Month: October 2020

Data security should be a top priority for enterprises, and for good reason

Even as the IT landscape becomes increasingly decentralized and complex, it’s important to understand that many security breaches are preventable. While individual security challenges and goals may differ from company to company, often organizations make the same widespread mistakes as they begin to tackle data security. What’s more, many enterprise leaders often accept these errors as normal business practice.

There are several internal and external factors that can lead to successful cyberattacks, including:

•  Erosion of network perimeters 
•  Increased attack surfaces offered by more complex IT environments 
•  Growing demands that cloud services place on security practices 
•  Increasingly sophisticated nature of cyber crimes 
•  Persistent cybersecurity skills shortage 
•  Lack of employee awareness surrounding data security risks

How strong is your data security practice?

Let’s look at five of the most prevalent—and avoidable—data security missteps that make organizations vulnerable to potential attacks, and how you can avoid them.

Pitfall 1

Failure to move beyond compliance

Compliance doesn’t necessarily equal security. TeraPixels System and their team of IT service professionals in San Diego, focus their security resources to comply with an audit or certification can become complacent. Many large data breaches have happened in organizations that were fully compliant on paper. The following examples show how focusing solely on compliance can diminish effective security:

Incomplete coverage

Enterprises often scramble to address database misconfigurations and outdated access polices prior to an annual audit. Vulnerability and risk assessments should be ongoing activities.

Minimal effort

Many businesses adopt data security solutions just to fulfill legal or business partner requirements. This mindset of “let’s implement a minimum standard and get back to business” can work against good security practices. Effective data security is a marathon not a sprint.

Fading urgency

Businesses can become complacent towards managing controls when regulations, such as the Sarbanes-Oxley Act (SOX) and the General Data Protection Regulation (GDPR), mature. While, over time, leaders can be less considerate about the privacy from IT service provider, security and protection of regulated data, the risks and costs associated with noncompliance remain.

Omission of unregulated data

Assets, such as intellectual property, can put your organization at risk if lost or shared with unauthorized personnel. Focusing solely on compliance can result in security organizations overlooking and under protecting valuable data.

Solution

Recognize and accept that compliance is a starting point, not the goal

Data security organizations must establish strategic programs that consistently protect their business’ critical data, as opposed to simply responding to compliance requirements

Data security and protection programs should include these core practices:

• Discover and classify your sensitive data across on-premises and cloud data stores. 
• Assess risk with contextual insights and analytics. 
• Protect sensitive data through encryption and flexible access policies. 
• Monitor data access and usage patterns to quickly uncover suspicious activity. 
• Respond to threats in real time.
• Simplify compliance and its reporting

The final element can include legal liabilities related to regulatory compliance, possible losses a business can suffer and the potential costs of those losses beyond noncompliance fines.

Ultimately, you should think holistically about the risk and value of the data you seek to secure. 

Pitfall 2

Failure to recognize the need for centralized data security

Without broader compliance mandates that cover data privacy and security, organization leaders can lose sight of the need for consistent, enterprise-wide data security. 

For enterprises with hybrid multicloud environments, which constantly change and grow, new types of data sources can appear weekly or daily and greatly disperse sensitive data.

Leaders of companies that are growing and expanding their IT infrastructures can fail to recognize the risk that their changing attack surface poses. They can lack adequate visibility and control as their sensitive data moves around an increasingly complex and disparate IT environment. Failure to adopt end-to-end data privacy, security and protection controls—especially within complex environments—can prove to be a very costly oversight.

Operating security solutions in silos can cause additional problems. For example, organizations with a security operations center (SOC) and security information and event management (SIEM) solution can neglect to feed those systems with insights gleaned from their data security solution. Likewise, a lack of interoperability between security people, processes and tools can hinder the success of any security program.

Solution

Know where your sensitive data resides, including on-premises and cloud hosted repositories

Securing sensitive data should occur in conjunction with your broader security efforts. In addition to understanding where your sensitive data is stored, you need to know when and how it’s being accessed, as well—even as this information rapidly changes. Additionally, you should work to integrate data security and protection insights and policies with your overall security program to enable tightly aligned communication between technologies. A data security solution that operates across disparate environments and platforms can help in this process.

So, when is the right time to integrate data security with other security controls as part of a more holistic security practice? Here are a few signs that suggest your organization may be ready to take this next step: 

Risk of losing valuable data 

The value of your organization’s personal, sensitive and proprietary data is so significant that its loss would cause significant damage to the viability of your business.

Regulatory implications 

Your organization collects and stores data with legal requirements, such as credit card numbers, other payment information or personal data.

