Why Data and People are the First Line of Defense Against Security Threats

By Isaac Kohen, Teramind

October is National Cyber Security Awareness Month, which means that you’re likely to see many alarming statistics regarding recent data breaches and evolving security threats. Such statistics may frighten and paralyze you, but try to stay focused on two basic components of cyber safety: data and people.

Focus on the Data First

Cyber security means protecting your data: financial records, personally identifiable information, personal health information, intellectual property, and other similar key data. But it’s very hard to adequately protect this data if you don’t have a complete understanding of where the data lives and who has access to the data.

Take a data-first approach as you implement a plan to prevent security threats:

• Inventory and classify your data to determine the most valuable data and where this resides in the organization.
• Evaluate how key data comes into and out of the organization so you can determine which interfaces require heightened monitoring.
• Identify who has access to your most valuable data. These personnel are those who have access to the systems and interfaces you’ve previously identified.
• Determine how much data is really necessary to hold and how long you must hold the data. Based on your inventory, are you gathering more information about customers or partners, for example, than you really need? Do you have data that could be purged from your systems?
• How are you deleting obsolete data? Do you have a secure process in place for both electronic and paper record destruction?

Manage the People Problem

Threats from the inside – whether due to negligence or malicious intent – are a leading cause of security breaches. On the opposite side of the ‘people issue’ is the shortage of security talent to help guard against insider threats.

Over 80% of security professionals identify ‘people’ as the industry’s biggest challenge compared to technology and processes, according to the results of the second annual survey from The Institute of Information Security Professionals (IISP).

Here are some questions to consider as you evaluate how your people interact with – and protect – your data:

• Are you using the principle of least privilege when granting access rights? Basically, you want to provide access to your users on a ‘need to know’ basis. For example, if a user is just entering leads into your CRM application, ensure he doesn’t have admin-level access.
• Do you provide security awareness training for new hires, and do you provide ongoing refresher training? Security policy and security training are two key ways to combat against the negligent insider. Ensure you train all employees, including seasonal workers, temp workers, and contractors.
• Do you have the right people and skillsets to ensure information security? There is a shortage of skilled security personnel right now, and a recent Frost & Sullivan report estimates the shortfall will be as much as 1.5 million skilled people by 2020. Whether inhouse or outsourced, you need to ensure the proper hiring budget – and ongoing training budget – for your IT team.
• Do your employees know how to safely use personal devices to connect to your data? Implement a bring your own device (BYOD) policy that covers what devices can be used, which data can be accessed, and how devices should be decommissioned.
• Do you have a way to monitor for suspicious behavior? Based on the data inventory you’ve created, can you listen for suspicious activity around this data, such as downloading in bulk to a USB or cloud drive?
• Don’t throw your hands up in the face of National Cyber Security Awareness Month coverage. Instead, focus on the real steps you can take around your data and your people.

About the author: Isaac Kohen is the founder and CEO of Teramind, an employee monitoring and insider threat prevention platform that detects, records, and prevents, malicious user behavior. Isaac can be reached at ikohen@teramind.co.

Widget not in any sidebars