The exponential production of data and the accelerated opening of Information Systems are opportunities for theft and compromise
As things stand, few organizations have adopted a “data-centric” approach that allows for comprehensive mapping and effective data governance. As a result, knowing what data needs to be protected and how to secure it on a long-term basis is very complex.
Data protection requires the implementation of several solutions that can vary significantly between companies.
There are two possible approaches to starting a comprehensive data protection project: either through risks and data classification or from the perspective of technological measures.
The first approach consists in leaning on business-line risks and their Cyber corollaries in order to map sensitive data. Once this inventory is completed, we can define a project strategy and identify the measures to be implemented. Now, while this approach has the advantage of being well suited to business-line challenges, it can sometimes lead to a tunnel effect with large companies.
The second approach consists of starting from the technical aspects by identifying the potential leakage points covered and not covered in order to agree on a strategy to be adopted to protect the entire system. This approach is more suitable for companies looking to make rapid headway on technical aspects.
In all cases, it is important to keep in mind the data life cycle (namely, Data in Use, Data in Motion and Data at Rest) to carry out an exhaustive mapping of risks and means. Data in Use refers to data that is accessed or used at a given moment, for example a user opening a Word file on a drive. Data in Motion refers to data that passes through the network, whether internal or external. Data at Rest concerns data stored on an infrastructure or media. A given sensitive data item (credit card number, for example) must be secured throughout its entire life cycle.
Structured data, unstructured data, smartphones, laptops, email, cloud drive… all examples of elements to be taken into account as part of a global strategy. In fact, there is really no point in focussing on a single type of data nor on a single medium since this is likely to move around within the information system.
Drawing on our 10 years of experience in these issues, we master the different risk scenarios as well as the majority of technological responses.
In addition to the solutions available on the market, Synetis offers an exclusive approach with GO-Encrypt, the result of several years of collaboration with PrimX and Yubico.