Lack of security 

oversight Your organization has grown to a point where it’s difficult to track and secure all the network endpoints, including cloud instances. For example, do you have a clear idea of where, when and how data is being stored, shared and accessed across your on-premises and cloud data stores?

Inadequate assessment 

Your organization has adopted a fragmented approach where no clear understanding exists of exactly what’s being spent across all your security activities. For example, do you have processes in place to measure accurately your return on investment (ROI) in terms of the resources being allocated to reduce data security risk?

If any of these situations apply to your organization, you should consider acquiring the security skills and solutions needed to integrate data security into your broader existing security practice.

Pitfall 3

Failure to define who owns responsibility for the data

Even when aware of the need for data security, many companies have no one specifically responsible for protecting sensitive data. This situation often becomes apparent during a data security or audit incident when the organization is under pressure to find out who is actually responsible.

Top executives may turn to the chief information officer (CIO), who might say, “Our job is to keep key systems running. Go talk to someone in my IT staff.” Those IT employees may be responsible for several databases in which sensitive data resides and yet lack a security budget. 

Typically, members of the chief information security officer (CISO) organization aren’t directly responsible for the data that’s flowing through the overall business. They may give advice to the different line-of-business (LOB) managers within an enterprise, but, in many companies, nobody is explicitly responsible for the data itself. For an organization, data is one of its most valuable assets. Yet, without ownership responsibility, properly securing sensitive data becomes a challenge.

Solution 

Hire a CDO or DPO dedicated to the well-being and security of sensitive and critical data assets

A chief data officer (CDO) or data protection officer (DPO) can handle these duties. In fact, companies based in Europe or doing business with European Union data subjects face GDPR mandates that require them to have a DPO. This prerequisite recognizes that sensitive data—in this case personal information—has value that extends beyond the LOB that uses that data. Additionally, the requirement emphasizes that enterprises have a role specifically designed to be responsible for data assets.Consider the following objectives and responsibilities for choosing a CDO or DPO:

Technical knowledge and business sense 

Assess risk and make a practical business case that nontechnical business leaders can understand regarding appropriate security investments

Strategic implementation 

Direct a plan at a technical level that applies detection, response and data security controls to provide protections.

Compliance leadership 

Understand compliance requirements and know how to map those requirements to data security controls so that your business is compliant.

Monitoring and assessment 

Monitor the threat landscape and measure the effectiveness of your data security program

Flexibility and scaling 

Know when and how to adjust the data security strategy and IT embedded services, such as expanding data access and usage policies across new environments by integrating more advanced tools.

Division of labor 

Set expectations with cloud service providers regarding service-level agreements (SLAs) and the responsibilities associated with data security risk and remediation.

Data breach response plan 

Finally, be ready to play a key role to devise a strategic breach mitigation and response plan

Ultimately, the CDO or DPO should lead in fostering data security collaboration across teams and throughout your enterprise, as everyone needs to work together to effectively secure corporate data. This collaboration can help the CDO or DPO oversee the programs and protections your organization needs to help secure its sensitive data.

Pitfall 4

Failure to address known vulnerabilities

High-profile breaches in enterprises have often resulted from known vulnerabilities that went unpatched even after the release of patches. Failure to quickly patch known vulnerabilities puts your organization’s data at risk because cybercriminals actively seek these easy points of entry. 

However, many businesses find it challenging to quickly implement patches because of the level of coordination needed between IT, security and operational groups. Furthermore, patches often require testing to see if they don’t break a process or introduce a new vulnerability. 

In cloud environments, sometimes it’s difficult to know if a contracted service or application component should be patched. Even if a vulnerability is found in a service, its users often lack control over the service provider’s remediation process.

Solution

Establish an effective vulnerability management program with the appropriate technology to support its growth

Vulnerability management typically involves some of the following levels of activity:

• Maintain an accurate inventory and baseline state for your data assets. 
• Conduct frequent vulnerability scans and assessments across your entire infrastructure, including cloud assets. 
• Prioritize vulnerability remediation that considers the likelihood of the vulnerability being exploited and the impact that event would have on your business. 
• Include vulnerability management and responsiveness as part of the SLA with third-party service providers. 
• Obfuscate sensitive or personal data whenever possible. Encryption, tokenization and redaction are three options for achieving this end. 
• Employ proper encryption key management, ensuring that encryption keys are stored securely and cycled properly to keep your encrypted data safe.

Even within a mature vulnerability management program, no system can be made perfect. Assuming intrusions can happen even in the best protected environments, your data requires another level of protection. The right set of data encryption techniques and capabilities can help protect your data against new and emerging threats.

