Data Security Best Practices Every CISO Should Know

Image

Aligning Data Security with Organizational Strategy

The responsibility for an organization’s information and data security is a hefty one, knowing each day that it’s not a matter of whether a cybersecurity attack will happen, but rather when it will happen on your watch. Whether data is grabbed in a headline-making breach of a well-known entity, or simple human error upends your operation, the financial and reputational impact can take its toll for years to come. According to a study by IBM, the average cost of a data breach is estimated at $3.92 million.

With information exchanged at ever faster and larger volumes, often in hybrid, complex IT environments, CISOs have their work cut out for them in terms of data security. Add in the remote workforce scenarios that look like they will be here to stay in some fashion, and it’s apparent that business-critical data is more vulnerable today than ever before. Luckily, there are also more solutions available to protect it from deliberate theft, manipulation, or human error.

Data security initiatives are one of those corporate balancing acts, as all initiatives should be aligned with overall organizational strategy. As CISOs, a deeper understanding of the business can help make operational activities surrounding data security more effective.

Here are some best practices CISOs and other security professionals can apply to their organizations.

Data Security Best Practices

It is imperative that those in charge of this protection, CISOs and others, assess their unique risks and minimize them through layered security initiatives and best practices.

Data security forms the basis from which all other security efforts radiate. If not secured at the onset, security measures directed at applications, endpoints, networks, and your perimeter are diminished. Both proactive and reactive measures can help ensure end-to-end security around your business-critical assets.

Assessing, identifying, layering, and securing data through integrated software solutions can act to comprehensively help protect the information your organization counts on to get business done throughout each state of its journey. These best practices should be considered when working under the matrix of data security as a mindset and as a set of coordinated efforts versus disparate software solutions.

1. Think About What You Are Trying to Protect and Why

Beneath all other data security decisions you consider should be the answer to the question above: What needs protecting and why? If you don’t know the answers to these two broad questions, nothing else matters.

With answers in hand, however, you can begin to operate from a zero-trust solution strategy and focus on the ultimate organizational mission.

2. Know What Kind of Data You Have and Where It Is

Before taking steps to protect your sensitive data, it’s imperative to know where all of your data actually lives. Is it on-premises, in the cloud, with third parties? Audit where your data is and then document it.

In a recent Fortra study, CISOs agreed that data visibility is their biggest cybersecurity weakness. After all, how can organizations begin to effectively control and govern their data if they don’t know what data they have, where it lives, how it is shared, and who can access it? A thorough understanding of this information can significantly boost a company’s ability to manage and control its data as well as lead to a more focused and appropriate technology solution.

Related Reading: What are Data Security Solutions and How do They Work?

3. Classify Your Data

Identifying and classifying what type of information you need to protect, including critical unstructured data such as intellectual property, gets your data security off on solid footing. Doing so also helps you secure the base control and management parameters needed to help ensure compliance.

The growing requirements – regulatory, compliance and legislative – organizations must adhere to can be challenging without context as to which data requires management and protection. Whether you need to protect public, financial, personally identifiable information (PII) information, or more, data classification can be the base upon which additional security layers are placed upon, as they continue to protect data along its journey. Data classification essentially serves as a red flag or warning as data travels, with metadata labels applied to sensitive data forming key alerts along the way.

Related Reading: 5 Steps to Effective Data Classification

4. Know Where Your Data Flows

Once you know what data you have, you need to also ascertain where it’s coming from, as well as where it’s going to in terms of geographic boundaries. There may be multiple national and international regulations to be aware of that are in force surrounding how you handle data at rest and in motion, particularly when it comes to international data transfers.

Meeting and adhering to industry or governmental compliance standards is substantially easier with a robust suite of data security solutions that work in sync.

5. Deploy Minimal Rights as Default; Scale Up Access, Not Down

Robust software solutions allow for the customization needed to control how access and rights to your sensitive data is granted. Rather than granting carte blanche access internally or externally to information requiring protection, you can start with the least amount of access possible and grant access as needed for specific business needs on a transfer-by-transfer basis, or for a limited time period.

6. Deploy Role-based Access and Multi-Factor Authentication

Another best practice when considering the sensitive information you’re responsible for locking down is to deploy data access on a role-based basis to limit access points from a given organization. Adding a multi-factor authorization requirement further contains your data access during file exchanges.

Robust collaboration and managed file transfer tools can be configured to mandate this and are seamless, automatic ways to ensure this restriction is employed on all file transfers.

7. Address Data Security with a Suite of Solutions for Simplification

CISOs would be wise to think in terms of implementing a suite of solutions versus disparate, singular solutions. By “upgrading” to a data security solutions suite, you get the benefit of software designed to be integrated with each other, with adaptation and ROI and smoother integration.

To maximize your data security position, your selected solutions should tackle the following security measures:

• Understand and classify files that may contain sensitive data
• Detect and prevent leaks of this sensitive information outside of your organization
• Secure and protect sensitive data that is shared both inside and outside your organization

In addition, such solutions should be able to be user-friendly to integrated, deployed, and adopted seamlessly to reduce the workload of staff and impact on productivity.

Reducing the complexity of the management of various solutions or vendors can often be compared to playing a round of Jenga (that tower block game). If you remove one block to find the solution you are replacing, you may find that new solution does not have the granularity you need. Vendors who provide solutions built over time deliver value in simplicity and balance.

8. Layered Security is a Data Security Best Practice

Data security is only as solid as the various elements that support it. Layering robust, proven solutions to ensure your sensitive data remains secure from start to finish is a proactive approach. Fortra’s suite of data security solutions provides the range of data protection needed: identification and classification, data loss protection and secure file transfer and collaboration.