Large-scale cyber-attacks, such as hacking, malware and unintended disclosures, became far too frequent this past year. With more than 30 major data breaches occurring in 2017, including the major breach from Experian, no single industry was exempt. Institutions across the spectrum found themselves victims of attack – from retail, financial service, and health care to educational, service, and government. In fact, this year Ponemon Institute reported that the average total cost of a data breach is now $3.62 million. Collectively, the rise of cybercrime has pushed information security (a subset of cybersecurity) spending to more than $86.4 billion in 2017, according to Gartner.
With the cost of data breaches continuing to rise, there has never been a better time to find solutions that protect your customers’ data and reputation while mitigating potential risks. As we head into 2018, we can only predict that cyber-attacks will become more frequent and severe.
To help mitigate this, here are five best practices that organizations can take into consideration to prevent data leaks:
1. Define a security policy
Organizations should start by developing a set of guidelines or best practices that all employees follow. IT decision makers should be charged with evaluating and updating corporate policies with increased frequency. This includes enforcing straightforward policies like not leaving computers logged on/unlocked when away from your desk and not sharing accounts with coworkers. These activities pose a high risk of data loss by an employee or data theft by a hacker because they are often unmonitored. Such basic rules may seem like non-brainers, but if they are not dictated and enforced, company data may be vulnerable to cyber-attacks.
Other policies may be industry or company specific. Who should have access to customer data, how is data classified as PII or PHI segregated and stored, and how should physical building security be managed? Establish a regular cadence for reviewing and updating the policy, and you are on your way to securing your corporate and customer data.
2. Invest in the right technology
Having the right technology in place is a critical line of defense when faced with hackers, malware and other cyber threats. This is not just one solution. Work towards a layered approach to protect against security threats, monitor and identify security risks, and respond to security threats and situations. Smaller companies may do some of this manually, while larger organizations will want to automate as much as possible.
Beyond standard approaches using firewalls, network monitoring, and secure backups, consider a solution for data protection. This might include a DLP or CASB tool, or an enterprise rights management solution, which aims to protect content from accidental or malicious sharing. Enterprise rights management (ERM) software embeds encryption and use permissions directly into a file, instead of the systems around it. Whether these files are in transit or in use, ERM software protects the information from inappropriate use. As a result, as we like to say, these solutions protect emails and documents and allow secure collaboration anytime, anywhere, and to anyone on virtually any device.
3. Keep your passwords and devices secure
As thousands of emails and documents are sent and received both inside and outside organizations daily, these become thousands of instances where employees can be vulnerable to data breaches. While sending data like intellectual property (IP) and Personally Identifiable Information (PII) are part of many people’s daily jobs, sharing is not always caring when it comes to sensitive information. Research from Cisco stated approximately, 63 percent of employees admitted to using a work computer for personal use every day, and 83 percent admit to doing so occasionally. However, the transference of files between work computers and personal computers opens companies to cyber threats and corporate liability. Employees will continue to use their personal phones for work, so companies can help them by providing secure ways to perform work activities on such devices. Can your employees view sensitive information on their phones in a secure manner? If not, your data may be at risk.
Another way organizations can help employees in this area is to provide access to key systems as-needed. Use of pluggable authentication modules (PAM) is becoming more popular to grant administrative access to engineers or database experts only when they need truly it. The underlying systems are more secure and the company can monitor when and how often employees request elevated rights.
4. Provide security education
When it comes to cyber threats and attacks there’s no such thing as too much information. Establishing a security awareness and education practice in your business is an important step to help your employees handle phishing, social engineering, and other cyber attacks. If employees believe security programs are important they are more likely to adhere to policies and follow procedures - like the ones laid out in Step #1. Part of this education should include knowing the physical location where sensitive data is stored. Especially when organizations operate in multiple locations, the importance of securing data both on a device and while in motion should be emphasized. By spreading awareness across the enterprise regarding the consequences of individual actions and the impact of a breach, organizations may avoid security problems entirely.
5. Maintain compliance with regulations
Complying with regulations is pivotal to secure digital operations. In addition to complying with government cybersecurity regulations, such as NIST 800-171, it is vital that companies have rules in place to protect cyber content inside and outside the organizational network. This includes the hundreds of emails and documents organizations process daily, which may fall out of the scope of some specific laws yet still represent corporate liability and reputation risks. To keep HR, legal, and other documents protected and secure, organizations should work internally and with their cloud vendors to know where data is stored and where it is processed. When enterprises prioritize content protection to meet compliance regulations, they have a better chance of preventing data leakage and of preventing fines or reputational issues related to this information.
Data theft and hacking are an unfortunate reality and an increasingly prevalent threat in the digital age. No one is immune. To minimize the potential for and consequences of a data breach, cybersecurity should be top of mind in every industry. Organizations can lessen their risk by following the simple ideas presented here: establish security policies, invest in the right solutions, secure device and data access, invest in employee education, and actively maintain compliance with applicable regulations.
Good luck, and stay safe out there.
Erik Brown, CTO, GigaTrust
Image Credit: Wright Studio / Shutterstock