Rethinking Data Security: What to Consider Before You're Hit
Seagate, Ashley Madison, eBay, AOL, Target, Home Depot, Sony, the U.S. Government, and JPMorgan Chase. Now, insert your company name at the end of the list. It's not a matter of if your corporate data will be targeted by cybercriminals, but when.
The question is, are you going to wait until you're hit or are you going to take a proactive approach to bolstering your data security before your company ends upon the hit and headline list?
Unfortunately, most companies wait until a data breach happens before they take steps to better protect their data. Why? Because many don't realize relying on old practices and technologies is not enough to thwart modern day thieves who are getting more sophisticated by the minute.
They don't understand that data is different and needs special attention. Many rely on technologies like a firewall to thwart cyber thieves, forgetting that a firewall won't stop thieves from tapping into the CEO's smartphone or marketing's use of cloud-based storage solutions like Dropbox.
If you are among the savvy companies that want to proactively protect your data, you need to know what you should be doing differently today to improve data security and prevent data loss.
Understand Data is Special
First, you need to recognize that data is different, and special. Many security products, like a firewall, for example, are just one piece of a greater puzzle – one product doesn't stop all breaches. Most likely you don’t have, but need a data loss prevention product, known in the industry as DLP, to fortify your defenses. It operates much like your home's smoke detector, increasing your protection from a fire.
Consider adding a DLP
Solutions like Intel Security’s DLP identify, monitor and protect data in use, as it moves on your network, and as it sits on desktops, laptops, mobile phones or tablets. DLP systems are like the police; they enforce data security policies through contextual analysis and content inspection. DLP provides a framework – guided by your policies – that detects and prevents the unauthorized use and transmission of your critical data – much like police enforce laws. DLP also protects against internal mistakes and intentional misuse by insiders and external attacks.
Policies are critical to DLP success
DLP isn't a technology you simply deploy and forget about. You need to create corporate policies so the system understands policies such as who is allowed to download and distribute certain critical information, who is allowed to access certain data and so on. Without the policies, the technology isn't going to protect you.
What policies do you need to implement? Some will be obvious – your cleaning crew, for example, doesn't need access to the daily sales report. Other policies won't be as obvious, so bringing in a trusted consultant with experience will no doubt save you time and the headaches that come with trying to figure out what's needed on your own.
Know where your data resides
Before you can protect your data, you actually need to figure out what data you want and need to protect, and where that data lives. While that sounds simple, it's actually a complex problem. For example, have you asked every one of your employees to reveal:
- Which email systems they've used for corporate email
- How many USB drives they own with corporate data on them
- Which cloud storage systems they use
- How many web posts they've created and where they are
- What the folder system looks like on their desktop and laptop
- Whether they've used their smartphone for work
- Which partner agencies and independent consultants that they have shared corporate information with
Probably not. But take a look at that list and you'll realize how hard it is these days to know where your corporate data resides, and how much of an overwhelming task finding it and classifying it might become when you have hundreds and thousands of employees and partners.
Start with a single department
Some vendors will tell you to classify your data before you can adequately protect it. What they don't tell you is that it can take years to classify data. Some companies are stuck trying to find and categorize their entire data repository leaving them exposed to hackers. Instead, we advise you to start small, with a department like human resources and build from there, identifying where critical data resides and then building policies around it.
That's what we did with a midsized, rapidly-expanding-through-acquisitions logistics company with some 10,000 users. Because the company worked with several federal agencies, executives needed to prove the company had a program in place to protect customer data as part of its compliance certification. Executive buy-in was already in place.
Rather than launching an ambitious data classification project, we divided the company and started with a rather simple part, human relations. We helped them identify what their critical data was, where it resided, and crafted policies to protect it. This helped us establish a baseline and helped other departments understand how data impacts operations and how the process would work for them, which eliminates some of the fear involved in the project. Users need to see that we aren't taking access to data away from them or locking it up but better protecting it.
How to keep up with changing security landscape
With the average cost of a data breach now at nearly $3.8 million, and attacks coming faster and furiously, it is more important than ever to secure your data. Keeping up with the latest security measures is difficult. Good security experts are hard to find and expensive to hire, so many companies are turning to trusted partners to help them navigate the rapidly changing security minefield. With an overall understanding of where your data lives, DLP technology, and trusted partners that can help you implement the correct policies, you can avoid becoming the latest security breach headline.