How to Understand and Protect the Data in Your Enterprise

Map Your Data

Even in a small company, the number of data repositories can be surprisingly large and stored in many different locations. They might live on computers, but can also be found in more low-tech places, including storage boxes, behind closed doors and memories.

The first step in protecting your data is to take inventory of it, in order to build a solid understanding of all the data sources used by your company. It is likely that you have enough data such that you may need to interview key teammates in the company to find all of these data repositories. Use it as an opportunity to share the importance of strong security ' by explaining the simplicity of knowing where data is, you can begin to create a culture that values security. You might even have existing tools that can make the process easier, such as placing a legal hold on potential stakeholders who can identify these data repositories.

For example, identify all of the places you are storing financial information. Some of it may be in Quickbooks, financial projections in spreadsheets, or long-term financial data in warehouses. Once you've collected the location of the data and categorized it by type, you can visualize it with a data map, identifying where sensitive data is stored and how it moves throughout the enterprise.

Reveal the Right Data to the Right People

The next step is to decide who should have access to this data ' clearly, not everyone needs access to financial data. However, data security isn't only important once the information is identified. Limiting stakeholders is also key in the creation of data. You should be very disciplined about who can read, change, or create customer-specific data, so you can easily add it to your data map without needing to repeat the inventory process.

I'd recommend dedicating a singular team to securing the company ' including physical, network, and data security ' that is independent of other departments in order to have an auditory view of activities across the enterprise. By promoting best standards in coding and security awareness, the entire company will understand the importance of having strong security practices. The media often points to the “human factor” as having a negative impact on cybersecurity, but by cultivating an internal culture of security, the human factor turns into a benefit.

Appoint a Data Steward

Once you have identified all your repositories, identify or “volunteer” a data steward for each of these repositories or sets of repositories. The data steward needs to be someone who understands the business need for the data, who has a good relationship with the users of the data, and has authority to make decisions about data access ' reviewing the lists on a regular basis for appropriateness.

Do the people who need access have it? Does the steward have the power to revoke access if necessary? Are there any new team members that need to be added periodically? All of these are questions that should be asked frequently, and reported to a compliance officer if applicable.

Monitor over Time

The final piece of the puzzle is monitoring. Even if you have done a full and detailed inventory, realize that this is just a snapshot in time. New people are hired in the company, some leave for other opportunities, and new data repositories are added. Your appointed data steward needs to be aware of these changes, and should add reviewing the changes to their daily task list. Building strong cybersecurity practices is not a one-time event ' its effectiveness is completely dependent on its prioritization. However, that does not mean it is a massive undertaking, and can be accomplished with a straightforward plan leveraged by a dedicated stakeholder.

Conclusion

A data breach to an organization can be a very severe event. If your data is affected in a breach, you will be many steps ahead if you already know what data exists, how important it is to your organization, and who has access to it. This jump-start to your breach response will be valuable in the long run, and by knowing the data inside and out there is always a buffer of preparation ' and you will sleep better at night, knowing where your data lies.

Bill Lederer joined kCura in 2015, leading a team dedicated to maintaining secure virtual environments for customers and employees. He previously worked at Matasano as a security consultant and ran his own independent consultancy.