Expert Tips for Improving Your Organization’s Data Security Posture

In a recent webinar, Parham Eftekhari, Executive Vice President at Cyber Risk Alliance Communities, and Steve Hindle, Founder of Achilles Shield and Chief Security Advisor at Spirion, delved into the critical topic of improving data security posture management.  

Here are the key takeaways and actionable items to strengthen your organization’s data security. 

1. Data Security Is Vital:  

• Data is integral to every organization, encompassing sensitive information about employees, customers, and intellectual property. Protecting data means protecting people and the organization’s integrity. 

2.  Data Security Posture Management (DSPM) Must be Understood:  

• DSPM is about identifying, managing, and securing data throughout its lifecycle. It involves knowing where your data is, how it flows within your organization, and implementing appropriate security measures. 

3. Data Governance Should Be Collaborative:  

• Effective data governance requires a cross-functional approach involving stakeholders from IT, legal, compliance, and business units. Establishing a data governance committee can ensure comprehensive oversight and accountability. 

1. Identify and Classify Data: 

• Start with What You Know: Begin by identifying data within well-known areas such as HR, which handles sensitive employee information. 
• Use Tools for Data Discovery: Leverage tools like Microsoft Purview and Spirion for data discovery and classification to map out data across your organization. 

2. Engage Stakeholders: 

• Form a Data Governance Committee: Include representatives from various departments to ensure a holistic approach to data governance. 
• Rotate Participation: Regularly rotate operational leaders in committee meetings to provide diverse insights and foster broader engagement. 

3. Implement Data Security Controls: 

• Adopt Comprehensive Security Measures: Implement identity and access management, encryption, data loss prevention (DLP), and data privacy operations according to comprehensive guidelines and frameworks provided by NIST. 
• Automate Where Possible: Use automation to handle repetitive tasks and monitor data security effectively. 

4. Educate and Train Employees: 

• Conduct Regular Training: Hold regular training sessions to educate employees about data security best practices and the importance of protecting sensitive information. Short on resources to build content? Check out courses from SANS. 
• Target High-Risk Individuals: Focus on individuals who handle sensitive data or are frequently targeted by phishing attacks. 

5. Measure and Report Success: 

• Set Clear Metrics: Define key performance indicators (KPIs) to measure the effectiveness of your data security measures, supported by research and insights on data security and risk management from Gartner. This can include the number of data incidents, response times, and compliance audit results. 
• Use Data-Driven Reporting: Present data-driven reports to stakeholders to demonstrate the impact and value of your data security initiatives. 

• Phishing and Social Engineering: As attackers become more sophisticated, ensure your defenses are robust against phishing attacks, which are often the gateway to more severe breaches. 
• AI and Automation: Monitor the use of AI and automation within your organization, as these can introduce new vulnerabilities if not properly secured. We recommend using guidelines, best practices, and alerts on current cybersecurity threats from CISA. 

• Leverage Your Network: Engage with cybersecurity communities, such as the CyberRisk Alliance CISO community, for support and knowledge sharing. 
• Reach Out for Help: If unsure where to start, seek assistance from experts and peers in your industry. 

By implementing these actionable steps, your organization can significantly enhance its data security posture, safeguarding sensitive information and ensuring compliance with regulatory requirements.  

Remember, the journey towards robust data security begins with small, deliberate steps. Engage with the cybersecurity community, leverage expert insights, and continually adapt to emerging threats.  

Take action today to protect your organization’s most critical asset—its data. 

Parham Eftekhari
Executive Vice President at Cyber Risk Alliance Communities

Steve Hindle
Founder of Achilles Shield and Chief Security Advisor at Spirion