Data drives our businesses, economy and daily lives, so it comes as no surprise that data security needs to be a priority. But do we know what data we really have, where sensitive information is being collected and stored, what is happening with the data and where it is ultimately going? How do we build security around critical assets that we need to protect but don’t always have visibility into?

From Index Cards to Instant Availability

It’s remarkable how many different ways our organizations collect, manage and protect valuable data. I was reminded of this on a recent flight where I had the great fortune to sit next to a gentleman who spent much of his career helping credit organizations transition from local, independently operated agencies to the global credit bureaus we have today.

It was interesting to hear how credit scores were determined up until just a few decades ago. To assess someone’s creditworthiness, a lender would call a local credit agency, where handwritten index cards were maintained for the individuals within that community. These cards contained a wide range of personal information — everything that was deemed relevant to whether the individual had the ability to repay a loan. Each office used its own discretion to determine what information was collected and how it was used.

Over the years, regulations have standardized the type of information that can be collected, limited how long it can be retained, and given consumers unprecedented access to their personal information and credit scores. It has been a remarkable transformation. It’s also similar to ones many of our businesses have gone through, where modern IT and networking have allowed us to better manage our data and make it instantly available whenever and wherever needed.

Not surprisingly, these same technologies can be exploited in ways we’ve never imagined. As I continued my travels, I couldn’t stop thinking about how we collect and manage the many different types of data in our organizations and how it affects all of us.

The Need for Comprehensive Data Security

Managing sensitive data is a big responsibility that we all share. At some point, we may stop and think about how much simpler it would be to identify and secure our data if we locked it all in a filing cabinet in the back office. If we reverted back to such archaic record keeping methods, however, we would never be able to accomplish what we do today as businesses or as a society.

We need to find a way to better manage the volumes of sensitive data contained within our organizations. There is the data we know we have that we strive to rigorously manage and protect. But the bigger risk is the data we don’t even know exists. Sure, we can identify and protect the data we know about, but what about that list of sensitive customer information that someone in sales pulled together and stored on a laptop? Or that spreadsheet someone in finance created and shared with his or her colleagues? Or the engineering team’s proprietary designs, which are captured across many documents and systems?

In some ways, it is similar to the handwritten cards that used to determine credit scores, but without the organization or physical security of the locked filing cabinet. Let’s face it: Sensitive data is everywhere, even in areas that are often left unprotected.

The Power of Full Visibility

Data security starts with knowing what information exists and where it is located. Next, make sure you take the right precautions to secure and manage the data to prevent unauthorized access. The final step is to detect any movement of this data and establish visibility into who accessed it and what was done with it.

Unless somebody has physical access, odds are they are accessing, downloading or even exfiltrating this data over one of your networks. The network is where you can gain visibility into this data to assess what is being done with it. This works just as well for the data you don’t know about. Comprehensive visibility into your data empowers you to understand and better manage what you have, and to quickly detect and respond to unauthorized access and potential misuse.

This is the level of visibility we need across our networks, but how do we get it? Traditional means will only go so far, and this goes well beyond deep packet inspection. It requires full content analysis of network packet payloads with application-level context applied to gain visibility into the critical data we need to know about and protect.

Read the report: QRadar Network Insights Delivers Real-time Insights Like Nothing Else

More from Data Protection

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Data residency: What is it and why it is important?

3 min read - Data residency is a hot topic, especially for cloud data. The reason is multi-faceted, but the focus has been driven by the General Data Protection Regulation (GDPR), which governs information privacy in the European Union and the European Economic Area.The GDPR defines the requirement that users’ personal data and privacy be adequately protected by organizations that gather, process and store that data. After the GDPR rolled out, other countries such as Australia, Brazil, Canada, Japan, South Africa and the UAE…

Third-party breaches hit 90% of top global energy companies

3 min read - A new report from SecurityScorecard reveals a startling trend among the world’s top energy companies, with 90% suffering from data breaches through third parties over the last year. This statistic is particularly concerning given the crucial function these companies serve in everyday life.Their increased dependence on digital systems facilitates the increase in attacks on infrastructure networks. This sheds light on the need for these energy companies to adopt a proactive approach to securing their networks and customer information.2023 industry recap:…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today