[BreachExchange] 5 Best practices to prevent data leaks in 2018

[Audrey McNeil]

https://www.itproportal.com/features/5-best-practices-to-
prevent-data-leaks-in-2018/

Large-scale cyber-attacks, such as hacking, malware and unintended
disclosures, became far too frequent this past year. With more than 30
major data breaches occurring in 2017, including the major breach from
Experian, no single industry was exempt. Institutions across the spectrum
found themselves victims of attack – from retail, financial service, and
health care to educational, service, and government. In fact, this year
Ponemon Institute reported that the average total cost of a data breach is
now $3.62 million. Collectively, the rise of cybercrime has pushed
information security (a subset of cybersecurity) spending to more than
$86.4 billion in 2017, according to Gartner.

With the cost of data breaches continuing to rise, there has never been a
better time to find solutions that protect your customers’ data and
reputation while mitigating potential risks. As we head into 2018, we can
only predict that cyber-attacks will become more frequent and severe.

To help mitigate this, here are five best practices that organizations can
take into consideration to prevent data leaks:

1. Define a security policy

Organizations should start by developing a set of guidelines or best
practices that all employees follow. IT decision makers should be charged
with evaluating and updating corporate policies with increased frequency.
This includes enforcing straightforward policies like not leaving computers
logged on/unlocked when away from your desk and not sharing accounts with
coworkers. These activities pose a high risk of data loss by an employee or
data theft by a hacker because they are often unmonitored. Such basic rules
may seem like non-brainers, but if they are not dictated and enforced,
company data may be vulnerable to cyber-attacks.

Other policies may be industry or company specific. Who should have access
to customer data, how is data classified as PII or PHI segregated and
stored, and how should physical building security be managed? Establish a
regular cadence for reviewing and updating the policy, and you are on your
way to securing your corporate and customer data.

2. Invest in the right technology

Having the right technology in place is a critical line of defense when
faced with hackers, malware and other cyber threats. This is not just one
solution. Work towards a layered approach to protect against security
threats, monitor and identify security risks, and respond to security
threats and situations. Smaller companies may do some of this manually,
while larger organizations will want to automate as much as possible.

Beyond standard approaches using firewalls, network monitoring, and secure
backups, consider a solution for data protection. This might include a DLP
or CASB tool, or an enterprise rights management solution, which aims to
protect content from accidental or malicious sharing. Enterprise rights
management (ERM) software embeds encryption and use permissions directly
into a file, instead of the systems around it. Whether these files are in
transit or in use, ERM software protects the information from inappropriate
use. As a result, as we like to say, these solutions protect emails and
documents and allow secure collaboration anytime, anywhere, and to anyone
on virtually any device.

3. Keep your passwords and devices secure

As thousands of emails and documents are sent and received both inside and
outside organizations daily, these become thousands of instances where
employees can be vulnerable to data breaches. While sending data like
intellectual property (IP) and Personally Identifiable Information (PII)
are part of many people’s daily jobs, sharing is not always caring when it
comes to sensitive information. Research from Cisco stated approximately,
63 percent of employees admitted to using a work computer for personal use
every day, and 83 percent admit to doing so occasionally. However, the
transference of files between work computers and personal computers opens
companies to cyber threats and corporate liability. Employees will continue
to use their personal phones for work, so companies can help them by
providing secure ways to perform work activities on such devices. Can your
employees view sensitive information on their phones in a secure manner? If
not, your data may be at risk.

Another way organizations can help employees in this area is to provide
access to key systems as-needed. Use of pluggable authentication modules
(PAM) is becoming more popular to grant administrative access to engineers
or database experts only when they need truly it. The underlying systems
are more secure and the company can monitor when and how often employees
request elevated rights.

4. Provide security education

When it comes to cyber threats and attacks there’s no such thing as too
much information. Establishing a security awareness and education practice
in your business is an important step to help your employees handle
phishing, social engineering, and other cyber attacks. If employees believe
security programs are important they are more likely to adhere to policies
and follow procedures - like the ones laid out in Step #1. Part of this
education should include knowing the physical location where sensitive data
is stored. Especially when organizations operate in multiple locations, the
importance of securing data both on a device and while in motion should be
emphasized. By spreading awareness across the enterprise regarding the
consequences of individual actions and the impact of a breach,
organizations may avoid security problems entirely.

5. Maintain compliance with regulations

Complying with regulations is pivotal to secure digital operations. In
addition to complying with government cybersecurity regulations, such as
NIST 800-171, it is vital that companies have rules in place to protect
cyber content inside and outside the organizational network. This includes
the hundreds of emails and documents organizations process daily, which may
fall out of the scope of some specific laws yet still represent corporate
liability and reputation risks. To keep HR, legal, and other documents
protected and secure, organizations should work internally and with their
cloud vendors to know where data is stored and where it is processed. When
enterprises prioritize content protection to meet compliance regulations,
they have a better chance of preventing data leakage and of preventing
fines or reputational issues related to this information.

Data theft and hacking are an unfortunate reality and an increasingly
prevalent threat in the digital age. No one is immune. To minimize the
potential for and consequences of a data breach, cybersecurity should be
top of mind in every industry. Organizations can lessen their risk by
following the simple ideas presented here: establish security policies,
invest in the right solutions, secure device and data access, invest in
employee education, and actively maintain compliance with applicable
regulations.

Good luck, and stay safe out there.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20171226/1bfde39f/attachment.html>