David Yakobovitch
Data security and privacy is mission critical for every organization in 2020 as cyber security threats¹ increase rapidly.
As information stores expand followed by out-of-control costs, and increasing regulatory requirements, ignoring the risks of unmanaged information is a losing and costly strategy.
Here is one truth: Sitting on vast amounts of unmanaged data is a competitive disadvantage when competitors are effectively managing and using all of their information assets.
From Equifax¹¹ to Canva¹² attacks from hackers and Adobe¹³ breach, enterprises need to reinvent their cybersecurity strategies.
Organizations adopting data governance policies² ensure protection against both malicious and negligent insider threats, as well as meet the compliance requirements of data protection regulations such as the GDPR, PCI DSS, HIPAA, or CCPA.
Laws and regulations change on a regular basis. Because of this, data privacy and security measures should be reviewed to ensure it continues to meet all legal and regulatory requirements and best practices.
Overview of Data Security and Privacy
Organizations are dependent on the creation and consumption of information. But information is valuable to an organization only if decision makers know where #data is, what is in it, and what is shareable.
The lack of good information governance³ has brought us to an inflection point: decision makers must gain control of their information to enable innovation and growth; or continue down the current path of information anarchy and potentially lose out to competitors who are better able to govern their information
The information governance policy should explain why the policy was created and why it is important to the organization, as well as an explanation of how information is used. The policy should include a designated person to direct questions to, as their contact information.
The information governance policy should list unacceptable information use/management and the penalties that will be administered for not following the policy.
Drivers of Data Governance Policies
Organizations look to information governance programs to solve a variety of problems normally revolving around risk, cost or both. In many cases, these problems are not obvious until they are already negatively impacting the organization.
The key business driver’s organizations are reacting to are:
Regulatory compliance requirements
#Informationsecurity
End-user productivity⁴
Public cloud storage
Implications of Weak Data Governance Policies
The following are some implications of weak data systems within organizations:
Out of control litigation costs
Bad publicity from data loss
Loss of confidential information
Inability to respond to information requests and regulatory action from loss
Best Practices for Data Security and Privacy
Let us explore 4 best practices organizations can implement to consolidate data security and privacy:
1. Cloud Data Protection Strategy
The cloud⁵ has become an integral part of digitization efforts, but as data migrates to the cloud, the issue of its security has sparked heated debates among CIOs
The most common policies applied by big companies involve the use of tools specialized in data protection in the cloud or a limitation of the types of data that are stored in the cloud. Another strategy involves encrypting sensitive data before it is transferred to the #cloud.
2. Current State of Data and Movement
One of the most crucial steps towards efficient data protection is knowing exactly what data is being stored and where. By accurately identifying data flow and its vulnerable points, companies can take informed decisions concerning the measures they need to take to protect it.
#Enterprises use data discovery tools to scan company networks for sensitive data⁶ and, when finding it on computers not authorized to access it, they frequently have the option of encrypting it. In the age of data protection regulations, transparency is key both for compliance and for building effective data protection policies.
3. Develop BYOD Measures
As companies embrace Bring-your-own-device⁷ policies that increase productivity and reduce costs, they often ignore their security implications. Accessing sensitive information on personal devices means that data is traveling outside the confines of the company network, effectively rendering any security measures taken to protect it moot.
Companies restrict the sort of data that can be transferred outside company devices. Policies marking the level of trust of a device can be applied. In this way, employees are given the option of aligning the security of their personal devices to policies used within the company and, if they choose not to apply them, it guarantees that no sensitive data is allowed to be transferred on them.
As we move forward into the age of data protection⁸ by design and by default, smaller and mid-sized companies must follow in the footsteps of larger companies and adopt policies that protect sensitive information from both inside and outside threats or risk losing not only their customers’ trust, but their entire businesses.
4. Organizational Encryption Policies
From encrypted hard drives, phones to data encrypted prior to transfer to the cloud or onto portable devices, #encryption⁹ has become a must for all companies looking to secure their sensitive information.
Encryption tackles two common data protection vulnerabilities in today’s global economy: a work force always on the move and the rise of remote work. With devices frequently leaving the safety of company networks, encryption ensures that, in case of theft or loss, the sensitive data they contain is inaccessible to outsiders.
Key Takeaways
Successful information governance programs combine records management, archiving, eDiscovery processes, technology-based auto-classification, and other capabilities to help organizations reduce legal and business risk, and to drive business value.
When information is actively managed, the organization profits greatly
Information governance is an enterprise-wide responsibility that can greatly add to the bottom line or end up being a complete waste of money and resources if not performed correctly.
One of the key reasons organizations move towards an information governance program is to enable an enterprise-wide sharing of information¹⁰. This can increase the return-on-investment of information by ensuring that valuable content is available to all that could benefit from it.
Works Cited
¹Cybersecurity Threats, ²Data Governance Policies, ³Information Governance, ⁴End-User Productivity, ⁵The Cloud, ⁶Sensitive Data, ⁷Bring-your-own-device, ⁸Data Protection, ⁹Encryption, ¹⁰Sharing of Information
Companies Cited