Everyday your data is at risk. Cybercriminals are constantly getting smarter and finding new ways to hack your most valuable assets. So how do you stay abreast of the top security measures to protect you and your agency?
In a recent GovLoop training, Protecting Your Data: More Than an IT Problem, cybersecurity experts Brad Rounding, Director of Security Operations for the USDA, and Pat Plante, VP of Strategic Business Development for Informatica, discussed what is causing your data to be unsafe and what you can do to eliminate those security threats.
Most organizations have security measures on every layer of data systems to ensure protection. There is security for networks, applications, devices, and data hosts, just to name a few. Yet even with all these layers of security, people are still being hacked.
To secure your data you need to understand which information hackers want, how hackers get your information, and which security measures work best for you.
What do hackers want? To determine what data needs to be protected, you first need to understand what cybercriminals are trying to steal. These criminals are after your sensitive data.
When people hear sensitive data they sometimes wonder what that actually means. There are quite a few fields of information, also known as domains, that are considered sensitive data, such as: credit card number, national identification number, drivers license number, full name, fingerprints, email address, birthplace, and more.
It’s often the combination of a few of these fields being hacked that creates a severe data breach. “If you know the gender, birthdate, and zip code you can uniquely identify an individual in the United States,” said Plante.
The challenge in cybersecurity is knowing what’s sensitive and where it’s located. Previously, organizations would organize databases with a “yes” or “no” determining if a field was sensitive and needed protection. Today, because it’s a combination of fields that make information dangerous, data that isn’t sensitive on it’s own can become sensitive when paired with other data.
How do hackers break-in? Information that’s most at risk of being hacked is live data that your agency is constantly accessing. Look at information that’s sitting in live applications, being used by developers or testers, or analytics, from support personnel, administrators, contractors, 3rd parties and outsiders.
When you determine where your active data is being used, look at the method you’re using to access that sensitive data, those are the areas hackers sneak in. There are three main methods: applications, business intelligence (BI) tools and structure query language (SQL). Applications have carefully designed access controls with screens designed to restrict views. That’s a fairly simple and safe way to view information. In contrast, BI tools are used where data scientists access application databases with tons of screens and tools that change constantly. This is fairly high in risk. And SQL access is pervasive and used to extract data for analysis. With this large amount of access methods, it’s easier for cybercriminals to hack your information and much less safe for your data.
The problem with many organizations’ cybersecurity measures is that their researchers are analyzing data and subsequently accessing sensitive information. The reality is researchers may need access to people and statistics in a database to perform their analysis but they don’t need to have access to those people’s social security numbers or other private information to do their jobs successfully. Having constant access to highly sensitive information adds a lot of unnecessary risk.
What do you do to protect yourself? To help reduce the risk of sensitive data exposure implement data security intelligence and data security controls.
Data security intelligence is set up to help organizations better understand their data and learn what it is they need to do with it. This process helps you to create a standardized basis for measuring risk, communicating the status of your data within your organization, and making agile decisions.
Data security controls are actual security measure you implement once you understand your agencies data security intelligence. This can include anything from blocking information you don’t want certain employees or people to see to setting up an alert system warning your agency about a potential brief.
Understanding what cybersecurity is best for your agency is not an easy process and it takes a lot of time to figure out what’s best for you. To learn more about how you can protect yourself against data breaches, view this training on-demand here.
