cybersecurity attacks are on the rise all over the world, and the Arab world is no exception. There are even some recent reports stating that the Arab countries are among the ones facing the highest number of attacks. Meanwhile in EU, GDPR was launched back in May 2018 to create a new benchmark for personal data protection, and its influence was felt far and wide. It is now the template for privacy laws throughout the world. So how can organizations in the Middle East create a framework to ensure attacks are dealt with in a GDPR-aware manner, minimising fines, reducing breach-related costs, and ultimately better protecting the personally identifiable information?

 

There has been a lot of talk of GDPR over the last year, so organizations today understand the serious repercussions of non-compliance and many have put basic frameworks in place with a focus on two pillars – ‘people’ and ‘process’.

 

People – GDPR stipulates the appointment of a data protection officer (DPO) for any organisation that is a public authority that has a core activity involving the monitoring of individuals on a large scale, or the processing of large volumes of sensitive data. The DPO needs to have a thorough knowledge of GDPR and have an independent voice within the organisation.

 

Process – Many organizations’ GDPR approach so far has been data mapping ‘ identifying where, why and how personal data is being used, while also eliminating any unnecessary data processing. Once this is done, each organisation has a foundation  from which to ensure secure policies and processes are in place.

 

While the two GDPR pillars ‘ ‘people’ and ‘process’ have been looked at, there has been a bit of lag in the use of the third pillar – ‘technology’ ‘ which plays an important role in detecting attacks and crucially, responding to attacks. Do organisations need to rip and replace existing cybersecurity tools?

 

Let’s now look at the technology aspects of data protection and GDPR:  

 

Technology: Security Solutions to the rescue

A GDPR security strategy should look at 4 technology areas. By applying good quality security solutions to each of these areas, security teams and the DPO can together manage the inevitable exposure to the risk of cyberattack:

 

Network Access Control (NAC)
Businesses today embrace the idea of anywhere, anytime connectivity, but have largely ignored the need for secure NAC. Many employ a laid-back ‘connect now, secure later’ NAC philosophy. Others simply choose the same vendor for security that they use for network infrastructure. Both of these approaches give the illusion of security’even compliance’but in reality, leave extensive security gaps.

 

Network access control (NAC) offers, at a minimum, authentication of a user or device. With mobile access now the norm and Internet of Things devices connecting to the network, the only way to ensure proper access is maintained is to go beyond simply validating credentials. The next level beyond this is to tightly control who and what is authorised to access IT assets, including personal information.

 

With advanced NAC, the IT team knows where personal data is located. They can use NAC to stipulate who is entitled to access that information and under what circumstances. In an ideal world, NAC and policy management solutions will provide device discovery, role-based access to IT assets and a closed-loop, policy-based attack response. For complete convenience, it should also integrate seamlessly with existing network infrastructure, perimeter security systems and service and support offerings.

Assurance
The next level of protection relies on the fundamental security of the underlying network infrastructure. If data can be easily tapped off the network in normal day-to-day business flows and process, the chances of a breach increase.

 

This is where technologies such as equipment tamper-proofing, encryption, key management and secure network administration are critical to the overall security strategy.

Breach Detection
GDPR requires the reporting of a data breach within 72 hours. Many existing systems can take almost all of this time to detect and generate the required event information.

 

While prevention is better than cure, early detection of a breach is a close second. There’s a huge range of different technologies and products available that find attacks before they do damage.

 

Today more and more attacks are specifically designed to breach traditional defences. It is because these exploits almost always result in the loss of personal information (and a quick sale on the Dark Web) that new approaches to attack detection are required. For example, a high volume of breaches make use of valid credentials, which means phishing attacks and social forensics are one of the biggest risks. The result is the bad actor using legitimate credentials to execute an attack that may take days, weeks or even months to unfold. How do you stop an ‘attack’ using valid credentials to tap information the real user has a valid reason to access?  

 

Because these are previously unknown attacks, it’s no use to look for a signature or pattern to detect them. This means IT and security teams introducing an additional level of monitoring that complements existing defences, one that uses new types of attack detection such as machine learning to detect small behavioural changes that suggest an attack has occurred. Actions can range from requiring re-authentication or quarantining to totally blocking network access.

 

Machine learning can establish a ‘risk score’ based on the characteristics of suspected unusual behaviour and how these characteristics differ from the norm. This helps organisations to prioritise their resources and investigate suspected attacks before they do damage.

 

Response to Breach
The GDPR’s breach notification requirements are very clear when it comes to what an organisation must do when a personal data breach occurs. These include notifying the regulator within 72 hours of being ‘aware of the breach’ and notifying impacted individuals ‘without undue delay’. The notifications must include details of the breach including:

The type of data, type of exposure and the number of individuals involved
The probable consequences of the breach
Any mitigation actions taken
 

So, in the unfortunate event that a breach occurs, the DPO and his team need to rapidly gather the facts: what happened, the scope of the damage, and a plan of containment and remediation. This all has to be communicated to the regulators and authorities in a clear, concise manner. It is vital they have the tools and solutions to deliver this information efficiently. Any delays in gathering this information could cost the organisation dearly, both reputational and financially.

