Today’s businesses rely heavily on data. Customers give it to them at every interaction, and they use it to improve efficiency, agility, and service levels. However, it’s becoming painfully obvious that the amount of data that businesses collect has made them a desirable target for cybercriminals.
That statistic implies that the average company is a target and that it is running out of time to defend its data. And it doesn’t have to be difficult to do so. To assist, here is a simple 5-step framework that businesses of all sizes can use to safeguard customer data.
Step 1: Examine and revise your data collection standards.
The first step for businesses to improve the security of their customer data is to examine what types of information they’re collecting and why. The majority of businesses that go through this process are surprised by what they discover. This is because, over time, the volume and variety of customer data collected expand far beyond the original intent of a company.
It’s common practice, for example, to collect a customer’s name and email address. And if that’s all a company has on file, they’re not going to be a tempting target for a hacker. However, if the company has a cloud call center or any type of high-touch sales cycle or customer support, it’s likely that they collect home addresses, financial data, and demographic information, which they’ve then compiled into a collection that’s perfect for enabling identity theft if the data is leaked.
As a result, when determining the value of each collected data point, businesses should ask themselves: what critical business function does this data facilitate? They should purge the data and stop collecting it if the answer is no. If there is a valid answer, but it is for a non-critical function, the company should weigh the benefits of the data against the potential harm they would suffer if it were exposed in a breach.
Step 2: Minimize Data Access
Following the reduction of the amount of data to protect, the next step is to reduce the attack surface of the data by limiting who has access to it. Because the theft of user credentials is the primary way that malicious actors gain access to protected systems, access controls play a significant role in data security. As a result, businesses must follow the principle of least privilege (PoLP) when it comes to both their data repositories and the systems that connect to them.
Minimizing data access also has a positive side effect: it helps to prevent data breaches caused by insider threats. Insider threats are expected to cause 31% of breaches this year, according to research firm Forrester, and that number is expected to rise. Businesses address both internal and external threats by keeping sensitive customer data out of the hands of most employees in the first place.
Step 3: Remove passwords from as many places as possible.
Businesses can make it more difficult for hackers to access customer data even after reducing the number of people who have access to it. That is, passwords should not be used as a primary authentication method whenever possible. It’s a small change that can have a big impact.
According to the Verizon Data Breach Investigations Report for 2021, credentials were used in 61 percent of all data breaches last year, whether stolen or not. As a result, it stands to reason that the fewer credentials to worry about, the better. There are a few things you can do to reduce your reliance on password authentication systems.
The use of two-factor authentication is one example. Accounts must have both a password and a time-limited security token, which is typically sent via app or SMS. However, using hardware security keys is a better option. They’re physical devices that control data access with unbreakable cryptographic credentials. Phishing and other social engineering attacks are significantly reduced when they are used. They’re the most secure authentication method available right now, at least until solutions like Hushmesh become more mainstream.
Step 4: Encrypt Data
While stolen credentials are the most common source of data breaches, they are far from the only danger. An attacker can always find a way to get around standard access control methods and gain access to customer data by exploiting a software flaw or other security flaw. Worse, such attacks are difficult to detect and even more difficult to stop once they’ve started.
As a result, ensuring that all customer data is encrypted at all times is the fourth step in any competent data security plan. This entails encrypting data as it passes through software, networking hardware and components that encrypt data, and a data storage system that encrypts data in transit. This limits the amount of data an attacker can access without credentials, limiting the damage in the event of a breach.
Step 5: Create a Data Breach Response Strategy
No matter how you look at it, there is no such thing as perfect cybersecurity. Attackers are always on the lookout for vulnerabilities to exploit. Many of them can be eliminated or reduced if businesses plan ahead of time. This does not, however, eliminate the possibility of a data breach.
As a result, developing a data breach response plan is the final step in the customer data protection framework. It should provide a road map for the company to follow in the event that an attacker gains access to customer data. The plan should include every detail, including how internal IT teams should respond, who should be the go-to 3rd-party security consultants, and how customers should be notified of the breach.
