As an IT leader in charge of database engineering and database audit and compliance for a Fortune 50 American company with millions of customers, I know that there are potential risks and vulnerabilities inherent in every aspect of data management. Companies like ours store and change terabytes of operational and customer data on a constant basis. There are databases that host sensitive data. There are numerous levels of access to the data. The data is replicated in many forms. Therefore, it is increasingly difficult to manage the volume, complexity and security of all this data.

With all this data and the responsibility to keep it viable, safe and secure, there are plenty of reasons to worry. Here are three potential scenarios that top the list of things that keep me up thinking about work when I should be in a peaceful slumber.

A Massive Public Data Breach

A breach of protected data is likely the ultimate concern for anyone who has responsibility for keeping data secure as part of their job, whether they are a database administrator, a chief information officer, or anyone in between. This is likely because such exposure could result in severe damage, including financial penalties, unplanned compensation, compromised brand reputation and even a personal feeling of failure.

A data breach is probably one of the most difficult things to prevent because many people potentially have a legitimate need to access data as part of their job. They may need to access it for customers, they may need to analyze it for data science or they may need to apply business logic to it.

Here are some suggestions for helping to mitigate these access risks:

1. Implement strong access controls.
2. Identify, classify and prioritize sensitive data, including payment card data, protected health information, personally identifiable information and other data types.
3. Recertify access regularly.

Watch the on-demand webinar for a panel discussion with our expert IBM Security Guardium Champions to hear how they are using Guardium to address their data security challenges.

Accidental Deletion or Editing

The next thought that keeps me wide awake is the idea of a developer with inappropriate access in production inadvertently deleting or changing the wrong data. Data integrity and recoverability are essential for any data steward. Business applications are designed to update data in a manner consistent with normal operation. However, manual manipulation of the data in a production database is all too common. This could be a result of poor system design or the inheritance of a legacy system or process with antiquated capabilities.

When manual attempts to ‘fix’ data in a production database occur, the likelihood of human error rises. If you don’t enforce separation of duties and if application developers have elevated access in production, a simple alter or delete with an improper predicate can result in a very unexpected and inappropriate change.

Here are some suggestions for helping to mitigate these risks:

1. Implement a thoughtful and reliable backup strategy.
2. Utilize tools that will aid in the analysis and recovery of changed data (like the Log Analysis Tool, IBM Security Guardium).

How to Manage the Move to the Cloud

Data is moving to the cloud, and we can’t keep pace with location tracking and risk management. It was not too long ago that the three-year plans in major IT organizations were super conservative with any movement of company assets to the public cloud. That strategy seems to be changing rapidly. In a large organization where a move to the cloud is growing, the assets may be difficult to trace. There could even be multiple initiatives and programs led by different areas that don’t necessarily align.

You may have an infrastructure cloud enablement team, or a third-party consulting initiative, or business areas may be leading their own efforts to move assets to the cloud. How do you protect data if you don’t have a complete view of what is where?

Here are some suggestions for managing the move to the cloud from a data perspective:

1. Invest in a robust application and asset inventory system.
2. Classify the data moving to the cloud and implement the appropriate protection and controls.
3. Implement a consistent database vulnerability management tool.

At the end of the day, investment in the proper process and tooling will help you build a world-class IT organization where data security and protection are paramount — and where sleepless nights are few and far between.

Watch the on-demand webinar for a panel discussion with our expert IBM Security Guardium Champions to hear how they are using Guardium to address their data security challenges.