When the news broke that a Capital One data breach had affected approximately 100 million customers in the U.S. and another 6 million in Canada, there was widespread panic among the company’s users and much confusion regarding data storage standards. Even amid the arrest of the woman responsible for accessing the data, Capital One customers were left wondering why their sensitive information was accessible to her in the first place.
It is just the latest example of how no company wants to navigate the embarrassment and trust issues that come from a breach. With technologies such as sensors, smartphones, cloud servers and more, user data is consistently at risk of exposure. By going back to the basics of proper data governance, companies can learn to protect themselves against these kinds of attacks. Below are a few key things CSOs should consider to keep data secure in an increasingly complex cyber environment.
Better Protocol for Data Storage
The CapitalOne issue seemed to be the result of an improperly configured firewall, which allowed the hacker to breach data stored on third-party servers. It was also uncovered that some of the leaked data was created in 2005. The age of this data indicates Cap One felt it was necessary to maintain and store aging data. However, data becomes more at-risk as a company stores it, especially over long periods of time.
As data storage and server capabilities advance to store more data and larger files, companies need to be more aware of the fundamentals of data safety before propelling themselves forward. Contrary to popular belief, overall data hygiene isn’t an on-prem versus cloud or X provider versus Y provider issue. Rather, companies need to assess their data and analyze the way it’s stored before moving forward.
To mitigate risk, enterprises need to first develop a streamlined process for storing data. This should include guidelines to determine what type of data is stored, in what format and how long it is necessary to keep. Conducting data inventory assessments and penetration tests will help companies assess what data they are keeping and how vulnerable that data is to attack. These basic processes and assessments are key to building a solid foundation to launch companies data capabilities into the future.
Can Data Breaches Be Prevented?
In the wake of a large-scale breach, it is easy to point fingers. But in practice, data compliance and security can be a tricky business. Companies should treat these widely publicized hacks as a monument to the importance of maintaining focus on data security.
A data protection plan that includes backup protection measures and access prevention is a pivotal step in addressing a breach, if and when one does occur.
One such plan involves implementing a cloud-based server model to enforce data compliance and security across the board. By storing sensitive information on a private cloud, companies have found they are able to control backup and recovery, and ensure that vulnerable information is only viewable inside their network. Companies with the appropriate IT bandwidth to navigate the private cloud should consider doing so – keeping data convenient to access but also secure is a major step in preventing these kinds of attacks.
A Need-to-Know Basis
Another benefit of the private cloud is control who has access to files, and the ability to instantly restrict that access.
A hypothetical situation: you fire a privileged member such as an IT administrator or IT manager. What precautions do you have set up to prevent them from having access to sensitive files immediately after their departure?
After someone with access to sensitive data leaves a company, their access to this vulnerable data should be immediately revoked. There shouldn’t be a lag time in removal from servers or the ability for access to remain — access should be able to remotely, immediately terminated.
Companies need to figure out ways to onboard and terminate employees in a way that maintains security for their files. Whether a company is 5, 50 or 5000 people, these processes are absolutely necessary to make sure breaches like this are easier to avoid.
Moving to a Safer World
Large-scale data breaches shouldn’t beckon widespread panic for enterprise organizations, but rather act as an opportunity to examine current practices and continue an open dialog about navigating cyber-threats.
We are reminded that data is vulnerable, and the cyber-landscape is complex. By putting proper precautions in place, we are more able to identify and halt these threats before they happen. Let’s go back to the basics.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.