Data breach prevention is a top priority for organizations of all sizes and across all sectors. A breach of sensitive information — whether it’s personal information like credit card and Social Security numbers, or proprietary information like intellectual property or financial forecasts — can have serious consequences. Anyone whose personal data is breached is at increased risk of identity theft and other misuse of the stolen data, and organizations that suffer a cybersecurity incident are likely to suffer compliance fines and other financial penalties, as well as loss of market share and reputation damage.
As the volume of information increases and the threat landscape evolves, answering the question of how to prevent a data breach can seem like an insurmountable challenge. But it’s not. Here are 9 great tips for protecting your business against data breaches.
1. Look to Regulations for Guidance
Data protection regulations like the Health Information Portability Act (HIPAA), the California Consumer Privacy Act (CCPA), and the Payment Card Industry Data Security Standard (PCI DSS) have specific requirements for how organizations must manage and protect sensitive data.
You should know which regulations your company is subject to and use their requirements to inform decisions about which data security controls to implement around each type of data. For example, if your company keeps data about credit card payments, you have to comply with PCI DSS; therefore, you need to make sure that all files and databases that contain customers’ credit card numbers are properly secured, and constantly monitor for suspicious activity around that data.
2. Establish a formal security policy
Every organization should have a written information security policy that covers all aspects how data is to be handled in their network: what data can be collected, how it must be managed, the retention for each type of data, the level of security controls required for each data type, and so on.
To implement this policy, you need automated data discovery and classification. By identifying all sensitive information you create, process and store and classifying it by type, you’ll be empowered to protect it according to its value and sensitivity.
3. Create an Incident Response Plan
To respond effectively to security threats to your company’s data, you need a written and tested data breach response plan. NIST Special Publication 800-61 lays out the four fundamental steps that an incident response plan (IRP) needs to cover:
- Preparation
- Detection and analysis
- Containment, eradication and recovery
- Post-incident handling
4. Use Encryption
Data encryption is an often overlooked data security best practice, but it’s incredibly effective because it makes stolen data useless to thieves. Encryption can be software-based or hardware-based. It’s essential to encrypt data both at rest and in transit; in particular, make sure that all portable devices that could hold sensitive data are encrypted.
5. Enforce Restrictive Data Permissions
Only authorized personnel should have access to private data. Strictly enforcing the principle of least privilege — restricting the access rights of each employee, contractor and other user to the minimum required for them to do their job — helps you minimize your risk from both malicious insiders and attackers who compromise a user account.
6. Separate Business Accounts from Personal Accounts
Don’t allow employees to store or access corporate data using their personal accounts, especially when it comes to cloud services like Dropbox and OneDrive. Ensure that all services used within the organization are controlled by the IT team, not individual users, so you can ensure proper protection measures, including authentication and backups, are in place.
7. Regularly Audit Your Infrastructure
Periodic audits help you evaluate the effectiveness of your security controls and identify security risks. Experts recommend conducting audits at least twice a year, but they may be more frequent, such as quarterly or monthly. In addition to improving security, internal audits help you prepare for compliance audits. Auditing software is invaluable for streamlining the process of both internal and external auditing.
8. Perform Vulnerability Assessment
Vulnerability management must be part of your security strategy. Catalog all assets in your IT infrastructure, such as servers, computers and databases, and assign a value to each. Then identify the vulnerabilities and threats to each asset using techniques like vulnerability scanning and penetration testing. By assessing the likelihood and potential impact of each risk, you can prioritize measures for mitigating the most serious vulnerabilities for your most valuable resources.
9. Educate Employees
Cybersecurity is not solely the responsibility of IT and security teams. Every user needs to know about best practices for identifying threats and preventing data breaches. Indeed, a significant number of breaches are the direct result of someone inside the company making a mistake, like clicking on a phishing link or copying unencrypted data to a personal laptop. When MediaPro asked business users how they would handle various security-related scenarios, 75% of respondents “struggled with identifying best practices related to correct behaviors in cybersecurity and data privacy.” Educating users about how to protect sensitive data is critical to preventing breaches.
In particular, be sure to teach users about how to choose strong passwords. Be sure to explain what “strong” actually means and why strong passwords matter. Then automate enforcement of this requirement through Group Policy whenever possible.
Conclusion
Following these 9 best practices will help your organization reduce the risk of a data breach. By making data protection a top priority and choosing the right solutions to help, you can dramatically improve cybersecurity and regulatory compliance.
