Cybersecurity threat management is one of the biggest issues for any organization today. But while there are many aspects to this, one of the biggest focuses for every firm must be securing sensitive data from loss, theft or corruption.

This matters because data loss of some kind is almost inevitable. Indeed, one 2022 study found more than three-quarters of IT leaders (76 percent) had experienced an incident affecting mission-critical data in the previous year, with 45 percent unable to recover information. Although accidental data loss remains a major issue, the growing threat of cybercrime and ransomware must also be addressed.

While cybersecurity as a whole includes efforts to protect your devices and networks from infiltration, data security management is all about the information your firm holds. This includes intellectual property, research and development, operational documentation, financial details, employee and customer personal information, and much more. In today’s environment, these are your crown jewels and if data is compromised, the consequences can be severe.

Therefore, a comprehensive data security management strategy that focuses on protecting this is a must. But why does this matter, and what should you be doing to implement it?

Data security management is a broad term that covers all the operations firms must undertake to protect their most sensitive digital information from threats. There are many issues that can cause data to be lost, compromised or otherwise corrupted, including:

• External hacking attacks
• Careless or negligent employee behavior
• Malicious insiders
• Loss or theft of devices
• Hardware failure
• Natural disasters

To protect against these issues, a comprehensive management strategy is required. This should focus on several aspects, including what tools and technologies will be used to defend against threats, the roles and responsibilities of everyone in the business – not just IT and security teams – and what steps need to be taken to recover in the event of a data breach.

This not only helps defend businesses from threats, but ensures compliance with rules such as the EU’s General Data Protection Regulation and the California Consumer Privacy Act, which have strict requirements for any business dealing with personally identifiable information (PII).

The loss of critical data leads to a wide range of problems, whether it is the result of carelessness or malicious activity. As well as the direct cost of fixing a data breach and mitigating against future incidents, there is also the threat of regulatory fines, lost business and reputational damage to take into account. 

According to IBM, the average cost of a data breach in 2023 was $4.45 million, up from $4.34 million the previous year. Therefore, any firm that isn’t making information security a priority could end up facing a huge bill – which in some cases may even be enough to threaten the future existence of the company.

While data security risk management has long been a major part of any cybersecurity strategy, there are a couple of reasons why it has become an even bigger issue in the last few years. Firstly, the sheer amount of data businesses possess has risen exponentially in recent years, as big data has become the standard for every firm. What’s more, much of this consists of highly sensitive information that will be particularly enticing to hackers. As a result, many cybercriminals have been shifting their tactics in order to focus on targeting sensitive data.

These groups have quickly realized the damage that data loss can do to a business and have sought to exploit this through tactics such as double extortion ransomware. By stealing data and then holding it hostage – often threatening to release it publicly unless they receive a payment – these criminals increase their chances of making money. Many businesses feel it will be cheaper and less disruptive to give in, as well as avoiding any potential reputational damage. 

However, this is rarely an effective option. At the end of 2023, for example, we found the average ransomware payout reached $850,700 – an increase of 15 percent in just six months. What’s more, companies that do pay up are highly likely to be targeted again.

A good data security posture management strategy needs to include a wide range of tools, technologies and policies in order to defend against these threats. Among the key components of this are the following activities:

• Data discovery and classification: This is essential in helping firms understand exactly what digital assets they possess, where these are located and which should receive the highest priority for security measures.
• Data governance: This covers all critical data handling and management policies related to how data is stored, accessed and processed. It’s vital in ensuring data privacy and security while still making mission-critical data available when needed.
• Backups: Ensuring all critical data is backed up in secondary locations, apart from the main network, can help mitigate downtime in the event of a data loss incident or ransomware attack that encrypts key files. As part of this, there should also be a clear plan for recovery.
• Access management: Controlling who has access to data and how they do this involves a range of steps. This includes enforcing strong password policies and multi-factor authentication to reduce the risks posed by stolen credentials, as well as monitoring tools to alert security teams to any suspicious activity.
• Employee training: Human error is a leading cause of data breaches, so it’s essential everyone is aware of the importance of security and what their own responsibilities are. This ranges from not sharing passwords or accessing data via unsecured Wi-Fi networks to undergoing training to help spot and report phishing attacks.

