In recent years, data protection has become a must for all companies, no matter their size. While big organizations suffering data breaches such as Facebook, Orbitz or Quora are the ones making headlines, a more troubling reality awaits small and mid-sized companies: 60% of them go out of business within six months of a cyberattack, according to the National Cyber Security Alliance.
Additionally, the rise of data protection regulations around the world, has added an extra layer of urgency to the need for all companies to implement concrete data protection measures. Big companies, are, in many cases, way ahead of the game, having already built their cybersecurity policies and tested them over the course of the last few years. Let’s have a look at some of their most successful strategies:
1. Knowing where data is and where it’s going
One of the most crucial steps towards efficient data protection is knowing exactly what data is being stored and where. By accurately identifying their data flow and its vulnerable points, companies can take informed decisions concerning the measures they need to take to protect it.
Large organizations use data discovery tools to scan company networks for sensitive data and, when finding it on computers not authorized to access it, they frequently have the option of deleting or encrypting it. In the age of data protection regulations, transparency is key both for compliance and for building effective data protection policies.
2. The use of encryption across the board
From encrypted hard drives, USBs and phones to data encrypted prior to its transfer to the cloud or onto portable devices, encryption has become a must for all companies looking to secure their sensitive information.
Encryption tackles two common data protection vulnerabilities in today’s global economy: a work force always on the move and the rise of remote work. With devices frequently leaving the safety of company networks, encryption ensures that, in case of theft or loss, the sensitive data they contain is inaccessible to outsiders.
3. Protecting data in the cloud
The cloud has become an integral part of digitalization efforts, but as data migrates to the cloud, the issue of its security has sparked heated debates among CIOs and in information security circles. While many argue that the security measures applied by cloud service providers to their servers far exceed any a modest or even large company is likely to apply to its on-site servers, the feeling that their most sensitive data’s security is out of their hands makes many organizations nervous.
The most common policies applied by big companies involve the use of tools specialized in data protection in the cloud or a limitation of the types of data that are stored in the cloud. Another strategy involves encrypting sensitive data before it is transferred to the cloud.
4. Educating employees at all levels
The human factor is often the biggest vulnerability in the chain of data protection. Whether through ignorance or negligence, employees account for 54% of data breaches according to a survey conducted by the Ponemon Institute. Large corporations ensure employees are kept informed of compliance regulations and internal cybersecurity policies, providing them with both training and clear guidelines for those coming into contact with the most sensitive types of data.
C-level executives are frequently targeted by malicious outsiders due to their high level access to data. Big companies take special care that higher management do not circumvent the rules as it is essential that the same level of data security is maintained across the board, not only horizontally, but vertically as well.
Software such as Data Loss Prevention solutions can act as an effective method of enforcement, by setting clear policies that protect and restrict access to sensitive data. Levels of access to data can be controlled based on groups and specific users or endpoints.
5. Creating BYOD policies
As companies embrace Bring-your-own-device (BYOD) policies that increase productivity and reduce costs, they often ignore their security implications. Accessing sensitive information on personal devices means that data is traveling outside the confines of the company network, effectively rendering any security measures taken to protect it moot.
Big organizations restrict the sort of data that can be transferred outside company devices. At the same time, policies marking the level of trust of a device can be applied. In this way, employees are given the option of aligning the security of their personal devices to policies used within the company and, if they choose not to apply them, it guarantees that no sensitive data is allowed to be transferred on them.
As we move forward into the age of data protection by design and by default, smaller and mid-sized companies must follow in the footsteps of larger companies and adopt policies that protect sensitive information from both inside and outside threats or risk losing not only their customers’ trust, but their entire businesses.