Arguably the most important piece of the security domains, for a simple reason: Data is money. Be it insider threats or external threats, the main goal of attackers is to get hold of data from enterprises and individuals alike. There is no silver bullet to safeguard our data, and we have put in place approaches that are quickly becoming the industry’s best practices:
- We cannot protect what we do not know. Hence, it is essential to know the location and type of data you have. Data Discovery is the suggested first step in helping organizations know themselves better. Did someone hide a $100 bill in a shoebox? Is it in a biscuit tin? Data discovery will search for long forgotten, yet important data that is strewn in an organization’s environment.
- Data Classification is to give data a “price tag”. How important is the data to the organization? Can one afford to lose these data? These are key questions to consider before defining what should be done for the data that were classified. So far, the Defense and Financial industry has done quite well in this aspect and they are role models for this area.
- Data Encryption is the last line of defence for your valued data. The key challenge is to identify the data to encrypt, and to ensure that the decryption process do not compromise the integrity of the data.
- Data Leakage Prevention comes into play to minimise the risk of unintentional data leakage from a rightful person. Policy review is an ongoing effort that an organization will need to take up, to keep up with any changes to the ever dynamic organization requirements.