TVs and Audio Category

Why CISOs Should Team With Business Leaders To Collaboratively Address Enterprise Data Risk


Glen Day is the Founder and CEO of NVISIONx, the data risk Intelligence platform that enables companies to control their enterprise data.

With the increasing prevalence and sophistication of cyberattacks, chief information security officers must remain vigilant to new assaults that threaten their enterprise. However, the new level of attacks, the volume of data and the complex dispersion of controls demand a data-first approach to better defend a company’s most important digital assets.

Why is this? Companies hiring cyber and privacy professionals still struggle with truly knowing their data. They find themselves reactively discovering data instead of having a reliable system for finding it on demand. The problem of controlling data is more challenging than ever. Cyber and privacy professionals have done as well as they can to defend and remediate data risks. The journey now requires closer teaming with business leaders who are familiar with the data that matters most.

So how can business leaders work with their CISOs to control data in a systematic way and reduce risk? Adopt a framework that can optimally assess the level of control for all data—from its creation through to its final disposition because the better you know your data, the more efficiently you can control it. These seven questions cover the life cycle of any dataset to help companies determine which data presents a risk concern and which measures must be taken to properly protect it:

ALSO READ:  How To Leverage Content During Economic Uncertainty

1. What data do we have?

I’ve learned firsthand that the data-first approach begins with a collaboration between the CISO and the rest of the company to determine the priority, scope and ownership of key data. It’s what you don’t know that can put you at risk, which is why it’s crucial that all data gets properly accounted for to avoid blind spots. Just accounting for some or most of your data is not acceptable.

2. Where do we store that data?

Regardless of if your data is in your data center, corporate cloud or across multiple shared cloud services, it should all be accounted for. Business, cyber and IT leaders should work together to proactively assess their data ecosystems to minimize the excessive time, costs and risks associated with reactive discovery or searches. Ensure you can find what you need when you need it.

3. Who has access to the data?

For any data classified as sensitive, CISOs need to work with business leaders to clarify access control. This means ensuring that only those users and groups that should have access, have access (and for only as long as they need it). In my experience, this is one of the first lines of data protection, but this process often grants greater access than is needed.

4. Is the data properly protected?

Once business leaders have provided insights on what data is critical and understand where it’s stored, the CISO can then better evaluate if all of the proper controls have been installed and if they are effectively reducing risks. You can consider using solutions that fuse business data with cyber intel. (Full disclosure: My company provides this type of solution, as do others.) This can allow cybersecurity teams to focus on more specific, sensitive data to provide a true risked-based approach for data protection that results in reliable outcomes with minimal human effort.

ALSO READ:  Navigating A New Business Venture? 14 Critical Tips For Success

5. Can we find the data when we need it?

In the event of a security incident or in response to a legal matter, you need to find exactly what you need in a quick and reliable manner. If you have adopted the first two principles of knowing what you have and where you have it, these time-sensitive functions could be performed in a way that reduces the cost and risk to minimize the potential impact and damage to the corporate brand. It’s unfortunate that some companies can take weeks to determine what data may be exposed and how it could impact the business. The longer it takes, the greater the impact on the brand and its customers, patients or partners.

6. Are we keeping only the data we need?

It might be hard to admit, but I see it all the time. Almost every company has data hoarding practices. They often adopt the philosophy of “keep everything forever, just in case.” But I’m seeing data volumes doubling every two years and the daunting impact of the “right to be forgotten” privacy rights, so hoarding data can no longer be tolerated.

ALSO READ:  Resilient Companies Must Be Prepared To Navigate Social Issues

Good data hygiene means keeping what you need for only as long as you need. Keeping data that is beyond its useful life, including beyond the record retention requirements, might seem to be easy because storage is cheap, right? Storage might be cheap to buy, but it’s not cheap to keep. More data results in greater compliance scopes, greater attack surfaces, greater e-discovery costs and excessive storage costs. The longer you hoard data, the more cost and risk your company will incur.

7. Are we disposing of data that we no longer need?

Once disposable data is identified, there must be a plan to review, approve and delete surplus data in a defensible manner. Some platforms, my own included, can notify stakeholders of what data can be disposed of. This allows data to be queried against records, retention schedules and legal hold processes. Here, you’ll experience cost-saving for purging useless data, which can result in substantial and recurring ROIs.

Data protection is not the sole responsibility of the CISO. It’s a business-centric function that requires collaborative support and coordination among various stakeholders. Those who do it right reap the rewards and are transformed into proactive data guardians, not reactive data firefighters.


Forbes Business Council is the foremost growth and networking organization for business owners and leaders. Do I qualify?




Source link

admin

Nigerian Celebrity News and entertainment

Follow Us

Follow us on Facebook Follow us on Pinterest