 

In conclusion, GDPR ‘compliance’ is not fully defined by the law and will be determined in part by rapidly advancing security technology capabilities and evolving best practices. Only  technologies that are open and interoperable will make it through to the next generation of cybersecurity defences.

Cyber criminals today are attempting to penetrate your organisation’s network to try to get hold of critical assets with most looking for the valuable personal identifiable information (PII). It is a fact that cybersecurity attacks are on the rise all over the world, and the Arab world is no exception. There are even some recent reports stating that the Arab countries are among the ones facing the highest number of attacks. Meanwhile in EU, GDPR was launched back in May 2018 to create a new benchmark for personal data protection, and its influence was felt far and wide. It is now the template for privacy laws throughout the world. So how can organizations in the Middle East create a framework to ensure attacks are dealt with in a GDPR-aware manner, minimising fines, reducing breach-related costs, and ultimately better protecting the personally identifiable information? 

There has been a lot of talk of GDPR over the last year, so organizations today understand the serious repercussions of non-compliance and many have put basic frameworks in place with a focus on two pillars – ‘people’ and ‘process’.

 

People – GDPR stipulates the appointment of a data protection officer (DPO) for any organisation that is a public authority that has a core activity involving the monitoring of individuals on a large scale, or the processing of large volumes of sensitive data. The DPO needs to have a thorough knowledge of GDPR and have an independent voice within the organisation.

 

Process – Many organizations’ GDPR approach so far has been data mapping ‘ identifying where, why and how personal data is being used, while also eliminating any unnecessary data processing. Once this is done, each organisation has a foundation  from which to ensure secure policies and processes are in place.

 

While the two GDPR pillars ‘ ‘people’ and ‘process’ have been looked at, there has been a bit of lag in the use of the third pillar – ‘technology’ ‘ which plays an important role in detecting attacks and crucially, responding to attacks. Do organisations need to rip and replace existing cybersecurity tools?

 

Let’s now look at the technology aspects of data protection and GDPR:

Technology: Security Solutions to the rescue

A GDPR security strategy should look at 4 technology areas. By applying good quality security solutions to each of these areas, security teams and the DPO can together manage the inevitable exposure to the risk of cyberattack:

 

Network Access Control (NAC)
Businesses today embrace the idea of anywhere, anytime connectivity, but have largely ignored the need for secure NAC. Many employ a laid-back ‘connect now, secure later’ NAC philosophy. Others simply choose the same vendor for security that they use for network infrastructure. Both of these approaches give the illusion of security’even compliance’but in reality, leave extensive security gaps.

 

Network access control (NAC) offers, at a minimum, authentication of a user or device. With mobile access now the norm and Internet of Things devices connecting to the network, the only way to ensure proper access is maintained is to go beyond simply validating credentials. The next level beyond this is to tightly control who and what is authorised to access IT assets, including personal information.

 

With advanced NAC, the IT team knows where personal data is located. They can use NAC to stipulate who is entitled to access that information and under what circumstances. In an ideal world, NAC and policy management solutions will provide device discovery, role-based access to IT assets and a closed-loop, policy-based attack response. For complete convenience, it should also integrate seamlessly with existing network infrastructure, perimeter security systems and service and support offerings.

Assurance
The next level of protection relies on the fundamental security of the underlying network infrastructure. If data can be easily tapped off the network in normal day-to-day business flows and process, the chances of a breach increase.

 

This is where technologies such as equipment tamper-proofing, encryption, key management and secure network administration are critical to the overall security strategy.

Breach Detection
GDPR requires the reporting of a data breach within 72 hours. Many existing systems can take almost all of this time to detect and generate the required event information.

 

While prevention is better than cure, early detection of a breach is a close second. There’s a huge range of different technologies and products available that find attacks before they do damage.

 

Today more and more attacks are specifically designed to breach traditional defences. It is because these exploits almost always result in the loss of personal information (and a quick sale on the Dark Web) that new approaches to attack detection are required. For example, a high volume of breaches make use of valid credentials, which means phishing attacks and social forensics are one of the biggest risks. The result is the bad actor using legitimate credentials to execute an attack that may take days, weeks or even months to unfold. How do you stop an ‘attack’ using valid credentials to tap information the real user has a valid reason to access?  

 

Because these are previously unknown attacks, it’s no use to look for a signature or pattern to detect them. This means IT and security teams introducing an additional level of monitoring that complements existing defences, one that uses new types of attack detection such as machine learning to detect small behavioural changes that suggest an attack has occurred. Actions can range from requiring re-authentication or quarantining to totally blocking network access.

 

Machine learning can establish a ‘risk score’ based on the characteristics of suspected unusual behaviour and how these characteristics differ from the norm. This helps organisations to prioritise their resources and investigate suspected attacks before they do damage.

