How to Prevent Data Breaches

Data breach prevention is a top priority for organizations of all sizes, in all industries.

A leak of sensitive information – whether it’s personal information such as payment card and social security numbers, or proprietary information such as intellectual property or financial forecasts – can have bad consequences.

An individual whose personal data has been stolen is at increased risk of identity theft and other misuse, and organizations that suffer a cybersecurity incident are likely to face non-compliance fines and other financial penalties, as well as loss of market share and reputational damage.

Related article: Why Is Data Privacy More Important Today Than Ever?

As information volumes grow and the threat landscape continues to evolve, knowing how to protect against a data breach can seem overwhelming. Yet, it’s not so bad. Here are nine smart tips for protecting your business from data breaches.

Cybersecurity regulations will guide you

Data protection regulations, such as the Health Information Portability Act (HIPAA), the California Consumer Privacy Protection Act (CCPA), and the Payment Card Industry Data Security Standard (PCI DSS), have specific requirements for how organizations must manage and protect sensitive data.

You should be aware of the regulations your company is subject to and use their requirements to decide what security controls to put in place for each type of data. If, for example, your company maintains card payment data, you must comply with the PCI DSS, so make sure that all files and databases that contain customer payment card numbers are properly secured, and continuously monitor for suspicious activity involving that data.

Establish a formal security policy

Every organization should have a written information security policy covering all aspects of data processing in its network: what data can be collected, how it should be managed, the retention of each type of data, the level of security controls required for each type of data, etc.

To enforce this policy, you need an automated data discovery and classification solution. By identifying all the sensitive information you create, process and store and classifying it by type, you will be able to protect it according to its value and sensitivity.

Create an incident response plan

To effectively respond to threats to your organization’s data security, you must have a written and tested data breach response plan. There are four basic steps an incident response plan should include:

• Preparation
• Detection and analysis
• Containment, eradication and recovery
• Post-Incident Management

Use encryption

Data encryption is an often overlooked good security practice; however, it is incredibly effective because it makes stolen data unusable to thieves. Encryption can be software or hardware. Encrypting data at rest and in transit is essential; make sure all portable devices that may contain sensitive data are encrypted.

Establish restrictive data access permissions

Only authorized personnel should have access to sensitive data. By strictly enforcing the principle of least privilege (limiting the access rights of each employee, contractor and other user to the minimum necessary for their job), you minimize the risk of malicious insiders or hackers compromising a user account.

Separate business accounts from personal accounts

Don’t allow employees to store or access company data from their personal accounts, especially for cloud services like Dropbox and OneDrive. Ensure that all services used within the organization are controlled by IT, not individual users, to ensure that appropriate safeguards are in place, including authentication and backups.

Related article: 10 tips to protect your personal data

Audit your infrastructure regularly

Periodic audits allow you to assess the effectiveness of your security controls and identify security risks. Experts recommend conducting audits at least twice a year, but it can be more frequent, such as quarterly or monthly. In addition to improving security, internal audits help prepare you for compliance audits. Audit software is an invaluable asset to streamline the internal and external audit process.

Assess vulnerabilities

Your security strategy should include vulnerability management. List all the resources in your IT infrastructure, such as servers, computers and databases, and assign a value to each. Then, identify vulnerabilities and threats to each resource using techniques such as vulnerability scanning and penetration testing. By assessing the likelihood and potential impact of each risk, you can prioritize mitigation actions for the most serious vulnerabilities affecting your most valuable resources.

Train your employees

Cybersecurity isn’t just for IT and security teams. Every user should know the best practices for identifying threats and preventing data breaches. In fact, many breaches are a direct result of someone’s mistake within the company, such as clicking on a phishing link or copying unencrypted data to a personal laptop. Some business owners have been asked on how they would handle various security-related scenarios; 75 percent of those surveyed “struggled to identify best practices around appropriate cybersecurity and data privacy behaviors.” Educating business owners and workers about protecting sensitive data is critical to preventing data breaches.

This includes teaching them how to choose strong passwords. Explain to them what “strong” means and why it’s important to have strong passwords. Then, automate the implementation of this principle through group policy, where possible.