 

Pitfall 5

Failure to prioritize and leverage data activity monitoring

Monitoring data access and use is an essential part of any data security strategy. An organization leader needs to know who, how and when people are accessing data. This monitoring should encompass whether these people should have access, if that access level is correct and if it represents an elevated risk for the enterprise. 

Privileged user identifications are common culprits in insider threats.5 A data protection plan should include real-time monitoring to detect privileged user accounts being used for suspicious or unauthorized activities. To prevent possible malicious activity, a solution must perform the following tasks: 

• Block and quarantine suspicious activity based on policy violations.
• Suspend or shut down sessions based on anomalous behavior. 
• Use predefined regulation-specific workflows across data environments. 
• Send actionable alerts to IT security and operations systems.

 Accounting for data security and compliance-related information and knowing when and how to respond to potential threats can be difficult. With authorized users accessing multiple data sources, including databases, file systems, mainframe environments and cloud environments, monitoring and saving data from all these interactions can seem overwhelming. The challenge lies in effectively monitoring, capturing, filtering, processing and responding to a huge volume of data activity. Without a proper plan in place, your organization can have more activity information than it can reasonably process and, in turn, diminish the value of data activity monitoring.

Solution

Develop a comprehensive data detection and protection strategy

TeraPixels Systems and our security and IT services professionals in Orange County are typically tasked to secure a variety of businesses. To that end, when starting on a data security journey, you need to size and scope your monitoring efforts to properly address the requirements and risks. This activity often involves adopting a phased approach that enables development and scaling best practices across your enterprise. Moreover, it’s critical to have conversations with key business and IT stakeholders early in the process to understand short-term and long-term business objectives.

These conversations should also capture the technology that will be required to support their key initiatives. For instance, if the business is planning to set up offices in a new geography using a mix of on-premises and cloud-hosted data repositories, your data security strategy should assess how that plan will impact the organization’s data security and compliance posture. If, for example, the company-owned data will now be subject to new data security and compliance requirements, such as the GDPR, California Consumer Privacy Act (CCPA), Brazil’s Lei Geral de Proteção de Dados (LGPD) and so on.

You should also prioritize and focus on one or two sources that likely have the most sensitive data. Make sure your data security policies are clear and detailed for these sources before extending these practices to the rest of your infrastructure. 

You should look for an automated data or file activity monitoring solution with rich analytics that can focus on key risks and unusual behaviors by privileged users. Although it’s essential to receive automated alerts when a data or file activity monitoring solution detects abnormal behavior, you must also be able to take fast action when anomalies or deviations from your data access policies are discovered. Protection actions should include dynamic data masking or blocking.

 

Encryption is all around us. Our emails can be encrypted. Our video conferences can be encrypted. Even our phone calls can be encrypted. It’s only natural then to assume our most sensitive business data should also be encrypted. Yet according to Ponemon Institute’s 2019 Global Encryption Trends Study, the average rate of adoption of an enterprise encryption strategy is only 45 percent for those surveyed.

How can you be sure that all your sensitive data is encrypted? First, you need to know where it is located. With siloed databases, cloud storage and personal devices in the mix, there’s a good chance that at least some of your sensitive data is exposed. A data breach could lead to the worst kind of exposure — the kind where you notify millions of customers that you failed to protect their privacy and their personal information.

But that doesn’t have to be your reality. The right encryption strategy will not only help protect your data, it can help strengthen your compliance posture. IBM Security Guardium helps identify your sensitive data — on premises and across hybrid multicloud — and helps to protect it with robust encryption and key management solutions. Plus, IBM Security’s strategic consulting can work with you to align your encryption strategy with business goals.

Encryption for a world in motion

The most successful businesses are driven by data and analytics. A recent study from Forrester found that such businesses, on average, grow at least seven times faster than global GDP2 — and driving implies movement. Your data can move between clients and servers. It can move over secure and non-secure networks. It can move between databases in your network. It can move between clouds. Safeguarding your sensitive data on these journeys is critical. Customers expect it and many regulatory agencies require it. So why doesn’t every business do it?

Many organizations simply don’t have the skills and the resources needed to effectively protect all the critical data in their business. Maybe they have a general security on-site imbedded IT service strategy but have not dedicated the time and effort to creating a data encryption strategy. It’s a common problem, and one that cybercriminals prey upon by extracting unencrypted data and gaining unauthorized access to under-protected encryption keys. 

What can you do to help protect your business? You can start by encrypting your sensitive data, implementing strong access controls, managing your encryption keys securely and aligning your encryption efforts with the latest compliance requirements. Without these safeguards in place, your data might not be as protected as it could be.

Is your critical data protected?

