In today’s digital era, data is vital for organizations, encompassing everything from customer details to intellectual property. However, this data is continuously gathered, stored, and exchanged across intricate IT systems, making it susceptible to breaches. To combat this, a robust data loss protection strategy is essential. Data breaches can lead to severe consequences, such as damage to reputation, loss of customers, and significant regulatory fines. In 2021, the average cost of a data breach soared to $4.24 million, according to IBM’s report.
Marriott International experienced firsthand the repercussions of a breach in 2018 when personal data of over 500 million guests was compromised, including names, addresses, passport numbers, and credit card information. The breach, lasting four years, stemmed from a compromised reservation database of Starwood Hotels, acquired by Marriott in 2016. This incident resulted in $72 million in fines from the UK’s Information Commissioner’s Office for GDPR violations, in addition to an estimated $200 million in other expenses, highlighting the critical importance of data protection.
Effective data protection necessitates a comprehensive approach, covering the entire data lifecycle. This includes identifying and classifying sensitive data, assessing and mitigating risks, establishing clear handling policies, implementing robust access controls and encryption, securing endpoints, and preparing to respond to incidents. This article delves into these seven crucial steps every organization should take to safeguard their data.
Step 1: Identify and Classify Sensitive Data
To begin a data protection strategy, it’s crucial to understand your data. This involves creating a complete list of all data within the organization, including databases and unstructured information like emails and documents. Automated tools can help with this by scanning networks and systems to find sensitive data such as personal information, financial records, and intellectual property.
Once all data is cataloged, it must be categorized based on its sensitivity. A typical classification system includes: Public data, which can be shared freely, like marketing materials; Internal data, for use within the organization only, such as company policies; Confidential data, which could harm if disclosed, such as employee records; and Restricted data, highly sensitive information that could cause severe harm if compromised, like customer financial data.
Why Data Classification Matters
Data classification enables organizations to implement security measures appropriate to the sensitivity of the data. For instance, public data might not require encryption, while restricted data may need robust protections like multi-factor authentication and end-to-end encryption
Misclassifying data can create security vulnerabilities. Consider a scenario where a marketing contractor is granted access to what’s assumed to be a customer contact list for a campaign. However, the list also contains customer purchase histories and credit card numbers. Without proper classification, this sensitive financial data could be mishandled and exposed. This occurred with Home Depot in 2014 when hackers used stolen credentials to access the retailer’s network, leading to a breach that cost over $200 million. Proper data classification and segregation of duties could have limited the impact of the breach.
Data classification is crucial for compliance with regulations like GDPR, which demand heightened protection for personal data. Proper classification ensures that appropriate controls are in place to meet these obligations. GDPR imposes fines of up to 4% of annual global revenue or €20 million (whichever is greater) for breaches of its data protection principles, including inadequate security measures for personal data.
Step 2: Assess Risks and Vulnerabilities
After cataloging and classifying data, the next step is to grasp the potential threats and weaknesses that could result in data loss. This involves conducting a comprehensive risk assessment, examining aspects such as the threat landscape, security posture, and compliance obligations.
The threat landscape entails understanding the kinds of attackers and attacks the organization might encounter, based on its industry and data assets.
Assessing security posture involves evaluating how effectively the organization is safeguarding its data across various fronts, including access controls, encryption practices, network security, and endpoint protection, to pinpoint any deficiencies.
It’s also vital to consider compliance obligations to ensure adherence to relevant data protection regulations. Failing a compliance audit can lead to substantial fines and reputational damage.
Understanding Your Data Risk Landscape
A real-life incident underscores the importance of proactive risk assessment. In 2013, Target experienced a significant data breach exposing personal and financial information of more than 110 million customers. The breach originated from a phishing email sent to an HVAC contractor working with Target. Attackers leveraged stolen credentials from the contractor to infiltrate Target’s network, installing malware on point-of-sale systems to pilfer customer data.
Although Target had evaluated its internal security measures, it overlooked the importance of assessing third-party risk. Consequently, the company incurred over $300 million in legal fees, settlements, and remediation expenses due to the breach. A proactive approach to evaluating and mitigating supply chain risk could have averted this costly incident.
Step 3: Establish Data Handling Policies and Procedures
Organizations must set clear rules for managing data throughout its lifecycle. This involves policies and procedures for data collection, storage, usage, sharing, retention, and disposal.
Collection policies determine what data is collected, why, and with consent, following data minimization principles to collect only necessary data. Storage policies specify where and how long data can be stored, with security measures in place and adhering to data localization requirements.
Usage policies outline who can access data and for what purposes, distinguishing between acceptable and unacceptable uses. Sharing policies govern how data can be shared internally or with third parties, requiring security controls and agreements.
Retention and disposal policies ensure data is retained only as long as necessary for business and legal reasons, and then securely deleted.
Developing a Data-Centric Security Policy for Healthcare Providers
A healthcare provider crafting a data handling policy in compliance with HIPAA must ensure that access to electronic protected health information (ePHI) is restricted to the minimum necessary for each employee’s role. For instance, while doctors may access complete patient records, billing specialists may only access insurance and payment data.
The policy must also require encryption of ePHI both at-rest and in-transit to prevent unauthorized access. Regular access audits are necessary to confirm that permissions remain appropriate. Additionally, when a patient requests their data be deleted, verification and secure deletion procedures must be followed.
Clear, risk-based policies establish expectations for employees and ensure consistent, compliant data handling practices across the organization. However, policies alone are insufficient. Regular employee training is essential for understanding data protection responsibilities. Furthermore, policies must be enforced through technical controls and ongoing monitoring.
