Perimeter
1/9/2013
02:52 PM
Connect Directly
RSS
E-Mail
50%
50%

How Well Do You Know Your Data?

The more you know about your data, the more effectively you can protect it

Most organizations have a pretty good idea of which sensitive data is most critical to them. Depending on the kind of business entity, the data types can vary considerably. For financial organizations, the most critical data is most often consumer personally identifiable information (PII), including account and credit card numbers. In healthcare organizations, the major concern is still PII, but with a HIPAA twist to include protected health information. For other companies, the most critical data may be other nonpublic data, such as customer lists or intellectual property.

Regardless of the data types, in order to protect this sensitive data from insider threats (and outside, frankly), it is imperative for an organization to have as much knowledge of its data as possible. That means not just which data it is, but where it is, how it is used -- within and outside of the organization -- and the potential consequences if it were to become lost or stolen.

All that said, however, I do not support the idea of needing to know everything about sensitive data before taking steps to protect it. To the contrary, I stand firmly on the side of action, always assuming an organization and executive team know enough about the data to take effective protective measures. This is a delicate balance. On one hand, an organization may want to fully understand its data prior to deploying expensive data protection technologies. On the other hand, if the process of understanding the data is a multiyear project, the critical data may be subjected to unnecessary risk in the meantime.

So how does an organization maintain the right balance? For the sake of sensitive data, it is always prudent to take immediate action on the data already known to be the most critical. This could be, for example, the intellectual property of a technology company. Employing technologies in the short term to safeguard this intellectual property is the first and most important step. Once the most critical data is secured, the organization can then focus attention on identifying other sensitive data types. This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states.

Finally, a sensitive data review is always recommended. This process can be as simple or comprehensive as judged necessary. All data owners in an organization should be involved to ensure no sensitive data is overlooked. Each data set can be analyzed to map out approved handling procedures and identify any holes, determine appropriate storage locations, confirm approved data handlers, establish the correct process for breach response for that specific data, gauge the probable impact of data loss, and apply a risk ranking so the organization can know which of the sensitive data types have the greatest potential for collateral damage.

Armed with this newfound knowledge, an organization can protect all sensitive data, employ data protection tools on new data sets, uncover better data handling procedures, and take other appropriate steps to mitigate data loss risk.

Jared Thorkelson is President of DLP Experts, a reseller of data protection technologies Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jklingel296
50%
50%
jklingel296,
User Rank: Apprentice
1/23/2013 | 9:34:07 AM
re: How Well Do You Know Your Data?
Good article, describing exactly what we do at-áthe company I-¦m working for. It would be great if Jared could shed some light on the aspect of classifying data in terms of a monetary value. How do we get the information owner to stick a price tag to the data? Something we can then use in risk management to justify (costly)-ámeasures.

Best regards

Jan Klingel-á
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.