According to a study by the IT industry association Bitkom, spending on IT security is currently at an all-time high. Revenue growth of 2022 percent is expected for 9,9 and average annual growth of 2025 percent until 5,9.
A development that was driven by the need to work in home offices due to the pandemic. Increasing cybercrime, the use of cloud computing, the rapid spread of mobile devices and the different technologies and applications are forcing companies to protect themselves against more and more IT risks. However, the effectiveness of these measures is increasingly measured by the extent to which they can guarantee the security of company data without gaps.
Increased compliance requirements
The progressive digitization of business processes and the increased compliance requirements, which can result in severe penalties in the event of violations, make data security of central importance for smooth business operations. A requirement that a classic infrastructure-oriented security approach alone cannot guarantee. Companies are therefore striving to better adapt their IT security strategy to the processing chain of their data. As a rule, this approach means a rethink for companies, since a data-centric perspective differs significantly from the traditional, infrastructure-centric perspective. In addition, there are a large number of networks, applications and logins in home office scenarios, which poses further challenges. Risks that are often overlooked when developing a data-centric security strategy typically involve the following four factors:
1. Control over data usage
Many organizations use identity and access management, mobile device management, and/or data loss prevention (DLP) solutions to monitor and control their employees' access to data. However, there is a risk that data could leak out in other ways that remain undetected by these mechanisms. Companies must evaluate in detail which scenarios are conceivable outside of their measures and how these can also be integrated into the control.
2. Limited Transparency
Companies cannot completely trace where sensitive data is located. Modern businesses need to regularly share files containing sensitive information, and the visibility of that data once it leaves the organizational environment is beyond the capabilities of most monitoring, auditing, and tracking tools. As a result, the information contained cannot be tracked or verified without additional data-oriented technologies.
3. Shadow IT and the human factor
The quality of data protection measures is strongly influenced by user behavior and the user-friendliness of IT processes. For example, if employees find some of the company's applications too cumbersome for their workflows, they look for ways to get to their goals faster and easier. Storing sensitive data and unprotected documents on a USB stick or in private public cloud accounts are just some of the ways employees bypass security mechanisms to do their jobs more conveniently.
4. Long response time
The combination of user behavior and a lack of transparency and control leads to another factor: How long does it take before a data loss is discovered and effective countermeasures can be taken? Depending on the effectiveness of the IT security strategy, this period of time can range from minutes to years in companies. Gaps in security policies and processes as well as outdated security concepts mean that many companies' data security programs simply no longer function reliably.
Establish data-centric security
Michael Kretschmer, Vice President DACH at HelpSystems (Image: HelpSystems).
To effectively address these factors, security teams need to develop an approach that complements their infrastructure-based security measures and works at the data level. A data-centric approach to security consists of solutions that collect, manage, and protect sensitive data, whether stored on-premises or in the cloud. It starts with data classification, followed by robust automated policy enforcement, strong encryption, and tight access controls.
Once the data is classified, email security and DLP solutions can incorporate these specifications into their automated processes. Managed File Transfer (MFT) solutions ensure that files identified as sensitive and sanitized are protected in transit and at rest. Centralized enterprise-level technology can simplify, integrate, and move data anywhere, securely, quickly, and across environments and applications with key encryption and automation capabilities.
Secure data exchange
Combined with content analysis and adaptive DLP, file sharing with MFT enables secure data exchange. Regardless of where files reside, data-centric digital rights management software encrypts and controls access to sensitive data to ensure access, use, and intellectual property protection inside and outside the organization. The basic data classification applied at the beginning automatically triggers the enforcement of data-centric policies up to the final deletion of the data.
Security managers can use it to continuously track the status of data in the company and, if necessary, immediately block access to accidentally released data. Employees can work together without restrictions at a high level of security and transparency, which eliminates the risk of shadow IT in the company. By integrating data-centric guidelines and measures, companies can harmonize their IT security concept and make it more resilient overall.
More at HelpSystems.com
About HelpSystems
HelpSystems is a software company that helps organizations Build a Better IT™. With the provider's cybersecurity and automation software, companies can simplify critical IT processes and create security with ease. HelpSystems delivers solutions based on good technology design: high quality, a superior user experience and the ability to improve performance.