Not All Data Threats Are Created Equal

According to the 2013 Data Breach Investigations Report (DBIR), more than 47,000 information security incidents and 621 confirmed data breaches occurred in 2012 alone. No organization is immune, nor should any operate as though they are. That said, it’s impossible to protect everything and against every possible data breach scenario. Organizations should concentrate on identifying where they are most vulnerable and what data is most important to protect.

Consider for a minute that protecting your data was like protecting your home. Imagine you are installing protection measures to your home after some of your neighbors experienced burglaries the past few months. You’d put locks on the doors, install a new alarm system, maybe even put bars on some of the windows. Would it make sense to put bars on third-floor windows? What are the chances someone is going to be able to climb up three stories and break into those windows without being noticed? Probably very low. And the money that would be spent putting bars on those windows would probably be better used in other areas – fencing, flood lights, etc. Businesses should think this way about data. Rather than putting the same level of security on every piece of data, companies need to consider what to protect and how to best protect it by asking themselves two questions: How likely is it for someone to take it? Is it vulnerable enough to invest in protecting? What’s the cost of losing it?

To determine what’s vulnerable and important, consider the following tactics. Likely, this will help you worry less and leverage your assets, including personnel and skills, more effectively.

• Data Discovery: One of the first things to do when securing your home is an inventory and you increase protection in the areas where your valuables live. The same happens with your business. Doing a detailed data inventory can help you protect your data according to its importance. If you don’t know which environment or server houses your most critical data, chances are you are not doing what is necessary to protect it.
• Access Governance: Most people keep close tabs on their home keys. A few copies of your front door key floating around the town may increase the chances of things “disappearing” or even occasional break-ins. It is important to differentiate who needs access and those who would like access. While your nanny and housekeeper may need a key, your handyman and paperboy may not. Knowing who has access to your home (and data) is just as critical as knowing what you have and doing an inventory. Keeping a close eye on who has access can help your business reduce its risks in experiencing data breaches.
• Log Review: Installing cameras in your home is known as one of the best things to do to protect it. However, collecting video is not enough unless you take the time to review it. In a business, collecting log-in records is known to be a best security practice, but most organizations don’t go through the review process that is necessary to discover breaches. In fact, according to the 2013 DBIR analysis, 82 percent of breaches were discovered by third parties when there was evidence on their unviewed logs. Reviewing logs can help you prevent and react after data breaches take place. This can make the difference between discovering an incident hours versus months after it happened.

Data breaches can happen to anyone. Businesses-from large to small-are constantly combating and trying to prevent incidents that compromise their valuable assets. While developing protection tactics for every possible scenario is nearly impossible, assessing what’s important and what’s vulnerable-and acting upon that assessment-is not only viable, but also a best security practice.