There are a wide range of methods and techniques businesses can employ in order to achieve strong data protection. Among the most important are the following.

• Data encryption – This ensures that even if data itself is compromised, it will be unreadable by anyone without proper authorization and access to the right keys.
• Access control and authentication – Ensuring only an authorized user can view and edit sensitive data prevents hackers from moving laterally within a business, making it vital for both security and privacy.
• Email security – This channel remains the most common way for cybercriminals to access networks, so strong protection to guard against issues like phishing is crucial.
• Firewalls – An essential first line of defense in your network security, firewalls play a key role in preventing hackers from entering your network in the first place.
• Data masking – Especially important when dealing with PII, steps to anonymize critical information or decouple it from specific individuals are hugely useful.
• Data erasure – While usually more of a data privacy concern, holding on to data beyond its useful life gives hackers more options to target, so you need a clear plan for deleting data once it’s served its purpose.
• Anti data exfiltration (ADX) – A critical last line of defense, ADX solutions ensure that even if criminals do breach your network perimeter, they will be unable to remove data from the business.

Developing a cybersecurity risk management solution is no easy task. Big data security will require firms to cover a huge amount of ground, while at the same time battling against constantly evolving cyberthreat attack strategies that are always looking for new weaknesses to exploit.

Among the many challenges that businesses will have to tackle are:

Cybercriminals are constantly looking for new ways to subvert businesses’ defenses. For example, many traditional antimalware tools rely on signature matching in order to detect malicious activity. Therefore, the development of attack vectors that don’t include these telltale signs is a top priority for many hackers.

For instance, the use of fileless malware is one especially troubling trend. Attacks that use legitimate tools such as PowerShell won’t be detectable via this method, so it’s no surprise that more than nine out of ten ransomware attacks use these techniques.

Many data assets are no longer held on centralized, on-premise data centers. The vast majority of firms now use public cloud computing services to store and process big data, which presents many new issues for firms to deal with. As well as guaranteeing data security when using these tools, businesses also need to ensure information is protected when in transit to and from such services. 

Similarly, a large amount of information is now stored on unsecured devices, which means IT and security teams may not have full visibility into where their information is held or what protections are in place.

Related to data sprawl, changing working patterns also present several issues. Remote, hybrid and mobile working all mean employees will be increasingly accessing data from beyond the traditional network perimeter. 

As well as meaning sensitive information is likely to be stored on personal mobile devices that lack the same high levels of protection as enterprise devices, employees may be more likely to connect and work with data from devices without robust data protection solutions. They may also use unsecured, unapproved networks such as public Wi-Fi that can make it easy for attackers to intercept data.

We’ve touched on this above, but the actions of employees – whether deliberate or unintentional – remain the biggest data security weakness for many firms. Indeed, according to Cybint, 95 percent of cybersecurity breaches are at least partly caused by human error. 

While comprehensive employee training can help protect against many inadvertent issues, there is another human element to consider – the malicious insider. This refers to people within the business who act against the company for personal gain. According to the Ponemon Institute, while these incidents only make up a quarter of insider threats (25 percent), the damage they do is often severe, costing an average of $701,500 per incident.

Having the right solutions in place is a critical part of data security management. It’s important to note that there’s no single tool that can provide full protection against every threat, so it’s vital to take a defense-in-depth approach that can safeguard every area of the network, as well as offer contingencies in the event that hackers are able to bypass primary defenses.

This should start at the network perimeter with tools such as next-generation firewalls, antimalware software and email security that aim to identify and block any malicious activity before hackers have a chance to enter the network.

Should this fail, internal monitoring and alert tools such as Security Information and Event Management software can help detect any suspicious activity within a business. Without these tools, once the initial layer of perimeter defenses has been overcome, cybercriminals may be free to move laterally within the network undetected while they seek out the most valuable data.

Finally, one critical last line of defense should be ADX technology. This needs to be added to every endpoint on the network in order to prevent information being leaked. This can not only stop external hackers in their tracks, but also makes it harder for malicious insider threats to remove data undetected.

Having all these tools in place is essential for an effective data security management strategy. In an environment where the amount of information firms have to manage – and the number of threats – is growing, any gaps in a firm’s defense will quickly be exploited.