Perimeter
1/9/2013
02:52 PM
Connect Directly
RSS
E-Mail
50%
50%

How Well Do You Know Your Data?

The more you know about your data, the more effectively you can protect it

Most organizations have a pretty good idea of which sensitive data is most critical to them. Depending on the kind of business entity, the data types can vary considerably. For financial organizations, the most critical data is most often consumer personally identifiable information (PII), including account and credit card numbers. In healthcare organizations, the major concern is still PII, but with a HIPAA twist to include protected health information. For other companies, the most critical data may be other nonpublic data, such as customer lists or intellectual property.

Regardless of the data types, in order to protect this sensitive data from insider threats (and outside, frankly), it is imperative for an organization to have as much knowledge of its data as possible. That means not just which data it is, but where it is, how it is used -- within and outside of the organization -- and the potential consequences if it were to become lost or stolen.

All that said, however, I do not support the idea of needing to know everything about sensitive data before taking steps to protect it. To the contrary, I stand firmly on the side of action, always assuming an organization and executive team know enough about the data to take effective protective measures. This is a delicate balance. On one hand, an organization may want to fully understand its data prior to deploying expensive data protection technologies. On the other hand, if the process of understanding the data is a multiyear project, the critical data may be subjected to unnecessary risk in the meantime.

So how does an organization maintain the right balance? For the sake of sensitive data, it is always prudent to take immediate action on the data already known to be the most critical. This could be, for example, the intellectual property of a technology company. Employing technologies in the short term to safeguard this intellectual property is the first and most important step. Once the most critical data is secured, the organization can then focus attention on identifying other sensitive data types. This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states.

Finally, a sensitive data review is always recommended. This process can be as simple or comprehensive as judged necessary. All data owners in an organization should be involved to ensure no sensitive data is overlooked. Each data set can be analyzed to map out approved handling procedures and identify any holes, determine appropriate storage locations, confirm approved data handlers, establish the correct process for breach response for that specific data, gauge the probable impact of data loss, and apply a risk ranking so the organization can know which of the sensitive data types have the greatest potential for collateral damage.

Armed with this newfound knowledge, an organization can protect all sensitive data, employ data protection tools on new data sets, uncover better data handling procedures, and take other appropriate steps to mitigate data loss risk.

Jared Thorkelson is President of DLP Experts, a reseller of data protection technologies Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jklingel296
50%
50%
jklingel296,
User Rank: Apprentice
1/23/2013 | 9:34:07 AM
re: How Well Do You Know Your Data?
Good article, describing exactly what we do at-áthe company I-¦m working for. It would be great if Jared could shed some light on the aspect of classifying data in terms of a monetary value. How do we get the information owner to stick a price tag to the data? Something we can then use in risk management to justify (costly)-ámeasures.

Best regards

Jan Klingel-á
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.