![\"Expert](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/11\/Cybersecurity-Better-MOD-.jpg\")
<\/p>\n<\/p>\n
Today is Data Privacy Day 2021. We spoke with several cybersecurity experts on what this day signifies and what best practices enterprises should embrace.\u00a0<\/b><\/p>\n
According to an <\/span>iProov<\/span><\/a> survey, 95 percent of respondents care about their data privacy, and 25 percent of respondents felt like they have no control over their data privacy. Meanwhile, 75 percent of people have had to change their password due to a security breach and 66 percent of people are frustrated with having to do so. This could prove a significant obstacle to enterprises\u2019 long term bottom line and reputations if not corrected. <\/span>Cybersecurity<\/span><\/a> focused on data privacy could help, but where to start?\u00a0<\/span><\/p>\n On this Data Privacy Day 2021, we speak to the experts on the first steps, next steps, and beyond.\u00a0<\/span><\/p>\n Anurag Kahol is CTO of <\/span><\/i>Bitglass<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cData Privacy Day serves as a reminder of one of the most important responsibilities for any organization: keeping sensitive data secure. Consumers are constantly discovering the information that is collected about them, how that data is used, and how daily breaches put that information at risk. Consequently, to maintain consumer trust (and remain compliant with regulations), it is imperative that companies make security a top priority.\u201d<\/span><\/p>\n \u201cThis past year marked a pivotal change in how companies conduct business, with most being forced to rapidly shift to a remote workstyle of operations due to the global COVID-19 pandemic. Now that we have begun to see distribution of the vaccine, some may think it\u2019s only a matter of time before \u2018normal\u2019 in-office work resumes. However, that is not likely to be the case. Instead, we are going to see a permanent blend of remote and in-office work, as well as mobile employees whose workspaces are constantly changing. Organizations must be prepared to continue to operate in this manner while ensuring that data is secure no matter where or how it is accessed.\u201d<\/span><\/p>\n \u201cUnfortunately, many organizations lack the ability to achieve the above and are relying on outdated tools that are designed for predominately on-premises operations and lack the granularity needed today. To address these challenges, there are a few steps that must be taken. First, organizations must have an accurate inventory of data. This step is critical for adhering to data privacy regulations including CCPA, because if companies don\u2019t know the information they have or where it is going, then they cannot properly protect it. What\u2019s needed is a set of comprehensive activity logs that track all file, user, app, and web activity to reveal everything that is happening with consumers\u2019 data.\u201d<\/span><\/p>\n \u201cNext, companies need to protect access to consumer information as well as the various systems that store it. This can become more challenging for improperly equipped organizations that adopt cloud technologies and other remote work capabilities, as consumer data can then potentially be accessed across numerous applications and on various devices. To address this problem, organizations can require that employees attempting to access consumer data are authenticated via Single Sign-On (SSO) as well as multifactor authentication (MFA). This will aid in ensuring that only legitimate, authorized users can handle consumer information.<\/span><\/p>\n Finally, organizations need to have a thorough understanding of data jurisdictions and any security challenges they may present after migrating to the cloud. With respect to certain data privacy regulations like CCPA, data may only be stored or transferred where the state has jurisdiction or an agreement is in place. To ensure compliance, organizations should look for security solutions that allow them to encrypt cloud data (wherever it resides) while maintaining local control of encryption keys. Additionally, solutions that dynamically allow or deny access based on contextual factors like a user’s location, device type, or job function are highly helpful, along with data loss prevention (DLP) capabilities. For ease of management and cost-effective, consistent security, organizations should look for a single security platform that integrates all these capabilities into one offering.\u201d<\/span><\/p>\n Saket Modi is Co-Founder and CEO at <\/span><\/i>Lucideus<\/span><\/i><\/a>.<\/span><\/i><\/p>\n We are stepping into an era that is more digital-dependent than ever before. With PHI selling on the dark web for as little as a few hundred dollars, data is the new currency.\u00a0<\/span><\/p>\n While to date, the ethical and moral responsibilities that come with its abundance have rested with governments and the corporate world, the end-user (consumer) has to start sharing the onus. From being prudent about what kind of information they are making publicly available, to knowing exactly which website, platform, or service they are using has been breached – there is a lot the average person has to incorporate into their cyber-consciousness.<\/span><\/p>\n Consumers need to take control of their digital footprint and privacy. They must know, objectively and in real-time, what they expose through their online identities, devices they own, applications and services they use, along with staying updated with the modern trends leveraged by cyber-criminals to misuse data. To that end they can start safeguarding some of the most recurring pain points:<\/span><\/p>\n Robert Meyers is the Channel Solutions Architect at <\/span><\/i>One Identity<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201c2020 was a very tumultuous year, and in privacy, some good things happened, and some bad things happened. On the good side, we had the NIST Privacy Framework 1.0, and on the bad side, breach after breach, let alone things that aren\u2019t directly privacy related. The problem with privacy programs is there is too much that comes under the category of privacy, and a lot of people don\u2019t understand what that means. 2021 is a year starting with hope: privacy professionals finally have some simple tools.\u201d<\/span><\/p>\n \u201cWhen building privacy programs it\u2019s imperative to utilize the new tools, like the NIST Framework to build a privacy program, and build strong cybersecurity programs around privileged accounts, control data access, and implementing least privilege management tools. While doing this, remember this is part of the privacy program too. With good things on the horizon and the tools available to make understanding privacy easier, 2021 starts as a year of hope. With the NIST Framework privacy programs, privacy professionals and people who are interested in privacy now have a checklist. This is something we\u2019ve never had at this level before, which makes the future look clear for the first time since privacy programs began.\u201d\u00a0<\/span><\/p>\n Adrian Moir is Technology Strategist and Principal Engineer at<\/span><\/i> Quest Software<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cWith a change in working practices comes an opportunity to look closer at the impact of data privacy and privilege. With a distributed workforce, there are issues surrounding differing threat vectors and data usage that may compromise data privacy. While an organization can have a robust data protection and privacy policy, a substantial change in work practices can, overnight, impact that policy such that it\u2019s no longer effective. Consider, now that you may have hundreds or thousands of workers at home sharing their network with devices that do not meet corporate standards: Where do they store corporate data so it\u2019s kept from prying eyes? How do they transfer that data, share data with other homeworkers? What\u2019s the exposure of \u2018just use a cloud storage solution to share data\u2019? Sharing data and data use become simpler to do, but that can lead to not only data breaches but breaches in privacy policies too. Who can access what data, who can use what data, and how can be changed with just a few clicks. Human involvement has a lot to do with a level <\/span>of data or privacy breach.\u201d\u00a0<\/span><\/p>\n \u201cAs your home workers become more adept at using new services and techniques to share data, they increasingly become a target for bad actors. Now your threat vectors are distributed like your workforce, except your workforce are unlikely to have enterprise-grade protection of their home infrastructure. It\u2019s important to educate your workers and reinforce your data protection and privacy policies, and provide the solution deemed suitable to sustaining the new working culture, so workers don\u2019t need to or will not fall outside of your desired policy. Make this an easy thing for your workers so that the uptake is swift but controllable.\u201d<\/span><\/p>\n
Widget not in any sidebars
<\/p>\nExpert Commentary and Best Practices: Data Privacy Day 2021<\/b><\/h2>\n
Anurag Kahol\u00a0<\/b><\/h3>\n
Saket Modi<\/b><\/h3>\n
\n
Robert Meyers<\/b><\/h3>\n
Adrian Moir<\/b><\/h3>\n
Steve Grewal<\/b><\/h3>\n