How to Operationalize Your Data Protection Program
by Tori Thurmond / February 15th, 2023
Data is the most valuable aspect of your organization, and if you want your organization to succeed, you have to protect it. However, building a data protection program can be an intimidating process, especially if you’re starting from the beginning.
The cost and damages of data breaches are multiplying daily as well as the amount of data your organization possesses. Old data may not seem relevant, but when a hacker breaches your environment, all data is at risk. Creating a program to ensure that both old and new data is protected is essential for your organization’s success. A good place to start when developing a data protection program is looking at the National Institute of Standards and Technology (NIST) framework.
Here are five disciplines to take away from the NIST framework:
- Identify
Where is your data? Perform data inventory and mapping so you know where your data is. Performing regular risk assessment reviews and having your data processing ecosystem, or the cycle that data is sent through from individuals all the way up to the government, assessed for vulnerabilities is a great way to make sure you’re doing everything you can to keep your data secure.
- Govern
Make sure you have data governance policies, processes, and procedures in place that all members of your organization are aware of and trained on to enforce in their daily work routines. When all members of an organization are well versed in the risk management strategy, the security posture of the organization will be strengthened.
- Control
Are you controlling your data? Just like with governing your data, it’s important to have policies, processes, and procedures in place to have full control over the data your organization possesses.
Consider hiring or training a data protection officer who understands how to control the data your organization is responsible for. Data is the most valuable asset your organization owns, so making sure you have experts helping you manage and protect that data is essential to your organization’s success.
- Communicate
Communicate your data governance and management policies throughout all branches of your organization. All members of your organization should be familiar with how your data is processed. When everyone knows how they are responsible for the organization’s data, fewer breaches will occur.
- Protect
Data protection is yet another discipline where data policies, processes, and procedures are essential. Hiring a data protection officer is one way to make sure these policies are being upheld, ensuring your data is as secure as possible.
Incorporate dual authentication methods into employees work procedures and only grant access to those who need it. Have your risk assessment policy reviewed and hire penetration testers to check your environment for vulnerabilities before threat actors can.
Developing a Plan
After reviewing the NIST framework, there are three key areas to focus on when continuing to develop your data protection program.
First, focus on the people you need to implement the program.
Make sure your CISO and other decision makers within your organization are on board with your data protection efforts. Security needs to come from the top down. When other members of the organization see how much security is valued by C-level executives, a security culture will be established.
Bring on dedicated security professionals like a data protection officer, a data architect, and a compliance officer. Many IT teams don’t have the staff to dedicate to data protection and security. They are working their hardest just to keep the lights on. By hiring individuals whose main responsibility is data protection, your organization will be better prepared to face any threats that may arise.
Next, focus on the process.
How are you going to execute your data protection initiatives? Along with the policies and company-wide awareness mentioned above, make incident collection and reporting a well-known process. A strong incident response plan will make a difference in how much damage an organization faces after inevitable incidents.
Establish response levels within your incident response plan. Have a procedure written for false positives and a separate plan for the investigation and remediation of true threats. A well-organized incident response plan will prove to be a valuable resource when all threats are handled effectively and efficiently.
Finally, focus on the technology.
Think about what systems you will use to make your data protection program work. What Data Loss Prevention (DLP) technology will you use? What about SASE, SSE, SIEM, or CDR? Deciding exactly what will work best for your organization may be an overwhelming process. Make sure you’re partnering with someone who will walk you through all aspects of your compliance journey to help you decide what will benefit your organization the most.
If you don’t have the correct people doing the correct processes, your technology and tools will be ineffective. For tools to be effective, you must have the right people and processes.
The goal of your data protection program should be holistic security. Automation alone will not create a secure environment, but there are ways to leverage automation to help improve your security and compliance. When systems and people work together with a clear understanding of security and data protection goals, your organization can become unstoppable.
Are You Asking the Right Questions?
To make sure your data protection program runs as efficiently as possible, make sure you ask the right questions.
- What are your business drivers?
- What existing security controls support data protection?
- What channels do you protect first?
- What is the intended response of a violation?
- What is your risk appetite for building exceptions?
- What are the risks you are trying to mitigate?
- What are your data assets?
While these questions do not make up and all-inclusive list of questions your organization should consider when building your data protection program, they are a good start.
What Does a Mature Data Security Policy Look Like?
While there is no single correct approach for constructing and organizing DLP policies, here are a few examples of what a mature program could look like.
- Instead of unfamiliarity of DLP features, your organization uses advanced features, such as database fingerprinting.
- Your organization is using policy levels and exceptions as opposed to only using a single layer of policies applied to all of your users.
- You’re using custom classifiers or action plans.
- Your rules and exceptions are granularly controlled bases by channel.
- Instead of being in monitor-only mode, your program is in blocking mode.
There is no one way that a mature data security policy functions within an organization, however, consistency is key.
Shifting from Reactive to Proactive
Breaches and threats are not something you just want to keep up with but something you want to stay ahead of. If your organization is barely keeping up with threat management, you could be falling behind and exposing yourself to threats that could cost millions of dollars in damages.
Stay proactive by continuously evaluating user interactions to gain meaningful visibility of your environment. Having professionals on staff to make sure your controls are working as intended and evaluate user and data interactions will help your organization stay ahead. Looking within the organization for threats is just as valuable as looking for outside threats. Risk assessments, cloud scans, and policy reviews are some of the best ways to stay ahead of threats.
Still Not Sure Where to Start?
Building a data protection program is hard work. Here at KirkpatrickPrice, we want to help make this process more manageable. We have data security experts who would love to partner with you on your compliance journey.
Not only can we help you establish your data protection program or create your data security policy but we can also help you maintain it by reviewing your risk assessment policy, performing cloud security scans, reviewing your policies and more. Partner with a KirkpatrickPrice expert today to become security champions.
