Data Security in an Interconnected World

In a data-driven world, cybersecurity becomes the ‘hot topic’ on everyone’s mind. Between 2005 and 2018, there were 11 billion data records breached in the US. In 2018 alone, there were over 53,000 incidents and 2,216 confirmed data security breaches.

These breaches can cost a company billions of dollars—and even lost customers. In this blog, we dive into the proactive actions you can take that will help prevent a security breach and keep cybercriminals away from your customer sensitive information.

Communication is Key

We can’t stress enough the importance of increasing your interconnected environment, regulations and compliance requirements—and developing or updating your Code of Conduct is a good place to start. This step should be formally communicated by your President or CEO, or a top leader in the organization. It’s important to include references to company/individual responsibility in order to safeguard proprietary information for clients, suppliers and your company itself.

Developing, updating and communicating your information security polices, standards and procedures is another essential step. Example policies include: information security, risk management, physical security, data protection, network configuration, access control, logging and monitoring, information classification/handling, records retention and acceptable use.

Lastly, it’s vital to develop and practice a robust risk management program. This program should include internal/external security risk assessments, internal audits and third-party risk management programs (including legal, procurement and information security functional participation).

Know Your IT Environment

Not only should you know your IT environment like the back of your hand, but it’s vital to keep an updated asset inventory. Assign information stewards, data owners and data custodians to each IT asset so that nothing falls through the cracks.

Ever heard of patching? Patching is the process of making sure your software and solutions are up to date so that viruses don’t creep their way in and attack your systems. Implement a robust patching process that updates your applications, operating system, database and all network infrastructure layers appropriately.

Consider the Right Tools for Ultimate Success

Data loss prevention tools, also known as Cloud Access Security Brokers (CASB) in cloud environments, help ensure that end users don’t send sensitive or critical information outside of your corporate network/environment. This is commonly done through required training, usually within the first couple days of starting a new role at a company.

Along with data loss prevention tools, it’s important to consider tools that help perform internal and external penetration tests. This way you can prioritize and remediate findings and track open items easily and efficiently.

Identify Your High-Risk Vulnerabilities

If you aren’t performing regular internal and external scans to detect vulnerabilities and prioritize remediation of high-risk ones, you’re leaving yourself in the dark. Nothing can prepare you for an attack you don’t know is coming, but if you can catch one before it happens (or at least in the very beginning), you’re in a much better position than if you were running blind.

Follow these steps to ensure you’re fully prepared for a breach:

• Utilize tested standard configurations and remove unnecessary/insecure services and protocols
• Implement appropriate physical safeguards (employee identification/access badges, visitor management, video surveillance, access reports, access management)
• Develop and implement robust change management practices to reduce unplanned outages and ensure appropriate stakeholders are involved to approve changes with roll-back plans
• Log operating system, application, database and network events and ensure logs are reviewed timely
• Don’t store sensitive information in log files (passwords, account numbers, SSN, DOB, etc.)
• Implement IPS/IDS capabilities and ensure monitoring of network and host-based events are monitored with a short reaction time (e.g., 15 minutes)
• Develop and test an incident response plan and procedures with clear definition of roles and responsibilities, contact lists and notification procedures

The Right Malwarebytes Can Be Your Safe Haven

Malware, or malicious software, is any program or file intentionally designed to cause harm to your computer. Types of malware can include computer viruses, worms, Trojan horses and spyware. A software that protects against these, such as malwarebytes, can feel like a protective shield that always has your back.

Use malware detection/scanning services and apply regular updates to ensure they’re detected and eradicated on all computing devices. Encrypt sensitive data at rest and in transit using strong encryption techniques to ensure encryption keys are protected.

The following are general rules to follow when it comes to managing your malware detection software:

• Manage and review user and privileged accounts/access rights periodically (at least quarterly)
• Ensure strong password configuration practices are followed and encrypt passwords at all layers
• Implement and enforce usage of Virtual Private Network connections to internal networks
• Ensure secure system development practices are followed

Don’t Get Scammed by Internal Employees

At this moment, you may be thinking your biggest threat is external attackers. However, sometimes attacks can come from within. It’s important to perform background checks on prospective employees, contractors and any other third parties you use prior to employment.

Ensure they also sign non-disclosure/confidentiality agreements prior to being granted access to your networks, information and facilities. Require that information security awareness and training sessions are completed by employees and contractors periodically (at least annually)—and don’t forget to assess their knowledge.

In the event of a data breach, it’s important to communicate that ‘the show must go on’. That’s where a business continuity plan comes into place. Develop, test and update your business continuity/IT disaster recovery exercises periodically (at least annually) and ensure you communicate this to your employees once complete.

Lastly, identify, rank and manage your third-party relationships through a risk-based assessment program—including onsite and other assessment activities. This will allow you to stay on track with who might carry the highest risk.

So, now’s the time to ask yourself if you’re fully prepared to handle a data security breach. Or better yet, prevent one from happening altogether. By following these best practices, you’re a big step closer to protecting your clients’ data—and yours.