August 11, 2016 By Leslie Wiggins 3 min read

There are times in life when simply doing enough to get by is, well, sufficient. Other times, you know you need to go all in and compete to win. Top athletes, for example, know how and where to spend their time and effort. They don’t go all-out all the time, but they do know when to push hard, give it their all and set their sights on the podium — and a medal.

By contrast, an alarming number of organizations today are completely unaware that they are competing in a kind of data security triathlon. They are essentially sitting on the grass, looking up at clouds, unaware of the malicious insiders, uneducated users and cybercriminals creating risks and flying past them in a race to get to sensitive data.

Get in the Game!

Many organizations recognize there’s something going on, but they are unaware that they need to be in it to win it. Instead, they spend their time just doing enough: They make sure to check the compliance box and pass their audit, whether for PCI DSS, HIPPA, SOX or the EU’s GDPR, which goes into effect in June 2018.

While being in compliance is absolutely important and represents a great first step along the road to data security, it is merely sufficient. It helps avoid fines, scrutiny and other unpleasant things, but it does not position organizations to compete.

In this day and age, there seems to be a new data breach almost every day. Organizations must adopt a win-now mindset rather than simply doing enough to satisfy compliance requirements.

An organization can go for the gold by starting its data security journey with compliance and then intensifying its efforts and staying focused. This means successfully safeguarding data from internal and external threats. It also means being the champion and protector of your customers, your brand and the sensitive data that fuels your business.

Start With Compliance

The right place to begin is indeed with compliance. By starting with compliance, you become acquainted with the basics and can start learning the vocabulary of the data security athlete. Compliance helps you pass your audits, but it can also get you to start thinking about:

  • Discovery: Where is the relevant data?
  • Monitoring: Who is reading or changing that data, and how do I create an audit-worthy trail that I can share with auditors?
  • Hardening: What do I need to do to secure the data repositories where the relevant data lives?

To help you simplify and speed your compliance efforts while keeping costs down, you should look for a solution that can support discovery, monitoring and hardening. It should be automated, with as much built-in functionality as possible.

Protect Sensitive Data

As you train for the data security triathlon, you also need to make sure your compliance solution can grow with your future needs, supporting discovery, monitoring and hardening but also protecting sensitive data.

Sensitive data — such as IP, customer or partner information, manufacturing information, proprietary algorithms and all those other types that are crucial for business success but are not covered by compliance mandates — is probably scattered throughout your environment in databases, the cloud, big data environments and file systems. You need to find this information and protect it with a variety of features that can thwart threats.

Key capabilities to look for include: data protection (masking, redaction, encryption, blocking, alerting, etc.) for data at rest and in motion; entitlement reporting; risk and threat detection, including real- and right-time analytics, cognitive analytics and specialized threat detection analytics; and broad platform support so that when you are ready, you can safeguard your sensitive data, wherever it resides.

Expand Your Data Security Vocabulary

You can now use your expanded data security vocabulary and capabilities to achieve better security. Further your aims by asking questions such as:

  • Where is my sensitive data?
  • How can I protect my sensitive data at rest?
  • Who has access to my sensitive data?
  • Do users have the right level of access, or should access be turned off?
  • What must I do to secure my sensitive data repositories?
  • What is actually happening to my sensitive data?
  • How can I prevent unauthorized activities?
  • How can I protect sensitive data in motion?

Expanding from compliance to data security should not be difficult, and you should not be confronted with technical sticking points. With the right training program in place and key considerations in mind, you can score a neat compliance victory and then expand your program, build on your efforts and continue your journey to the data security triathlon. There you will surely have your shot at gold.

More from Data Protection

Overheard at RSA Conference 2024: Top trends cybersecurity experts are talking about

4 min read - At a brunch roundtable, one of the many informal events held during the RSA Conference 2024 (RSAC), the conversation turned to the most popular trends and themes at this year’s events. There was no disagreement in what people presenting sessions or companies on the Expo show floor were talking about: RSAC 2024 is all about artificial intelligence (or as one CISO said, “It’s not RSAC; it’s RSAI”). The chatter around AI shouldn’t have been a surprise to anyone who attended…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

How data residency impacts security and compliance

3 min read - Every piece of your organization’s data is stored in a physical location. Even data stored in a cloud environment lives in a physical location on the virtual server. However, the data may not be in the location you expect, especially if your company uses multiple cloud providers. The data you are trying to protect may be stored literally across the world from where you sit right now or even in multiple locations at the same time. And if you don’t…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today