Headlines frequently alarm us with news about the latest data breach or computer virus. Cyber criminals are intent on stealing information they can use or resell, so your organization must take all possible steps to protect your data and intellectual property. Here are five ways to accomplish this.
1. Identify and Secure Sensitive Data
Many organizations keep up their firewalls and anti-virus programs and trust that this will do the job. But that isn’t adequate as a security strategy. You should start by identifying the most sensitive information, such as customer credit card, vendor account, and Social Security numbers. Have all this information stored in separate tables that are encrypted and linked only by record IDs with relevant textual information.
2. Assess Information Flows
It’s important to evaluate your workflows for the best data protection. Confidentiality should always be observed. For every type of sensitive information you keep, ask yourself who enters it, who uses it, and who can edit it. Each employee in the workflow should have the minimal access and permissions needed to do their job. Departing employees should immediately have all their permissions revoked.
3. Determine Data Usage
Think about the risks in how every piece of data may be used. Customer data, financial information, employee data, and intellectual property should all be monitored. Maintain and archive user logs to determine who accesses the information and when, including mobile and remote users. Sensitive information should be accessed only via reports or stored procedures that filter data based on the user’s permissions.
4. Enforce Security Policies
Employees will tend to revert back to bad habits if security policies are not enforced. Your system can be programmed or integrated with third party software to send alerts to database or network administrators. When violations are detected, such as trying to access restricted files or failure to follow password guidelines, action should be taken. Disciplinary measures may involve suspended privileges or probationary periods as you deem necessary, up to and including termination for serious or repeated offenses.
5. Review Your Progress
For the best results, your data protection policies should be reviewed periodically. Employee compliance should be emphasized with occasional reminders and training sessions. It’s also a good idea to bring in outside analysts. Reasons for network consulting on a regular basis include more specialized skills, greater experience, objective assessments, and suggested improvements to meet the latest threats.
Even if you have data backups, a single breach or virus causes loss of productivity and loss of reputation. A multi-layered digital security plan is essential to your business future.
