Data Asset Management: What Do You Really Need?

At Interop, a cybersecurity and privacy leader explains her approach to data management and governance at a massive, decentralized company.

INTEROP 2019 – LAS VEGAS – Nobody wants to admit they dont know what kind of data theyre collecting, where it goes, or where their backups are located. In a room packed with IT professionals, one could guess at least a few are grappling with those exact questions.
Its really critical to us to know what we have, said Stacey Halota, vice president of information security and privacy at Graham Holdings Co., during a keynote chat with Dark Reading senior editor Sara Peters at Interop 2019, held this week in Las Vegas. Each year, Graham Holdings conducts a sensitive data project to inventory data from every organization in the company. When the iterative process is complete, she explained, all of the metrics are sent to the board.
Much of the chat focused on data asset management and governance, a hot topic among the IT pro audience. Each data privacy regulation forces IT and security teams to consider data in a different way, Halota said. Consider GDPR, which she said was a little bit easier for the global company because it was already regulated by the European Unions Data Protection Directive.
GDPR is a supercharged version of the directive, Halota noted. But the California Consumer Privacy Act (CCPA), which has a different definition for personally identifiable information (PII), required a broader approach. Graham Holdings had to consider a wider range of device information to ensure its definition of PII was varied enough to include all of the data it stores. Its data protection impact assessment (DIPA) and existing risk assessments had to be repackaged.
New regulations have prompted technological change. The company relies on Archer for much of its data governance and risk compliance. A major step for GDPR, CCPA, and the many bills coming in the future is to repurpose Archer in some ways to define risk assessment and expand its document repository so it collects data needed for different laws.
Halota isnt only concerned with ensuring compliance for Graham Holdings data. Shes also focused on reducing the collection of sensitive data and deleting anything it doesnt need.
To us, the keystone of our business is information, she said. Its understanding what you have and what you collect ... what you collect is precious, its important, and its important to only collect what we need. If a company doesnt need information, it should delete it. As part of the sensitive data project, Graham Holdings organizations are not only asked about the information they collected, but that which they deleted. If they didnt delete anything, why?
We seek to minimize the really sensitive data that we hold, Halota said. For instance, Graham Holdings keeps data in production environments but scrambles it in non-production. It doesnt keep credit card numbers if it can help it, she added; if it has numbers, theyre tokenized.
Keeping sensitive data to a minimum is a businesswide effort. Halota has to speak with everyone – CEO, CFO, marketing, human resources, legal – to understand their needs and when it may be time to eliminate data. Its always a hard conversation, she said, and it can be complicated. Ive had missteps myself ... I think things should be deleted and they dont.
The most important part is building a relationship with different departments. Its absolutely critical to talk with every part of the business so she can argue when data isnt valuable to the company. Its not just saying, Were going to delete all this stuff, she said.
Related Content:
Effective Pen Tests Follow These 7 Steps
Proving the Value of Security Awareness with Metrics that Deserve More
The 3 Cybersecurity Rules of Trust
What You Need to Know About Zero Trust Security

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps