There are times in life when simply doing enough to get by is, well, sufficient. Other times, you know you need to go all in and compete to win. Top athletes, for example, know how and where to spend their time and effort. They don’t go all-out all the time, but they do know when to push hard, give it their all and set their sights on the podium — and a medal.

By contrast, an alarming number of organizations today are completely unaware that they are competing in a kind of data security triathlon. They are essentially sitting on the grass, looking up at clouds, unaware of the malicious insiders, uneducated users and cybercriminals creating risks and flying past them in a race to get to sensitive data.

Get in the Game!

Many organizations recognize there’s something going on, but they are unaware that they need to be in it to win it. Instead, they spend their time just doing enough: They make sure to check the compliance box and pass their audit, whether for PCI DSS, HIPPA, SOX or the EU’s GDPR, which goes into effect in June 2018.

While being in compliance is absolutely important and represents a great first step along the road to data security, it is merely sufficient. It helps avoid fines, scrutiny and other unpleasant things, but it does not position organizations to compete.

In this day and age, there seems to be a new data breach almost every day. Organizations must adopt a win-now mindset rather than simply doing enough to satisfy compliance requirements.

An organization can go for the gold by starting its data security journey with compliance and then intensifying its efforts and staying focused. This means successfully safeguarding data from internal and external threats. It also means being the champion and protector of your customers, your brand and the sensitive data that fuels your business.

Start With Compliance

The right place to begin is indeed with compliance. By starting with compliance, you become acquainted with the basics and can start learning the vocabulary of the data security athlete. Compliance helps you pass your audits, but it can also get you to start thinking about:

  • Discovery: Where is the relevant data?
  • Monitoring: Who is reading or changing that data, and how do I create an audit-worthy trail that I can share with auditors?
  • Hardening: What do I need to do to secure the data repositories where the relevant data lives?

To help you simplify and speed your compliance efforts while keeping costs down, you should look for a solution that can support discovery, monitoring and hardening. It should be automated, with as much built-in functionality as possible.

Protect Sensitive Data

As you train for the data security triathlon, you also need to make sure your compliance solution can grow with your future needs, supporting discovery, monitoring and hardening but also protecting sensitive data.

Sensitive data — such as IP, customer or partner information, manufacturing information, proprietary algorithms and all those other types that are crucial for business success but are not covered by compliance mandates — is probably scattered throughout your environment in databases, the cloud, big data environments and file systems. You need to find this information and protect it with a variety of features that can thwart threats.

Key capabilities to look for include: data protection (masking, redaction, encryption, blocking, alerting, etc.) for data at rest and in motion; entitlement reporting; risk and threat detection, including real- and right-time analytics, cognitive analytics and specialized threat detection analytics; and broad platform support so that when you are ready, you can safeguard your sensitive data, wherever it resides.

Expand Your Data Security Vocabulary

You can now use your expanded data security vocabulary and capabilities to achieve better security. Further your aims by asking questions such as:

  • Where is my sensitive data?
  • How can I protect my sensitive data at rest?
  • Who has access to my sensitive data?
  • Do users have the right level of access, or should access be turned off?
  • What must I do to secure my sensitive data repositories?
  • What is actually happening to my sensitive data?
  • How can I prevent unauthorized activities?
  • How can I protect sensitive data in motion?

Expanding from compliance to data security should not be difficult, and you should not be confronted with technical sticking points. With the right training program in place and key considerations in mind, you can score a neat compliance victory and then expand your program, build on your efforts and continue your journey to the data security triathlon. There you will surely have your shot at gold.

More from Data Protection

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Transitioning to Quantum-Safe Encryption

With their vast increase in computing power, quantum computers promise to revolutionize many fields. Artificial intelligence, medicine and space exploration all benefit from this technological leap — but that power is also a double-edged sword. The risk is that threat actors could abuse quantum computers to break the key cryptographic algorithms we depend upon for the safety of our digital world. This poses a threat to a wide range of critical areas. Fortunately, alternate cryptographic algorithms that are safe against…

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…