Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

1/9/2013
02:52 PM
50%
50%

How Well Do You Know Your Data?

The more you know about your data, the more effectively you can protect it

Most organizations have a pretty good idea of which sensitive data is most critical to them. Depending on the kind of business entity, the data types can vary considerably. For financial organizations, the most critical data is most often consumer personally identifiable information (PII), including account and credit card numbers. In healthcare organizations, the major concern is still PII, but with a HIPAA twist to include protected health information. For other companies, the most critical data may be other nonpublic data, such as customer lists or intellectual property.

Regardless of the data types, in order to protect this sensitive data from insider threats (and outside, frankly), it is imperative for an organization to have as much knowledge of its data as possible. That means not just which data it is, but where it is, how it is used -- within and outside of the organization -- and the potential consequences if it were to become lost or stolen.

All that said, however, I do not support the idea of needing to know everything about sensitive data before taking steps to protect it. To the contrary, I stand firmly on the side of action, always assuming an organization and executive team know enough about the data to take effective protective measures. This is a delicate balance. On one hand, an organization may want to fully understand its data prior to deploying expensive data protection technologies. On the other hand, if the process of understanding the data is a multiyear project, the critical data may be subjected to unnecessary risk in the meantime.

So how does an organization maintain the right balance? For the sake of sensitive data, it is always prudent to take immediate action on the data already known to be the most critical. This could be, for example, the intellectual property of a technology company. Employing technologies in the short term to safeguard this intellectual property is the first and most important step. Once the most critical data is secured, the organization can then focus attention on identifying other sensitive data types. This could include data such as HR and employee data, which, in many cases as consumer PII, is subject to data breach notification laws in all but a handful of U.S. states.

Finally, a sensitive data review is always recommended. This process can be as simple or comprehensive as judged necessary. All data owners in an organization should be involved to ensure no sensitive data is overlooked. Each data set can be analyzed to map out approved handling procedures and identify any holes, determine appropriate storage locations, confirm approved data handlers, establish the correct process for breach response for that specific data, gauge the probable impact of data loss, and apply a risk ranking so the organization can know which of the sensitive data types have the greatest potential for collateral damage.

Armed with this newfound knowledge, an organization can protect all sensitive data, employ data protection tools on new data sets, uncover better data handling procedures, and take other appropriate steps to mitigate data loss risk.

Jared Thorkelson is President of DLP Experts, a reseller of data protection technologies Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years ... View Full Bio

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jklingel296
50%
50%
jklingel296,
User Rank: Apprentice
1/23/2013 | 9:34:07 AM
re: How Well Do You Know Your Data?
Good article, describing exactly what we do at-the company I-m working for. It would be great if Jared could shed some light on the aspect of classifying data in terms of a monetary value. How do we get the information owner to stick a price tag to the data? Something we can then use in risk management to justify (costly)-measures.
-
Best regards
-
Jan Klingel-
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.