The Truth About Data Security in Today's Cyber Landscape

June/July Month in Review

Presented by Jeff Garrett, Opkalla VP of Solutions Architecture

Happy August to all! I hope the summer has been kind to everyone and that you are getting the chance to enjoy some rest and relaxation with friends and family. Though we no longer get to unplug for three-month-long summers like we did as kids, it is always great to take some time away from work.

Let’s be honest though, as technologists in today’s technology-driven world, we never truly unplug. We typically look at life situations through work-colored glasses. I found myself doing the same on my travels with my family this summer. From airlines to restaurants and hotels, I kept thinking about the question, "How secure are these organizations with my data?"

Data Security has been a huge topic of conversation with customers over the last few months. So, for this iteration of Month-In-Review, I am sticking to the theme of cybersecurity, but with a specific focus on Data Security.

When it comes to data, I believe that most organizations are in the business of securing it but are not doing true Data Security. There is a primary focus today on keeping the bad guys out of our data in areas such as -

  • Email security

  • Endpoint security

  • And network security

Even data backup is just a form of securing and protecting our data.

And while all of these are necessary, none of them provide true and complete Data Security.

True Data Security comes from knowing the What, Who, Where, and When of the data we store in our organizations.

The What (Data Classification):

Everything starts here. You cannot realistically perform the remaining areas of Data Security or even effectively protect your data without knowing what kind of data you have. Organizations needs to ask themselves:

  • How much sensitive data do we have?

  • Who has access to this data?

  • Where is this data?

  • Is this data backed up and protected correctly?

None of these questions can be answered if the data is not classified correctly. Organizations need to start by classifying their data according to its sensitivity level. This will help identify which data is most important to protect. It will also make the remaining functions of Data Security much easier.

The Who (Access Control):

"Zero Trust": Everyone say it out loud, mark it off your buzzword bingo cards, and let’s move on. Yes, it is a buzzword now, but the underlying concept of least privilege and "never trust, always verify" is very important here.

Once you know what sensitive data the organization has, you need to make sure there are proper access controls for that data. Organizations needs to ask themselves:

  • Do we know who is accessing this data?

  • Do they even need to access this data?

  • Are they who they say they are?

Organizations then need to implement access control measures to restrict access to sensitive data to prevent improper use and compromised access.

These controls should include:

  • User authentication

  • Role-based access control

  • And least privilege

Proper controls can keep accounts from becoming compromised or from giving compromised accounts too much access.

The When and Where (Data Tracking & Awareness):

Now that you have identified your data and put access controls in place, you need to continually make sure you know the when and where of data access and storage. Even if everything else is done correctly—you’ve kept the bad guys out, classified everything, and controlled access—sensitive data can still be moved outside of your organization.

Many times this is done by employees without knowing that they are potentially causing a serious risk. It’s especially true in today’s hybrid work-from-anywhere environment, where everyone has multiple email accounts and cloud storage locations to use.

Data tracking and awareness is becoming a new ask of cyber insurance providers, as they not only want to know the WHAT and WHO, but also WHEN something was accessed and WHERE it has been sent, moved, or copied.

It also involves an aspect of user behavior analysis to understand how people in the organization usually access data and if a change in their pattern shows signs of risk. This process of actively detecting and responding in real-time to data misuse is a newer area that data security tools have begun to address in the last few years.

Wrapping it Up

In all, cybersecurity is a multi-layered approach. By considering data classification, access control, and data tracking and awareness on top of traditional data backup and security controls, organizations can develop a comprehensive strategy that will move them from just securing their data to true Data Security.

Interested in a tailored in-depth Data Security for your organization? We’ve got you covered. Contact us to get started.

Month in ReviewCameron Keziah