There are times in life when simply doing enough to get by is, well, sufficient. Other times, you know you need to go all in and compete to win. Top athletes, for example, know how and where to spend their time and effort. They don’t go all-out all the time, but they do know when to push hard, give it their all and set their sights on the podium — and a medal.

By contrast, an alarming number of organizations today are completely unaware that they are competing in a kind of data security triathlon. They are essentially sitting on the grass, looking up at clouds, unaware of the malicious insiders, uneducated users and cybercriminals creating risks and flying past them in a race to get to sensitive data.

Get in the Game!

Many organizations recognize there’s something going on, but they are unaware that they need to be in it to win it. Instead, they spend their time just doing enough: They make sure to check the compliance box and pass their audit, whether for PCI DSS, HIPPA, SOX or the EU’s GDPR, which goes into effect in June 2018.

While being in compliance is absolutely important and represents a great first step along the road to data security, it is merely sufficient. It helps avoid fines, scrutiny and other unpleasant things, but it does not position organizations to compete.

In this day and age, there seems to be a new data breach almost every day. Organizations must adopt a win-now mindset rather than simply doing enough to satisfy compliance requirements.

An organization can go for the gold by starting its data security journey with compliance and then intensifying its efforts and staying focused. This means successfully safeguarding data from internal and external threats. It also means being the champion and protector of your customers, your brand and the sensitive data that fuels your business.

Start With Compliance

The right place to begin is indeed with compliance. By starting with compliance, you become acquainted with the basics and can start learning the vocabulary of the data security athlete. Compliance helps you pass your audits, but it can also get you to start thinking about:

  • Discovery: Where is the relevant data?
  • Monitoring: Who is reading or changing that data, and how do I create an audit-worthy trail that I can share with auditors?
  • Hardening: What do I need to do to secure the data repositories where the relevant data lives?

To help you simplify and speed your compliance efforts while keeping costs down, you should look for a solution that can support discovery, monitoring and hardening. It should be automated, with as much built-in functionality as possible.

Protect Sensitive Data

As you train for the data security triathlon, you also need to make sure your compliance solution can grow with your future needs, supporting discovery, monitoring and hardening but also protecting sensitive data.

Sensitive data — such as IP, customer or partner information, manufacturing information, proprietary algorithms and all those other types that are crucial for business success but are not covered by compliance mandates — is probably scattered throughout your environment in databases, the cloud, big data environments and file systems. You need to find this information and protect it with a variety of features that can thwart threats.

Key capabilities to look for include: data protection (masking, redaction, encryption, blocking, alerting, etc.) for data at rest and in motion; entitlement reporting; risk and threat detection, including real- and right-time analytics, cognitive analytics and specialized threat detection analytics; and broad platform support so that when you are ready, you can safeguard your sensitive data, wherever it resides.

Expand Your Data Security Vocabulary

You can now use your expanded data security vocabulary and capabilities to achieve better security. Further your aims by asking questions such as:

  • Where is my sensitive data?
  • How can I protect my sensitive data at rest?
  • Who has access to my sensitive data?
  • Do users have the right level of access, or should access be turned off?
  • What must I do to secure my sensitive data repositories?
  • What is actually happening to my sensitive data?
  • How can I prevent unauthorized activities?
  • How can I protect sensitive data in motion?

Expanding from compliance to data security should not be difficult, and you should not be confronted with technical sticking points. With the right training program in place and key considerations in mind, you can score a neat compliance victory and then expand your program, build on your efforts and continue your journey to the data security triathlon. There you will surely have your shot at gold.

More from Data Protection

Cybersecurity 101: What is Attack Surface Management?

There were over 4,100 publicly disclosed data breaches in 2022, exposing about 22 billion records. Criminals can use stolen data for identity theft, financial fraud or to launch ransomware attacks. While these threats loom large on the horizon, attack surface management (ASM) seeks to combat them.ASM is a cybersecurity approach that continuously monitors an organization’s IT infrastructure to identify and remediate potential points of attack. Here’s how it can give your organization an edge.Understanding Attack Surface ManagementHere are some key…

Six Ways to Secure Your Organization on a Smaller Budget

My LinkedIn feed has been filled with connections announcing they have been laid off and are looking for work. While it seems that no industry has been spared from uncertainty, my feed suggests tech has been hit the hardest. Headlines confirm my anecdotal experience. Many companies must now protect their systems from more sophisticated threats with fewer resources — both human and technical. Cobalt’s 2022 The State of Pentesting Report found that 90% of short-staffed teams are struggling to monitor for…

The Importance of Modern-Day Data Security Platforms

Data is the backbone of businesses and companies everywhere. Data can range from intellectual property to critical business plans to personal health information or even money itself. At the end of the day, businesses are looking to grow revenue, innovate, and operationalize but to do that, they must ensure that they leverage their data first because of how important and valuable it is to their organization. No matter the industry, the need to protect sensitive and personal data should be…

Meeting Today’s Complex Data Privacy Challenges

Pop quiz: Who is responsible for compliance and data privacy in an organization? Is it a) the security department, b) the IT department, c) the legal department, d) the compliance group or e) all of the above? If you answered "all of the above," you are well-versed in the complex world of compliance and data privacy! While compliance is a complex topic, the patchwork of regulations imposed by countries, regions, states and industries further compounds it. This complexity has turned…