Information is arguably the most valuable asset held by organizations today. Hence, they attract the attention of highly motivated, capable and well-funded threat actors. Moreover, the extensive footprint of these assets spread across various regions, systems, devices, and formats, provide ample opportunities for threat actors to breach and gain access.
While business leaders recognize the value of these information assets, they often underestimate their vulnerability to threats and the potential consequences of being compromised. To protect information assets, organizations have to think beyond existing protection capabilities and adopt protection processes that are balanced and comprehensive. Some basic steps in getting started should include:
- Identifying Critical Information Assets. Organizations need to identify vital information assets before these assets can be prioritized, subjected to a risk assessment and protected in line with their security requirements. The key steps in this process can include assessing and recording asset business value, applying a business impact rating, and creating a prioritized list of the most important assets.
- Understanding And Prioritizing Key Threats. Successful identification, profiling, and assessment of threats is dependent on an organization’s risk management capabilities. Key steps in this process include investigating the main threats to these assets, identifying the likely threat events that can be used to target these assets, and evaluating the level of exposure of each threat with each critical information asset.
- Determine The Necessary Protection Mechanisms. Once vital information assets and associated threats are identified, organizations will need to adopt security mechanisms, controls and approaches that provide relevant protection against these threats. Protection mechanisms can include investing in specialized enterprise security solutions, acquiring dedicated security products, or enabling certain built-in security features within existing technical infrastructure components.
- Leverage A Threat-based Protection Approach. Adopting a threat-based approach is about providing situational awareness of current and emerging threats at each stage of the cyber kill chain. It involves establishing an early warning system before an attack occurs, developing a combination of preventative and detective security measures during an attack, and efficiently managing security incidents associated with these information assets after an attack is detected.
- Secure The Information Lifecycle. Critical information assets must be protected at each stage of the information life cycle — when they are created, processed, stored, transmitted and destroyed. Information owners and users that work with vital information assets can apply comprehensive protections, such as multi-factor authentication, biometrics, encryption, real-time monitoring and reporting, regular reviews of event logs, and other standard security best practices.
Building A Robust Data Protection Process
Embedding these four elements can help broaden your data protection capabilities:
- Governance, Risk and Compliance: Governance, risk and compliance represent the disciplines and practices associated with how an organization governs information security, manages information risk, and addresses different compliance requirements. Adopting a GRC framework has the following benefits:
- A Structured Approach. GRC enables organizations to gather and analyze information, make informed data security decisions and manage a variety of ongoing data protection activities in a structured format.
- Proactive Risk Management. Embedding risk management efforts into daily operations can anticipate potential security threats faster, fostering a more resilient data protection posture.
- Compliance Adherence. GRC ensures ongoing adherence to regulatory requirements, enabling organizations to stay compliant and avoid potential penalties and reputational harm.
- Technology: Safeguarding vital information assets will require significant use of technology to automate protection and complement existing security measures. This includes:
- Technologies such as encryption, zero trust network access (ZTNA), data loss prevention (DLP), secure deletion and file sanitization software.
- Establishing a security operations center (SOC) to help monitor network activity, analyze potential threats and provide a coordinated response to security breaches. Leveraging AI technologies can also help in detecting anomalies in real-time.
- Deploying backup and disaster recovery solutions enables organizations to quickly restore data in the event of a breach, corruption, or loss. This ensures business continuity and mitigates risks related to data availability.
- Security Assurance: Several variables can affect critical information assets over time, including new business processes, changes in the threat landscape, technological developments like AI, modifications to legal or regulatory requirements, and corporate events like mergers and acquisitions. To manage these changes and evolving risks, security assurance activities become critical. Strategies that can help support these activities include:
- Regular security audits help identify weaknesses in systems, software, controls and processes, ensuring that security practices are up-to-date and aligned with the prevailing threat environment.
- Regular penetration testing, vulnerability scans and ongoing monitoring allow organizations to address potential vulnerabilities and plug security gaps before they can be exploited.
- Achieving compliance provides external validation that security controls are deployed according to industry best practices and meet adequate protection requirements.
Information assets account for the bulk of an organization's value, but the risks associated with these assets are often undervalued, despite the ongoing occurrence of high-profile security breaches. Organizations must identify their critical information assets as soon as possible and invest in building a resilient data protection process.
Steve Durbin is Chief Executive of the Information Security Forum, an independent association dedicated to investigating, clarifying, and resolving key issues in information security and risk management.
