8 Data Protection Strategies To Deploy For Cybersecurity Awareness Month

For security and IT professionals, Cybersecurity Awareness Month is like the start of a new year — it’s the perfect time to assess your company’s current policies, practices and technologies and set goals for improvement. That includes evaluating your data protection strategies.

Data protection focuses on safeguarding your company’s critical assets from breaches, ransomware attacks or data loss due to technology failures or natural disasters.

It means ensuring data availability, backup and recovery, as well as complying with data privacy laws.

If you know you need to update your data protection strategies but you’re not sure where to start, here are eight steps you can take immediately.

Data protection strategies for Cybersecurity Awareness Month

1. Engage the right people

While your security team may establish the framework, any data protection strategies you implement need to have buy-in across the organization to have a lasting impact. Anything that’s difficult to add to your current tech stack or creates extra work for your IT team will inevitably be met with resistance. Likewise, solutions that pester your developers with frequent alerts and delay the launch of critical projects will eventually be ignored, allowing vulnerabilities to slip through the cracks.

Start by assembling a team of stakeholders from key departments, including:

• Security
• Governance, risk and compliance
• IT
• HR
• Sales
• Marketing
• Operations
• Customer service

Ask questions to better understand how each department uses your data, where they store it, what level of access they need and what steps they already take to protect the data. This can help you identify gaps and clarify misunderstandings. For instance, you may discover your sales and marketing teams frequently download and upload customer lists because they use two different systems that don’t integrate well together. They may be inadvertently storing that data on their desktops, putting the information at risk of theft if an unauthorized user gains access.

2. Take inventory of all your enterprise data

Certain industries have different inherent risks depending on how they use data.

Seventy percent of financial services firms reported a cyberattack in the past 12 months, and they are more vulnerable to ransomware attacks, with an average cost of $5.85 million.

Consider what sensitive data you generate related to your business operations or product development. What data do you collect from customers?

Don’t forget to consider unstructured data. Many companies fail to protect this data because their employees are constantly generating it and it may not seem to have as much inherent value on the surface. However, it can bring valuable insights that increase revenue, improve patient outcomes and even detect fraud in real time.

And without proper data protection strategies, it can also make your company more vulnerable to ransomware attacks.

3. Review your data storage platforms

Managing enterprise data storage is becoming increasingly challenging as companies adopt more distributed models, including using multi-cloud and hybrid cloud environments. They have to contend with different file formats and implement data security protocols differently in each environment. This often leads to gaps and inconsistencies.

Look for opportunities to consolidate and simplify data storage when possible, and be sure you’re applying the same data protection across all platforms.

4. Audit your data access practices

Following a surge in ransomware attacks and greater distribution of enterprise data, nearly 60% of organizations plan to implement a Zero Trust security policy by 2022. The Zero Trust security principles go beyond protecting your network from external threats.

This framework assumes everyone is a potential threat and uses multi-factor authentication to verify every user, device and application that requests access to data. It also uses the principle of least privilege to grant them the lowest level of access they need to do their jobs.

If your organization hasn’t implemented Zero Trust security yet, now is the time to start the process.

5. Review your data backup procedures

Data backup and recovery is an important part of a strong data protection strategy.

Many organizations encounter challenges when they back up and transfer their enterprise data. They may be inadvertently creating a lot of duplicate data, forcing them to find new storage solutions frequently. They may be failing to properly encrypt that data, exposing it to cyberattacks. Or, if they are fully encrypting backups, they may not be able to retrieve that data quickly in the event of a disaster, which can disrupt business operations. Applying the appropriate protections to all data can be difficult when it exists in many different environments on servers and in the cloud.

Take this time to review your processes for data backup, identify any challenges, and address them. Here are a few important questions to consider:

• Do you encrypt backup data in transit and at rest?
• Do your backups include unstructured data?
• Do you follow a Zero Trust security model for restricting network access to your data backups?
• What protections are in place to restrict physical access to data centers?
• What backup and recovery processes do your cloud providers use?
• How often do you test your data backup processes to ensure they are working properly?

6. Determine your data privacy requirements

Depending on your industry and where you do business, you need to comply with different data privacy requirements. The Health Insurance Portability and Accountability Act (HIPAA) or the Gramm-Leach Bliley Act (GLBA) may not apply if you aren’t collecting private health information or personal financial data, but you will almost certainly need to comply with the General Data Privacy Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Do your data protection strategies meet these requirements?

7. Educate your employees about cybersecurity risks

Many employees don’t realize the simple steps they take every day to save, share and access data are putting your organization at risk. That includes storing passwords and forgetting to update them regularly, forgetting to update their devices with the latest security protections, or failing to set up multi-factor authentication for the applications they use.

Now is the time to start educating employees if you haven’t already begun. The Cybersecurity & Infrastructure Security Agency has plenty of resources you can share with your team, including tip sheets to protect online privacy, secure their data and devices, and prevent phishing and ransomware attacks.

Microsoft also offers cybersecurity awareness training that includes videos, interactive courses, and other resources.

8. Conduct a gap analysis of your data protection technology

Consider all the technology you use to implement your current data protection strategies. Are you applying it consistently across departments and storage platforms? Across both structured and unstructured data? Your data protection technology should include Zero Trust security, end-to-end encryption, data dispersion and data backup and recovery.

And because more than half of organizations have experienced a data breach caused by third parties, this is also a good time to evaluate all your technology vendors.

Ensure you have up-to-date security policies for each one, including:

• The results of their most recent cybersecurity risk assessment
• Their data privacy policy
• How they store data and backups
• How they manage access to their network and their software
• How often they conduct penetration testing
• How often they perform software updates
• What they’ve done to audit their own security controls
• Their most recent SOC 2 compliance certification, if applicable

Simplify data protection with Myota

To safeguard their data from inevitable ransomware attacks and other looming threats, today’s enterprises need a multi-tiered solution. Simply protecting their network is no longer enough. Fortunately, deploying best-in-class data protection strategies across all your storage environments doesn’t have to be complicated.

Myota’s Converged Data Protection Platform transforms unstructured data into immutable files capable of withstanding attacks. It combines Zero Trust access controls, data encryption, sharding and dispersion, and backup and recovery into a single solution your team can implement in minutes. Administrators can manage data access by user, device or storage location, and employees can protect sensitive data simply by dragging files into the Myota folder.

It’s easy to apply to any storage environment so you can protect both structured and unstructured data consistently and completely.

To learn more about how to implement next-generation data protection strategies, join us for an upcoming webinar at 1-2 p.m. Wednesday, Oct. 20.