Step 4: Implementing Robust Access Controls
Unauthorized access poses a significant threat to data security, whether from external attackers or malicious insiders. To mitigate this risk, implementing strong access controls is essential, with the principle of least privilege guiding the approach—granting users only the minimum access necessary for their job roles.
Multi-factor authentication (MFA) stands out as a highly effective measure against unauthorized access, requiring users to provide additional verification beyond passwords, such as codes from authenticator apps or biometric factors like fingerprints. MFA significantly reduces the risk of account compromise, with Microsoft reporting it can block over 99.9% of such attacks.
Role-based access control (RBAC) is another critical strategy, granting access based on users’ roles within the organization. Access permissions are mapped to job functions, ensuring users only have access to data and systems relevant to their roles. For instance, a financial analyst might have read access to financial reporting systems but no permission to modify data.
Regular auditing and adjustment of access permissions are vital. As employees change roles or leave the company, their access should be promptly updated or revoked to prevent unauthorized access. Dormant accounts and excessive permissions are common targets for attackers. Processes for immediate offboarding and periodic access reviews help address these security vulnerabilities.
Additional best practices include enforcing strong password policies, utilizing single sign-on (SSO) and identity and access management (IAM) platforms for centralized access management, network segmentation to limit lateral movement in case of a breach, and monitoring user activity for suspicious behaviors.
Get the plan, resources, and expertise in IT to move your business forward.
Let’s get you started today!
Step 5: Encrypting Data At-Rest and In-Transit
Despite robust access controls, organizations should prepare for potential data breaches by employing encryption, which renders data unreadable without the decryption key. Encrypting data both at-rest and in-transit is a fundamental practice for minimizing the impact of breaches.
At-rest encryption safeguards data stored on servers, databases, and devices, ensuring security even if a device is lost or stolen. Common solutions include Microsoft’s BitLocker for Windows devices and Apple’s FileVault for Macs, along with encryption options provided by enterprise storage and database systems.
During data transmission over networks, in-transit encryption using protocols like SSL/TLS establishes secure tunnels to prevent interception and tampering, especially crucial for public network transmissions. Browsers signal secure connections with padlock icons and “HTTPS” prefixes in the address bar.
For highly sensitive data, end-to-end encryption ensures encryption at the sender’s end, only decrypted at the recipient’s end, even if attackers access transmission servers. Tools like Signal for messaging and ProtonMail for email offer popular end-to-end encryption options.
Effective encryption key management is vital, with keys securely generated, stored, and managed to prevent unauthorized access. Hardware security modules (HSMs) are commonly used for secure key storage and management.
A 2018 breach disclosure from Aetna underscores encryption’s importance. The health insurer was fined $1.15 million for exposing the HIV status of 2,460 members due to unencrypted mail envelopes, violating HIPAA requirements. Encryption could have significantly mitigated the harm from this exposure.
Step 6: Securing Endpoints and Devices
Endpoint devices like laptops, smartphones, and tablets are often vulnerable points in an organization’s security. They frequently handle sensitive data and are susceptible to loss or theft, especially in remote work scenarios where they connect to corporate resources from insecure networks.
Start by ensuring devices are properly configured and regularly patched to address known vulnerabilities. Automated patch management systems can help keep devices updated with the latest security fixes. Additionally, configure devices securely by disabling unnecessary services, closing unused ports, and following hardening guidelines.
Deploy endpoint protection software, including antivirus solutions to detect known malware and endpoint detection and response (EDR) tools to identify new and fileless malware based on behavior.
Use virtual private networks (VPNs) when devices connect to untrusted networks to encrypt traffic and prevent interception. However, ensure VPN configurations are secure to avoid vulnerabilities.
For company-owned mobile devices, employ mobile device management (MDM) solutions for centralized management and security controls. This allows IT teams to enforce passcode policies, remotely wipe lost or stolen devices, and segregate corporate data from personal data.
Establish policies and educate employees on secure BYOD practices if personal devices are allowed for work. This may include requiring device encryption, prohibiting the download of sensitive data, and retaining the right to remotely wipe devices if necessary.
Step 7: Prepare for Incidents with a Detection and Response Plan
No organization is immune to security incidents. Quick detection, response, and recovery are crucial for minimizing damage.
Effective incident response starts with strong monitoring and alerting capabilities to promptly detect potential incidents. This includes analyzing log data, using intrusion detection and prevention systems (IDPS), employing security orchestration and automation (SOAR) tools, and setting alert thresholds.
A well-planned incident response (IR) plan guides the organization through containment, eradication, and recovery. Steps include initial triage, containment measures, evidence gathering, eradication of threats, recovery from clean backups, and post-incident review.
Regular testing of the IR plan through exercises and simulated attacks is vital for readiness. These sessions reveal plan gaps and improve team communication and coordination.
Data backups are critical. Following the 3-2-1 rule ensures backup viability in destructive malware attacks. Regularly test restore procedures.
Consider cybersecurity insurance to offset incident response costs, but insurers increasingly require robust security controls. Strong cybersecurity practices are essential as the cyber insurance market becomes more stringent.
Conclusion
In today’s digital landscape, safeguarding sensitive data is paramount. Organizations must take proactive measures across the entire data lifecycle, from collection to deletion. Following the seven outlined steps – inventory and classification, risk assessment, policy development, access control, encryption, endpoint security, and incident preparation – significantly enhances data security.