 

Response to Breach
The GDPR’s breach notification requirements are very clear when it comes to what an organisation must do when a personal data breach occurs. These include notifying the regulator within 72 hours of being ‘aware of the breach’ and notifying impacted individuals ‘without undue delay’. The notifications must include details of the breach including:

The type of data, type of exposure and the number of individuals involved
The probable consequences of the breach
Any mitigation actions taken
 

So, in the unfortunate event that a breach occurs, the DPO and his team need to rapidly gather the facts: what happened, the scope of the damage, and a plan of containment and remediation. This all has to be communicated to the regulators and authorities in a clear, concise manner. It is vital they have the tools and solutions to deliver this information efficiently. Any delays in gathering this information could cost the organisation dearly, both reputational and financially.

 

In conclusion, GDPR ‘compliance’ is not fully defined by the law and will be determined in part by rapidly advancing security technology capabilities and evolving best practices. Only  technologies that are open and interoperable will make it through to the next generation of cybersecurity defences.

 

About the author

Rabih Itani is the regional business development manager for Aruba security solutions across Middle East and Turkey at Aruba, a Hewlett Packard Enterprise Company. In this role he works closely with Aruba channel, customers and alliances and across almost all industry verticals including education, healthcare, government, financial services, and banking to design networks that are immune and responsive to internal threats. Rabih is an ICT and Telecom industry veteran with more than 25 years of experience. Rabih joined Aruba in 2012 carrying the mix of a multi-discipline engineer who enjoys a profound understanding of technology and has deep business analysis of the industry trends, markets, business drivers, and business models.

Israel may be the ‘Start-up Nation’ and a world-renowned center of technological innovation, yet for many years the procedures and conduct of the Israeli Land Registry have been trapped in the past.

 

The Ottoman Land Code of 1858 was enacted in Israel by the Ottoman regime. The new Ottoman law allowed for land to be transferred by a deed of ownership and required that all property rights be recorded with the Land Registrar of the district in which the relevant lands were located. The Ottoman Land Registry, which still exists today, marked the beginning of land registration in Israel. Property rights under the Ottoman law were registered in chronological order (a separate registry for each month would be maintained by the Land Registrar), and the parties to the transactions were required to physically report to the Land Registrar and to specify the nature of the transaction and all of its identifying details, such as  the geographical location and the size of the land in question and a description of its physical boundaries, the particular part of the land which was impacted by the transaction, its value, etc.

 

The cumbersome bureaucracy and paperwork which were characteristic of the Ottoman Empire remained until recently a prominent feature of the various Israeli Land Registry offices.

 

In order to transfer property rights in Israel, from the seller’s name to that of the buyer, the parties to the transaction are required to sign a deed of transfer, to submit tax certificates issued by the Israel Tax Authority (ITA) and to provide confirmations from the municipal authorities that there are no outstanding encumbrances on the property. If any of the parties is a registered company, it is additionally required to submit a certified copy of its Certificate of Association, certified by the Companies Registrar, and the corporate resolutions authorizing the transaction. These requirements, which involve various authorities and processes, cause the process of registering property rights in Israel to be a long and arduous process.

 

However, in the past few years the Israeli authorities have been undergoing a deep transformation, which includes the introduction of many new tools aimed at simplifying and expediting the real estate registration process by making use of technological advancements. Registration procedures are published regularly on the website of the Land Registry and Settlement of Rights Department. One example of the new technological advancements is a recently launched online registration system which allows for transfers of rights in certain properties to be carried out online. Another example of this trend is a direct interface between the Land Registrar and the main commercial banks, which is currently in the initial stages of implementation, which will enable recordings of paid-up mortgages to be removed without the parties having to proactively apply to the bank or the Land Registrar in order to do so.

 

The Ministry of Justice is working on additional procedures to improve its services, including services which will create direct interfaces between the electronic records of the Land Registrar and those of the other government agencies which generate documents or certificates required by the Land Registrar ‘ thus sparing the parties the need to apply for individual clearances.

 

These developments will make the current cumbersome requirement of providing the actual documentation to the Land Registrar – obsolete.

 

Until recently, the requirement that original documents be provided to the Land Registrar was considered a critical condition for registration of property rights, which naturally resulted in massive amounts of printed materials. The technological improvements described above reflect nothing short of a revolution in this field. Although some of these systems are in early or trial stages, their development and introduction into practice provide a clear indication for the future. Soon, almost all transactions that require registration will be carried out with a few simple online commands.

 

The results of these changes speak for themselves. According to the Land Registrar’s data, the nationwide average registration time has been reduced from 45 to 13 days. In most cases, registration of property rights takes only a few days. This revolution has the potential not only to shorten the process of the registration of real estate rights, but also to simplify and shorten negotiations and the execution of documents in real estate transactions (such as electronic signature of documents), which will ultimately bring the registration of real estate rights in Israel into the 21st century.

 

 *Lee Maor is a Real Estate Partner at Israeli law firm, Yigal Arnon & Co. Yigal Arnon & Co. provides a full range of corporate legal services. With its focused practice groups, Yigal Arnon & Co. combines the expertise of a specialty boutique practice with the advantages of a large, multidisciplinary law firm.