Nexon Blog - Do you have skeletons in your data closet? It’s a critical security question.

Big data brings huge benefits, but it comes with significant risks for security, privacy, liability and hackers. Today, organisation’s collect more data from more channels than ever.

The question is: How well do you really know your data?

In my discussions with senior business leaders, there are often more questions than answers when it comes to data security.
Although highly regulated sectors like finance and banking lead the way in data protection and compliance, other industries like education, healthcare and government have a lot of catching up to do.

Many organisations collect more data than they may account for, which is stored in various systems, databases, documents or hardware.

Even if not payment information, most businesses collect personally identifiable information (PII), which must be encrypted and protected to avoid compliance breaches, identity theft, fines, brand damage, personal liability and legal consequences.

Seven steps to scan, classify, manage and protect your data

Step 1: Identification

Step 1: Identification

Questions: Do you know precisely what data you have? Where is it collected from? Where and how is it stored? For how long?

Answers: Often overlooked, auditing your existing data is the most critical first step for data security. Many effective scanning services and tools can analyse data held across your business to create a central record of what you have and where it is stored.

Step 2: Classification

Step 2: Classification

Questions: What types of data do you hold? Do you have credit card details? Do you hold PII? Is sensitive data held in secure and compliant formats? Is other data structured?

Answers: Once you have identified your data, classifying it into logical categories – such as sensitive, personal, financial or operational – enables you to make informed decisions about risk management, compliance and business value. It also helps you determine the appropriate level of protection required for each data type, ensuring you allocate resources effectively.

Step 3: Management

Step 3: Management

Questions: Why are you collecting the data? Do you need to keep it for compliance? How long do you need to keep it? Are you using the data? Can it be deployed in more valuable ways?

Answers: With a complete understanding of your data, you can optimise its value. This includes protecting sensitive data, archiving or destroying unnecessary data, ceasing collection of redundant data, and exploring ways to maximise data value, minimise risks and ensure compliance.

Step 4: Protection

Step 4: Protection

Questions: What defences do you have in place? How many layers of protection? Who has access, and how is this managed? What service level agreements do suppliers provide?

Answers: With data identified, classified and managed, you can add protection layers, including data loss prevention (DLP) tools, multifactor authentication, strict access control, regular audits, and verify suppliers’ security measures to ensure robust protection and compliance.

Step 5: Compliance

Step 5: Compliance

Questions: Do you know what compliance rules apply to your sector? Are you compliant? How do you know? Can you prove it? How do you manage ongoing compliance and audits?

Answers: You can meet evolving regulations and standards by combining intelligent digital protection tools with expert security knowledge and ongoing processes. Regular audits, assessments and training help maintain and provide evidence of adherence to relevant rules.

Step 6: Respond

Step 6: Respond

Questions: What happens if you get breached? Are you missing data? If so, what was taken?

Answers: Security efforts sometimes over-emphasise perimeter defence. However, as breaches become more likely, it’s essential to have a well-oiled plan to respond quickly to breaches or data loss, including forensic analysis to identify affected data and potential damage.

Step 7: Recovery

Step 7: Recovery

Questions: Do you have a proven and tested backup solution? Is your backup data accurate and uninfected? How do you know? How quickly can you recover?

Answers: Compromised backups restored with infected data can lead to repeated breaches and prolonged recovery, which can take months. The latest cyber recovery solutions offer features like:

  • Detecting and reporting on sensitive data in backups for discovery and categorisation
  • Immutable data retention to protect backup data from changes, deletion or encryption
  • Malicious payload monitoring to identify safe and risky recovery points to avoid reinfection
  • Support for forensic analysis by detecting anomalous patterns of change, such as bulk modifications common in ransomware attacks

Data security is no longer optional. You are accountable.

Every organisation is responsible for protecting its data, whether stored on major public cloud platforms, private cloud, SaaS software or on-premise hardware. While providers offer built-in protection, it’s crucial to understand what’s included and ensure compliance.

It’s up to managers to implement adequate protections, but tightening regulations hold Directors and Boards accountable for breaches with huge potential fines. Ignorance is no defence.

Implementing robust data protection not only minimises risks to your people, data and business but can also significantly reduce the spiralling costs of cybersecurity insurance premiums, which reflect the rising costs and risks of data security.

In fact, there can even be a risk that cyber insurance policies will not cover your business if fundamental security practices are not up to scratch.

Want more answers than questions?

If you have questions about your data or cyber security strategy, please get in touch. Nexon has a team of experts and a range of proven security solutions.

Ryan Green is Head of Cloud Presales at Nexon Asia Pacific. For more information, contact Nexon today.

If you have questions about your data or cyber security strategy, please get in touch. Nexon has a team of experts and a range of proven security solutions.