Securityand IT Service professionals in San Diego are typically tasked with preventing data breaches, stolen passwords and internal espionage — should be concerned about the level of protection of their data, since data is the lifeblood of their businesses. Encryption can help to make data unusable in the event it is hacked or stolen. Think of it as the first and last line of defense that can help protect your data from full exposure.

There are steps you can take to protect your organization’s data. A good place to start is identifying what data needs to be protected and where it is located. (The answer: more data than you realize and in more places than you expect.) Customer and financial data are obvious choices for encryption, but many companies fail to realize that even older, seemingly non-critical data can contain sensitive information, partly because the definition of what constitutes personally identifiable information (PII) has broadened considerably in the last decade.

Controlling and monitoring data access represents an important part of any data encryption strategy. It’s something that organizations need to balance with frictionless access to data. You want to make sure the right people have quick access to the data they need, while blocking the access privileges of unauthorized users. This is where security best practices can be invaluable:

• Keep your encryption keys stored in a safe and separate location from your data 
• Rotate your encryption keys frequently and align your key rotation strategy with your industry’s best practices for key rotation 
• Always use self-encrypting media to help protect data on your devices 
• Layer file and database encryption on top of media encryption to provide granular control over access and cryptographic erasure 
• Use techniques such as data masking and tokenization to anonymize PII data that you share with outside parties

Use encryption to defend against threats

Most security professionals can include firewalls protection services to their IT Service package and are aware of the threats of data breaches and ransomware. They’re on the news, they’re on their minds and stopping them is at the top of most companies’ strategic imperatives. So why do data breaches still occur? Because, for cybercriminals, data breaches and ransomware attacks still work.

Ransomware attacks and data breaches are on the rise, so businesses should be prepared for these types of threats.2 It’s important to note that preparation is different from protection. You can try to protect against network attacks and insider threats 100 percent of the time, but you won’t always be successful. There are simply too many variables, too many chances for human error and too many cybercriminals looking to exploit those vulnerabilities to stop everything. This is why preparation is important — because you actually can encrypt your most sensitive data and render it useless in the event of a breach.

Encryption should be your first and last line of defense against attacks. It protects your data and your organization against internal and external threats and helps safeguard sensitive customer data. But encryption isn’t your only line of defense. Secure and consistent access controls across all your environments — on premises and in the cloud — as well as secure key management is important for keeping sensitive information out of the wrong hands

Use encryption to help address compliance

TeraPixels Systems and our security and IT services professionals in Orange County aren’t the only ones concerned with data protection. Countries, states and industry consortiums are entering the privacy picture with increasing frequency. For example, in 2019 and 2020 respectively, Europe’s Global Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA) introduced new security requirements that can levy heavy fines for non-compliance.

Keeping up with regulations can be difficult work. Understanding what data is impacted by specific regulations in each jurisdiction, the reporting requirements and even the penalties for non-compliance can be a full-time job. And in a world where full-time compliance experts are in scarce supply, many organizations have much to do before achieving compliance readiness.

Encryption, to borrow an expression, can cover a multitude of security sins. It can help to make your critical and sensitive data — what cybercriminals desire — worthless to would-be thieves. In many cases, compliance regulations mandate data encryption on some level. But beyond basic encryption, there are additional measures that every organization can take to protect their data. For example, using pseudo-anonymization strategies such as data masking and tokenization to selectively hide sensitive data as it’s being shared with partners can help make your data productive and protected. Using self-encrypting media on any device that stores data is another important safeguard that can help to prevent unauthorized parties from gaining access to data on stolen or salvaged devices.

How IBM Security Guardium can help protect your data

IBM Security Guardium can provide you with advanced and integrated solutions that help your organization identify, encrypt and securely access your most sensitive data. In addition, IBM Security offers security services and expertise to help your organization develop effective, efficient data protection strategies. At the heart of our encryption solutions are the IBM Security Guardium Data Encryption family of products and IBM Security Guardium Key Lifecycle Manager (GKLM).

IBM Security Guardium Data Encryption (GDE) helps protect critical data across all your data environments, helping to address compliance with industry and government regulations. The integrated family of products that make up GDE feature encryption for files, databases, applications and containers, as well as centralized key and policy management. GDE also provides data masking and tokenization, in addition to integration with third-party hardware security modules.

IBM Security Guardium Key Lifecycle Manager (GKLM)* helps deliver a secured, centrally managed encryption key management solution that supports the Key Management Interoperability Protocol (KMIP) — the standard for encryption key management — and features multi-master clustering for high availability and resiliency. GKLM can help organizations follow industry best practices for encryption key storage, access, security and reliability. GKLM simplifies encryption key management, synchronizes encryption keys between on-premises and cloud environments and automates many encryption functions, including self-encryption for storage media