Why should you protect your data? After all, it’s only now seen as the most valuable resource in the world; even more valuable than oil, in fact. What’s more, while it can be a challenge to steal enough oil, to steal enough data is a synch. After all, Snowden managed to steal 20,000 files from the NSA using nothing more than a few thumb drives. That’s the NSA we’re talking about!
So why should you protect your data? Because if you don’t, then you might well end up with a similar fallout when a disgruntled employee or outside hacker decides to get at your files and do serious harm with them.
The question, of course, isn’t if you should protect your data. That goes without saying. It is how to protect your data. That’s what the rest of this article is going to be devoted to.
Know what you need to protect
Step one is identifying the data that actually needs protection. Some things do. Some things don’t. Some things that absolutely need to be secured are things like:
- Customer data. This is stuff like transaction accounts, private information like names and addresses, personal data of any kind and anything else that might be sensitive.
- The golden goose. If your company depends on certain information to stay ahead of the competition or to actually make its money, then obviously that needs to be protected. Here we’re talking about trade secrets, business plans, and projections, as well financial records.
- Employee records. After all, their information is just as important as that of your customers, as they are entitled to privacy in the same way.
- Anything on which you signed a confidentiality agreement. You said you would keep it confidential, so you better keep it confidential. Otherwise, the fallout can be huge.
Put it in the right place
You can only protect data when you know where it is. If you think all the data is on your server, but somebody has important bits of it on a thumb drive that they forgot about at the bottom of their bag, then whatever you do to secure your data will not secure it.
So, make sure that you know where data is. Some things to consider are your servers, the cloud, mobile phones and other such devices, any emails that have been sent out that might have them as attachments and any third parties, like best writing advisor, that might have had to look at some version of your document at some point.
Protect it
Encrypt data when it needs to be moved. Make sure that your passwords are sufficiently strong that they can’t be cracked by some kid with too much free time on their hands. Make sure that you have good anti-virus software installed and that you’ve got firewalls that are worthy of the name.
When data is downloaded or taken off the server, do you know? Note that the NSA was supposed to know when people took data off the servers, but Snowden was able to get around that as he had administrator access. This meant he could access data in an untraceable manner, which rendered that kind of protection useless. Can your admins do the same? Should they be able to?
One thing to remember: Yes, it is important to protect your data. But if you do overboard and create a data that is the equivalent of Fort Knox, where every employee has to do ten things and ask for permission to manipulate data, then through your data might be safe, the effectiveness of your company will be severely affected.
So don’t go overboard.
Train your staff
The weak link in modern computer networks is the person sitting in front of the keyboard. For that reason, if you want your data to be secure, make sure that you train these people up correctly in how to use data, when to give out their passwords (i.e. never) and so on and so forth.
Also, make sure that you frequently change passwords so that even if somebody manages to get their hands on a password, they’ll only ever have access to your data for a limited amount of time.
What works surprisingly well is to make it clear that occasionally people will test the network by trying to break into the network on your behalf. Warn staff that if people do get in and do so as a result of their negligence they might well get fired.
This will turn the entire data security from an abstract concept into something concrete and directly applicable to staff.
Remember your vendors
If outsiders have access to your network, then you have to make sure that they are secure as well and that their staff is correctly trained. This should be a top priority for any vendor that you might work with (Snowden, you see, worked for a vendor).
One of the best policies is that they outline their data security actions before you sign any kind of contract with them and that you put in place legal safeguards that they will keep their security up to those standards. In that way, you can keep yourself safe and “ even if there is a breach “ you’ll have some legal recourse if it happened as a result of a vendor’s negligence.
Understand it will happen eventually
Data theft is a part of modern life. Eventually, somebody will get through. Be prepared for that.Here are the steps that you have to consider so that if there is data theft you can deal with it as quickly and effectively as possible:
- Make sure your employees report unusual activity and any suspected case of data theft and make sure that they do so immediately upon uncovering any sign thereof. You can practice this through those fake break-ins’ we suggested above.
- Have a team that is prepared for these kinds of emergencies ready to respond and makes sure that whatever they’re doing they know to drop it immediately and to springs into action.
If you can do this, then you might well be able to contain whatever data theft has occurred, so as to keep the losses to a minimum and to make sure that access can be restricted as soon as the problem is identified.
Last words
Data security is incredibly important. For that reason, it’s vital to have the right systems in place to protect it and to make sure your staff doesn’t accidentally give away secrets to some smooth operator. Realize, however, that there is nothing quite as safe as not having the data at all.
For that reason, make it a policy to destroy the data you no longer need. There are many ways to do that nowadays, but make sure whatever way you choose you to choose one that actually destroys data. In that way, you won’t have to worry again about it coming back to haunt you.
