Listen to this podcast on iTunes, Soundcloud or wherever you find your favorite audio content.
In today’s episode, Forrester data analyst Heidi Shey returns to the SecurityIntelligence Podcast for an in-depth look at discovery, classification and the future of corporate big data strategies.
Data Discovery and Classification 101
Shey puts it simply: For security teams, data discovery and classification provides critical understanding of corporate data. Where is it? Is it sensitive? How is it best defended?
When implemented well, these strategies create context for a data-first approach, helping teams identify the relevant risk of personally identifiable information (PII), enterprise data and intellectual property, in addition to permissions-based risk.
Common Approaches
Despite the shift to digital alternatives, Shey still sees enterprises taking a paper-based approach to data discovery, leading to gaps when data can’t be found. Some companies discover data and create elaborate classification strategies but never implement them, while others apply protection rules but skip the discovery and classification process.
Shey recommends using this as an opportunity to “clean house,” minimize data sprawl and get rid of stale data.
Listen to the podcast
Potential Pitfalls and Pain Points
While every data initiative is different, Shey notes that one common pitfall is overcomplication with too many levels of classification. Another potential misstep is assuming that the meaning and purpose of classification is the same across the entire organization; different departments often have different needs and priorities.
Shey also points out that some companies never get off the ground with discovery and classification because they perceive data volumes as too great — discovery is like “trying to boil the ocean.” She advises security leaders to separate efforts into two tracks — one for legacy data and one for new data — then leverage automation solutions to help streamline discovery.
What’s Next for Data Discovery and Classification?
Right now, discovery and classification efforts are “very static,” according to Shey. For her, the future starts with dynamic data classification that reflects changing corporate realities and scales on-demand. Both automation and machine learning tools offer potential benefits.
When done right, Shey says discovery and classification offer “a way to uplift and optimize other security efforts.” Achieving this goal requires a combination of strategy and technology — that means establishing a strong culture of security, empowering employees with intelligence, automated tools, and aligning those solutions with business outcomes.
Read the Forrester report on Data Discovery & Classification