As an IT leader in charge of database engineering and database audit and compliance for a Fortune 50 American company with millions of customers, I know that there are potential risks and vulnerabilities inherent in every aspect of data management. Companies like ours store and change terabytes of operational and customer data on a constant basis. There are databases that host sensitive data. There are numerous levels of access to the data. The data is replicated in many forms. Therefore, it is increasingly difficult to manage the volume, complexity and security of all this data.

With all this data and the responsibility to keep it viable, safe and secure, there are plenty of reasons to worry. Here are three potential scenarios that top the list of things that keep me up thinking about work when I should be in a peaceful slumber.

A Massive Public Data Breach

A breach of protected data is likely the ultimate concern for anyone who has responsibility for keeping data secure as part of their job, whether they are a database administrator, a chief information officer, or anyone in between. This is likely because such exposure could result in severe damage, including financial penalties, unplanned compensation, compromised brand reputation and even a personal feeling of failure.

A data breach is probably one of the most difficult things to prevent because many people potentially have a legitimate need to access data as part of their job. They may need to access it for customers, they may need to analyze it for data science or they may need to apply business logic to it.

Here are some suggestions for helping to mitigate these access risks:

  1. Implement strong access controls.
  2. Identify, classify and prioritize sensitive data, including payment card data, protected health information, personally identifiable information and other data types.
  3. Recertify access regularly.

Watch the on-demand webinar for a panel discussion with our expert IBM Security Guardium Champions to hear how they are using Guardium to address their data security challenges.

Register for the on-demand webinar replay

Accidental Deletion or Editing

The next thought that keeps me wide awake is the idea of a developer with inappropriate access in production inadvertently deleting or changing the wrong data. Data integrity and recoverability are essential for any data steward. Business applications are designed to update data in a manner consistent with normal operation. However, manual manipulation of the data in a production database is all too common. This could be a result of poor system design or the inheritance of a legacy system or process with antiquated capabilities.

When manual attempts to ‘fix’ data in a production database occur, the likelihood of human error rises. If you don’t enforce separation of duties and if application developers have elevated access in production, a simple alter or delete with an improper predicate can result in a very unexpected and inappropriate change.

Here are some suggestions for helping to mitigate these risks:

  1. Implement a thoughtful and reliable backup strategy.
  2. Utilize tools that will aid in the analysis and recovery of changed data (like the Log Analysis Tool, IBM Security Guardium).

How to Manage the Move to the Cloud

Data is moving to the cloud, and we can’t keep pace with location tracking and risk management. It was not too long ago that the three-year plans in major IT organizations were super conservative with any movement of company assets to the public cloud. That strategy seems to be changing rapidly. In a large organization where a move to the cloud is growing, the assets may be difficult to trace. There could even be multiple initiatives and programs led by different areas that don’t necessarily align.

You may have an infrastructure cloud enablement team, or a third-party consulting initiative, or business areas may be leading their own efforts to move assets to the cloud. How do you protect data if you don’t have a complete view of what is where?

Here are some suggestions for managing the move to the cloud from a data perspective:

  1. Invest in a robust application and asset inventory system.
  2. Classify the data moving to the cloud and implement the appropriate protection and controls.
  3. Implement a consistent database vulnerability management tool.

At the end of the day, investment in the proper process and tooling will help you build a world-class IT organization where data security and protection are paramount — and where sleepless nights are few and far between.

Watch the on-demand webinar for a panel discussion with our expert IBM Security Guardium Champions to hear how they are using Guardium to address their data security challenges.

Register for the on-demand webinar replay

More from CISO

How to Solve the People Problem in Cybersecurity

You may think this article is going to discuss how users are one of the biggest challenges to cybersecurity. After all, employees are known to click on unverified links, download malicious files and neglect to change their passwords. And then there are those who use their personal devices for business purposes and put the network at risk. Yes, all those people can cause issues for cybersecurity. But the people who are usually blamed for cybersecurity issues wouldn’t have such an…

The Cyber Battle: Why We Need More Women to Win it

It is a well-known fact that the cybersecurity industry lacks people and is in need of more skilled cyber professionals every day. In 2022, the industry was short of more than 3 million people. This is in the context of workforce growth by almost half a million in 2021 year over year per recent research. Stemming from the lack of professionals, diversity — or as the UN says, “leaving nobody behind” — becomes difficult to realize. In 2021, women made…

Backdoor Deployment and Ransomware: Top Threats Identified in X-Force Threat Intelligence Index 2023

Deployment of backdoors was the number one action on objective taken by threat actors last year, according to the 2023 IBM Security X-Force Threat Intelligence Index — a comprehensive analysis of our research data collected throughout the year. Backdoor access is now among the hottest commodities on the dark web and can sell for thousands of dollars, compared to credit card data — which can go for as low as $10. On the dark web — a veritable eBay for…

Detecting the Undetected: The Risk to Your Info

IBM’s Advanced Threat Detection and Response Team (ATDR) has seen an increase in the malware family known as information stealers in the wild over the past year. Info stealers are malware with the capability of scanning for and exfiltrating data and credentials from your device. When executed, they begin scanning for and copying various directories that usually contain some sort of sensitive information or credentials including web and login data from Chrome, Firefox, and Microsoft Edge. In other instances, they…