To Manage Security Risk, Manage Data First

At Interop 2019, IT and security experts urged attendees to focus on data asset management as a means of mitigating risk.

INTEROP 2019 – LAS VEGAS– At a time when organizations are launching digital transformation projects, bringing more devices onto their networks, and embracing cloud technology, its imperative leaders work together to create a plan for protecting vast stores of information.
Its no secret that cybersecurity and business teams often have a rocky relationship. As Optiv practice director Mark Adams explained here at Interop, security is viewed as a drag on the business. It doesnt demonstrate a value proposition, he said.
But business teams are not going to slow the pace of innovation, so security must help stay competitive by protecting the tech they want to use. Unfortunately, there isnt a real handbook around this, Adams noted, but its important for security teams to understand whats important for the business.
The problem is, most dont. The majority of cybersecurity teams can list priorities for their agendas, but they cant name even one of the top three business priorities. Responsibility for all this ultimately falls to the CISO, as board members expect the security lead to be a very savvy business person, he explained.
Digital transformation, however the business goes about it, carries tremendous implications for security staff. While great for the organization, these projects usually result in even more data being created, said Maxine Holt, research director for security at Ovum, in a discussion about digital transformation and privacy. Security functions must recognize and address the challenges.
Part of the problem in managing the influx of information is most companies either dont know where their data resides, what they want to protect, where backups are located, or answers to many other questions related to the management of the data they store. Security teams can stem the flow of information in a data leak, but that wont fix the core issue.
The way companies need to think about data has to change tremendously, noted Etan Lightstone, vice president of product design at ShiftLeft. Here are a roundup of the ideas, trends, and challenges around data management voiced by experts who spoke at Interop this week.
Know What Your Valuables Are
CISOs and security leads cant put a program around data governance if they dont know what to protect, Optivs Adams said. Its the first part of a data management strategy: Identify the most precious information the business needs to operate, know where it is, and prioritize its security. Sensitive data should be kept to a minimum and be given the strongest protection.
This isnt a one-time job, said Stacey Halota, vice president of information security and privacy at Graham Holdings Co., in a keynote. As a business changes, so, too, does its most valuable data. Her team conducts an inventory each year and requires each organization under Graham Holdings to report the data elements they have, where they go, where their backups are located, and other information so the full business knows what its collecting over time.
When data is no longer required to help a department or company operate, it should be deleted. The process for deciding what should stay and go is a complicated one, Halota explained. She said she has built relationships with division heads across the business so she can learn what they need and negotiate when its time to eliminate data thats no longer of value.
Watch Data Wherever It Goes
Businesses need to worry about data
wherever
it resides, said Shawn Anderson, executive security adviser in Microsofts Cybersecurity Solutions Group. Many businesses focus on endpoint security but should be thinking more broadly about where data is located – not only on employee computers, but in the cloud, on mobile devices, and on a growing pool of
IoT devices
.
You need to think differently about working in the cloud than you do on-prem, said Anderson in a session focused on endpoint security. The cloud is rapidly driving the amount of data companies collect, process, store, and use. Security teams can better protect data by focusing on identity: enabling multifactor authentication, blocking legacy authentication, increasing visibility into why identities are blocked, and monitoring and acting on alerts.
Businesses should protect their applications and verify those that employees can access. All of the different governance practices pretty much boil down to knowing who your users are and whether they have the appropriate access, said Michael Melore, an IBM cybersecurity adviser. People have privileges that they no longer require. Thats an unnecessary risk. There should be processes in place to acknowledge whether privileges are no longer needed.
No matter how much software is on the endpoint, attackers will win if you lack a data protection strategy, Anderson said. Sensitive data should be secured from the time it enters the organization: It should be detected when it arrives, classified and labeled according to policy, and protected as it travels across the business before its eventually retired and deleted.
A Closer Eye on Compliance
Compliance is not strictly a security issue, Ovums Holt explained, but it is a lever on security and attracts board-level interest. She pointed to scenarios in which organizations were fined for noncompliant security and privacy practices. For example, one Portuguese healthcare provider was fined €400,000 (US$447,328) because staff illicitly accessed patient records. A German social media company was fined €20,000 (US$22,366) for storing passwords in plaintext. Google was fined €50 million (US$55,917,500) for failing to meet transparency and information requirements, and not obtaining a legal basis for processing.
Government regulations, industry standards, and compliance requirements such as GDPR and NIST can cause an organizations information risk and security capabilities to change often and quickly, said John Pironti, president of IP Architects. He recommended companies document the types, amounts, and priority of information they find acceptable and unacceptable. This information-risk appetite should be developed alongside business leaders and stakeholders.
Still, different regulations have different definitions of what constitutes sensitive data. As Graham Holdings Halota
pointed out
in her talk, the California Consumer Protection Act (CCPA) puts a broader range of data under personally identifiable information than the GDPR. Graham Holdings had to repurpose its data governance solution to redefine risk assessment and expand its document repository so it was properly collecting and categorizing data.
Related Content:
Proving the Value of Security Awareness with Metrics that Deserve More
The 3 Cybersecurity Rules of Trust
What You Need to Know About Zero Trust Security
Satan Ransomware Adds More Evil Tricks

Last News
▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
To Manage Security Risk, Manage Data First