How can you maintain data security and governance in a remote work environment?

In the pre could, saas world we went to the data center and looked at all the racks and servers in the server farm. Securing the perimeter went a long way towards managing the risk. Fast forward to the cloud & SAAS world where we rent our infrastructure and software the only thing we really own is the data. The need to identify, catalogue and classify your critical data became more important. This is when the CISO and CDO needed to work together more closely. Outsourcing brought with it the clean room techniques for off shore worker and now the remote working brings the need for classification to be extended, applied not just a system level but to the records, files and documents.

Identify and classify data assets based on value, sensitivity, and regulations, prioritizing data security and governance. In remote work, address threats like unauthorized access and data breaches. Train staff in data security, and integrate governance into business processes. Aim for a holistic approach combining people, processes, and technology to protect and effectively manage your data assets. The protection of data assets in a remote work environment is about creating a synergy between people, processes, and technology to build a resilient and secure data ecosystem. Don't just focus on the 'what', 'how' and 'why' of data security. You can protect your data but also use it as a strategic asset to drive business growth and innovation.

You cannot secure what you cannot see. In a remote working environment specifically, the data is spread across multiple locations in systems which may or may not be secure. Thus, identify the location and type of data is very important before implementing any controls. Organizations usually use a variety of data discovery and data classification tools to locate and classify their data that can help them implement appropriate security controls.

Couldn’t agree more with it. Remote working has added extra layer of security threat. And reminding employees about the data security works like charm. There should be a top-down approach to talk about the importance of data security periodically. Training and communication plays a big role in creating eco system to enhance and more involvement from everyone.

In my opinion, assessing data assets and risks is akin to mapping uncharted territory. It's understanding the core of any enterprise - its data. It involves comprehending the depth, sources, and value of data while identifying potential threats like breaches, compliance issues, or unauthorized access. This meticulous process entails inventorying assets, evaluating security measures, ensuring compliance, educating employees, and leveraging advanced tech for predictive analysis. It's not a one-time task but an ongoing, iterative process crucial for unlocking data potential and safeguarding against risks, ultimately ensuring long-term success. Ultimately, an adept assessment not just mitigates risks but also unlocks the latent value within.

A DLP policy should also be regularly reviewed and updated to keep pace with the changing data landscape and threat environment. You should also educate and train your data users on the importance and best practices of data security and DLP, and monitor and report on the effectiveness and compliance of your DLP policy. A DLP policy should also be aligned with your data classification and risk assessment results, and reflect the best practices for data security, such as encryption, backup, access control, network segmentation, multi-factor authentication, and incident response.

One of the ways I've seen this play out is blocking print for certain classifications when working from home. No one wants customer records in suburban recycling bins!!

Now, small business as well as large must have a “cyber first” mentality. Bad actors and cybercriminals are equal opportunity offenders and don’t discriminate. All companies can take advantage of platforms like Office365 without making major changes to their business models or needing to make heavy investments in internal staff.

For both small and big businesses, we can adopt a policy of protecting data right from the consumption. For example, when collecting customer data we should encrypt and store right from the CRM portal instead of encrypting the data from a staging layer or worse encrypting only while storing in the data warehouse. In short, data protection should be considered while architecting a system and should not be a post-process thought. In current environment, we have multiple tools that have out-of-the-box features which will provide multiple options to secure your data.

In theory, this should be the ideal policy to audit and log every data access and how much data were accessed. While implementing the solution we will come across an issue called "performance". So, we have to balance our implementation of audit logging so that it will not affect customer experience.

Employees are the best line of defense. Train them. Make the education and training program and track the level of participation. Provide time for the employees to take the training. Follow up with managers when employees fail to take the training.

Leaders should empower all employees to defense the business. Leading by example and ensuring solid training is given as well as open communication regarding data security and governance.

To enhance data security, incorporate a white-hat hacking service internally to assess current security procedures regularly. Conduct surprise tests, including both technical and physical hacking evaluations, to gauge the organization's vulnerability and protection levels.

As everyone contributed that Governance and Security policies should be part of the enterprise culture, whether big or small. I understand that for small organization, sometime it is not financially feasible to invest in Data Governance products which are available in market but that should not deter companies to define DLP policies and standards. In one of my client, we have defined governance policies and standards using excel, so that at least stakeholders are aware of the DLP policies, data retention policies and security standards followed by the company.