Security Briefing Wrap-Up: Data Protection for Software and Technology Companies

In this month’s live Security Briefing, we focused on the unique data protection challenges that software and technology companies face and presented how Data Loss Prevention (DLP) tools can help ensure the security of sensitive information.

https://youtu.be/kH2I4_9fhrY

Our Security Briefings are open discussions with experts and guests from across the industries who share their expertise about data security topics.

This time our speakers included Tim Deluca-Smith (Chief Marketing Officer at CoSoSys), Chris Roney (Senior Strategic Account Executive at CoSoSys), and Ryan Ivis (Manager of Security Architecture at Ping Identity). They have discussed the hot topics facing data protection for software and technology companies, such as tackling the risk of insider threats, preventing accidental data loss, and data compliance breaches.

Key insights from the Security Briefing

Here are some of the most important highlights from the Security Briefing.

The multi-OS challenge

It’s pretty common for software and technology companies to have multiple operating systems. As such, they need to address this diversity in their security tools as well. This means they need tools that work perfectly across all devices and offer the same security features for every OS.

“Once you have Windows, Mac, and Linux, that changes everything. This means you need a DLP for all of these operating systems. Not something that has some features for Windows and some features for Macs; you need the same security capabilities across the whole company regardless of the operating system,” – Chris highlighted.

Ensuring that data is protected on every operating system is especially important since software and technology companies work with various sensitive information, including customer PII and intellectual property such as source code. They also need to meet compliance requirements of data protection regulations like the GDPR.

Data breaches bring high costs for tech companies; according to the Cost of a Data Breach Report 2021, technology companies are in fourth place in the average total cost.

“The principal contributing factor for the actual cost of the breach is simply the time it takes to identify it: it’s a slow drip,” Tim explained.

In many cases, breaches are caused by insiders – whether malicious or negligent. Companies also need to be aware of the latent threats that employees represent.

“It’s not data is being exfiltrated, it’s not an immediate breach, but there’s potential. Why is that data moving there? Why do we have PII at rest on this user’s machine? He hasn’t tried to remove it, but it probably shouldn’t be there,” Tim added.

DLP is not a product; it’s more like a journey

And this journey is different for every company.

“DLP is not something that you purchase and push a button; it’s something that you have to get familiar with, and you also have to understand your use cases,” Chris explained.

Security engineers need to understand the software’s core capabilities and utilize them strategically. In the case of DLP, having visibility into sensitive data and the ability to detect things that are not malicious in nature are two important benefits.

“There’s a lot of unintended data motion in an organization that isn’t malicious in nature. Being able to help your employees by coming up with a better strategy and building security in earlier is one of the main things I look at DLP from an endpoint perspective,” Ryan added.

Gaps in data protection and how to fix them

Remote and hybrid work environments have changed the way we work and introduced new security threats.

“We’ve seen a lot more organizations coming to us since the post-pandemic world and the adoption of the hybrid work environment. This is because it started to shine a light on gaps in organizations’ security stack,” Tim mentioned.

With the increased use of collaboration apps, with devices that can go offline – many businesses realized that their security tools leave gaps in their data protection.

“A lot of companies realized that in the post-pandemic world network DLP is not that important; everybody brings their computers home, they are accessing multiple different internet networks, and so on,” Chris explained.

But what happens on the endpoint matters more than it has ever done.

Companies need to know the exit points for sensitive information and understand what triggers alerts instead of focusing only on where sensitive data lives.

Organizations, especially in the software and technology industry, need to rely on multiple best-of-breed tools.

“Zero Trust is the new norm. We are moving towards a model where there’s identity validation, there’s device authentication, and there’s device policy. All enacted to gain access to data,” Ryan highlighted.

Companies also have to be aware of the core capabilities of their tools and have an integrated security stack.

“Having a DLP tool that’s easy to use and has a short learning curve is extremely advantageous these days because things are moving very quickly, and you want to be able to enroll people quickly,” Chris explained.

The rollout of a DLP solution should be systematic. It’s practical to have it in monitoring mode in the first few months and then make changes thoughtfully and strategically.

“The cultural implementation of DLP has to be done very carefully, especially at tech companies. Use the opportunity for data collection, and start to build analytics first. DLP could feel intrusive, and it’s important to show its value and make executives see that”, Ryan concluded.

Watch the recording and learn more about data protection best practices for software and technology companies.