Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/9/2013
02:52 PM
50%
50%

How Well Do You Know Your Data?

The more you know about your data, the more effectively you can protect it

Most organizations have a pretty good idea of which sensitive data is most critical to them. Depending on the kind of business entity, the data types can vary considerably. For financial organizations, the most critical data is most often consumer personally identifiable information (PII), including account and credit card numbers. In healthcare organizations, the major concern is still PII, but with a HIPAA twist to include protected health information. For other companies, the most critical data may be other nonpublic data, such as customer lists or intellectual property.

Regardless of the data types, in order to protect this sensitive data from insider threats (and outside, frankly), it is imperative for an organization to have as much knowledge of its data as possible. That means not just which data it is, but where it is, how it is used -- within and outside of the organization -- and the potential consequences if it were to become lost or stolen.

All that said, however, I do not support the idea of needing to know everything about sensitive data before taking steps to protect it. To the contrary, I stand firmly on the side of action, always assuming an organization and executive team know enough about the data to take effective protective measures. This is a delicate balance. On one hand, an organization may want to fully understand its data prior to deploying expensive data protection technologies. On the other hand, if the process of understanding the data is a multiyear project, the critical data may be subjected to unnecessary risk in the meantime.

So how does an organization maintain the right balance? For the sake of sensitive data, it is always prudent to take immediate action on the data already known to be the most critical. This could be, for example, the intellectual property of a technology company. Employing technologies in the short term to safeguard this intellectual property is the first and most important step. Once the most critical data is secured, the organization can then focus attention on identifying other sensitive data types. This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states.

Finally, a sensitive data review is always recommended. This process can be as simple or comprehensive as judged necessary. All data owners in an organization should be involved to ensure no sensitive data is overlooked. Each data set can be analyzed to map out approved handling procedures and identify any holes, determine appropriate storage locations, confirm approved data handlers, establish the correct process for breach response for that specific data, gauge the probable impact of data loss, and apply a risk ranking so the organization can know which of the sensitive data types have the greatest potential for collateral damage.

Armed with this newfound knowledge, an organization can protect all sensitive data, employ data protection tools on new data sets, uncover better data handling procedures, and take other appropriate steps to mitigate data loss risk.

Jared Thorkelson is President of DLP Experts, a reseller of data protection technologies Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jklingel296
50%
50%
jklingel296,
User Rank: Apprentice
1/23/2013 | 9:34:07 AM
re: How Well Do You Know Your Data?
Good article, describing exactly what we do at-the company I-m working for. It would be great if Jared could shed some light on the aspect of classifying data in terms of a monetary value. How do we get the information owner to stick a price tag to the data? Something we can then use in risk management to justify (costly)-measures.
-
Best regards
-
Jan Klingel-
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13611
PUBLISHED: 2019-07-16
An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.
CVE-2019-0234
PUBLISHED: 2019-07-15
A Reflected Cross-site Scripting (XSS) vulnerability exists in Apache Roller. Roller's Math Comment Authenticator did not property sanitize user input and could be exploited to perform Reflected Cross Site Scripting (XSS). The mitigation for this vulnerability is to upgrade to the latest version of ...
CVE-2018-7838
PUBLISHED: 2019-07-15
A CWE-119 Buffer Errors vulnerability exists in Modicon M580 CPU - BMEP582040, all versions before V2.90, and Modicon Ethernet Module BMENOC0301, all versions before V2.16, which could cause denial of service on the FTP service of the controller or the Ethernet BMENOC module when it receives a FTP C...
CVE-2019-6822
PUBLISHED: 2019-07-15
A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.
CVE-2019-6823
PUBLISHED: 2019-07-15
A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.