Why the future of security is data-centric

Nowadays, you will be hard-pressed to find a company that does not understand the importance of digital security. With departments ranging from distribution and logistics to marketing, engineering and design all relying on digital tools to gather information and perform their tasks, data has never been produced in such large quantities and at such speed. Such amounts of information coupled with ubiquitous internet is a match made in hacker heaven and with new breaches made public every day, security has moved up on businesses’ priority list, becoming a top concern.

However, a traditional security strategy, usually aimed at in-house IT infrastructure that includes firewalls, antivirus software and access control, is no longer a guarantee against breaches. Technology has given the work environment a degree of never before seen dynamism and flexibility. This inevitably means that it is easy for data to slip through traditional security precautions. Among them, the rise of BYOD, mobile technology and remote work as well as an increasing reliance on cloud and third-party services, have lead to data continuously leaving the security of in-house networks and entering vulnerable environments.

Even more so, companies have started losing control over the applications and services their employees use to communicate and share information. IT departments slow to respond to employee demands have caused the growth of shadow IT which implies the use of unauthorized third-party applications or self-built solutions to solve everyday problems.

Looking at security from the point of view of data

It is, therefore, becoming increasingly difficult to predict information’s detailed itinerary or control what employees do with it. A new, data-centric approach to security has emerged as a viable alternative for companies looking to secure their data against outside threats and insider negligence.

What data-centric security essentially means is that the focus shifts from networks and in-house IT infrastructure to the sensitive data that needs to be protected within it. When the size of a whole system cannot be accurately ascertained, it is easier to identify and protect crucial sets of data.

In a data-centric approach to security, companies need to first define what sensitive data is to them. This can be described differently depending on the industry, but things like personal and financial data that is protected through various regulations are often among the data flagged as sensitive. Once they have established the policies that define sensitive data as such, companies are ready to start building their data-centric security.

Data-centric security in practice

Data-centric security implies a new way of looking at sensitive data, by taking bigger care of how it is handled and distributed. This is often not enough. While rules, regulations and personnel training can help employees become more aware of what is acceptable and what isn’t in terms of sensitive data management, one cannot rely on their full application. Often through negligence or the need to cut corners to meet deadlines, employees can be tempted to bypass such regulations in the hopes that nothing will happen and their work will be thus completed faster and more efficiently.

While training is also an important part of data-centric security, it is imperative that companies use all the tools at their disposal to secure sensitive data. Encryption is one way in which companies can ensure that their data, whether at rest or in motion, is secure. In this way, even if breaches occur or data is transferred outside the network, it continues to be secure and inaccessible to third-parties without the proper keys at their disposal.

Another way to control data within and outside a network are Data Loss Prevention solutions. Designed with data protection in mind, DLP software such as Endpoint Protector, allows users to efficiently control data from a control panel, by transforming company policies into rules and definitions, based on which, sensitive data can be blocked from transfer, deleted when found on unauthorized endpoints or automatically encrypted when transferred onto USBs and other portable devices.

Data Loss Prevention solutions also support companies in the process of auditing and reporting, by providing accurate information concerning the movement of sensitive data that can be saved and then presented to authorities inquiring about their compliance with various regulations.

With the enforcement of data protection regulations, companies are starting to be held accountable for the security of sensitive data. They can no longer afford to hope that by securing their network they also protect the sensitive data within it. It is important that sensitive data be discovered, classified and special rules applied to it to ensure its protection. That is why a shift to data-centric security seems not only inevitable, but necessary.