Perimeter
1/9/2013
02:52 PM
Connect Directly
RSS
E-Mail
50%
50%

How Well Do You Know Your Data?

The more you know about your data, the more effectively you can protect it

Most organizations have a pretty good idea of which sensitive data is most critical to them. Depending on the kind of business entity, the data types can vary considerably. For financial organizations, the most critical data is most often consumer personally identifiable information (PII), including account and credit card numbers. In healthcare organizations, the major concern is still PII, but with a HIPAA twist to include protected health information. For other companies, the most critical data may be other nonpublic data, such as customer lists or intellectual property.

Regardless of the data types, in order to protect this sensitive data from insider threats (and outside, frankly), it is imperative for an organization to have as much knowledge of its data as possible. That means not just which data it is, but where it is, how it is used -- within and outside of the organization -- and the potential consequences if it were to become lost or stolen.

All that said, however, I do not support the idea of needing to know everything about sensitive data before taking steps to protect it. To the contrary, I stand firmly on the side of action, always assuming an organization and executive team know enough about the data to take effective protective measures. This is a delicate balance. On one hand, an organization may want to fully understand its data prior to deploying expensive data protection technologies. On the other hand, if the process of understanding the data is a multiyear project, the critical data may be subjected to unnecessary risk in the meantime.

So how does an organization maintain the right balance? For the sake of sensitive data, it is always prudent to take immediate action on the data already known to be the most critical. This could be, for example, the intellectual property of a technology company. Employing technologies in the short term to safeguard this intellectual property is the first and most important step. Once the most critical data is secured, the organization can then focus attention on identifying other sensitive data types. This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states.

Finally, a sensitive data review is always recommended. This process can be as simple or comprehensive as judged necessary. All data owners in an organization should be involved to ensure no sensitive data is overlooked. Each data set can be analyzed to map out approved handling procedures and identify any holes, determine appropriate storage locations, confirm approved data handlers, establish the correct process for breach response for that specific data, gauge the probable impact of data loss, and apply a risk ranking so the organization can know which of the sensitive data types have the greatest potential for collateral damage.

Armed with this newfound knowledge, an organization can protect all sensitive data, employ data protection tools on new data sets, uncover better data handling procedures, and take other appropriate steps to mitigate data loss risk.

Jared Thorkelson is President of DLP Experts, a reseller of data protection technologies Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jklingel296
50%
50%
jklingel296,
User Rank: Apprentice
1/23/2013 | 9:34:07 AM
re: How Well Do You Know Your Data?
Good article, describing exactly what we do at-áthe company I-¦m working for. It would be great if Jared could shed some light on the aspect of classifying data in terms of a monetary value. How do we get the information owner to stick a price tag to the data? Something we can then use in risk management to justify (costly)-ámeasures.

Best regards

Jan Klingel-á
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4734
Published: 2014-07-21
Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.

CVE-2014-4960
Published: 2014-07-21
Multiple SQL injection vulnerabilities in models\gallery.php in Youtube Gallery (com_youtubegallery) component 4.x through 4.1.7, and possibly 3.x, for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) listid or (2) themeid parameter to index.php.

CVE-2014-5016
Published: 2014-07-21
Multiple cross-site scripting (XSS) vulnerabilities in LimeSurvey 2.05+ Build 140618 allow remote attackers to inject arbitrary web script or HTML via (1) the pid attribute to the getAttribute_json function to application/controllers/admin/participantsaction.php in CPDB, (2) the sa parameter to appl...

CVE-2014-5017
Published: 2014-07-21
SQL injection vulnerability in CPDB in application/controllers/admin/participantsaction.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to execute arbitrary SQL commands via the sidx parameter in a JSON request to admin/participants/sa/getParticipants_json, related to a search parameter...

CVE-2014-5018
Published: 2014-07-21
Incomplete blacklist vulnerability in the autoEscape function in common_helper.php in LimeSurvey 2.05+ Build 140618 allows remote attackers to conduct cross-site scripting (XSS) attacks via the GBK charset in the loadname parameter to index.php, related to the survey resume.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.