How to identify and protect high-value data in the enterprise

Identification

The definition of high-value data is not one size fits all, as we all define our data differently. When considering what high-value data is versus what is just regular data, it is important to take a step back and use a holistic, risk-based approach; classify your data based on what can impact you the least to the most.

Consider adding a few flavors to your data classification formula, such as the value of the data, the consequences of the loss or exposure of that data, the likelihood of occurrences and risks to enhance your data classification, and also ensure that you are measuring and defining your data on a consistent basis.

Using the above approach and examples, take a deep breath and two steps back. Close your eyes and list a few data assets around you. Classify them inside your head, spin it a few times and then write them down.

Make sure you are not trying to capture all of the data at once, as doing so can be a dangerous move and will probably overheat your brain; limiting your scope is the key. Align it to your needs and realize that allowing your behavior to adapt on the basis of the new data classification approach is the most important first step before embarking on a bigger mission.

Protection

Protecting your high-value data can be very tricky at first, as our minds are programmed to protect our high-value data as much as we can. We must trick our minds into believing that the safeguards we have implemented are 100% secure. This approach comes with a few side effects; for example, the money you invest to protect the data shouldn't be greater than what the data is actually worth, as this can give you a false sense of security.

Have an attacker's mindset and put yourself in their shoes to solicit feedback and ideas.

Before you start investing in safeguards to secure your high-value data, take a closer look at the data you are looking to protect. Peel it back and understand the elements and threats surrounding it. Have an attacker's mindset and put yourself in their shoes to solicit feedback and ideas.

Once you have gathered all of your facts, decide on the approach that makes the most sense for you. Here are some suggested principles -- dubbed H.E.A.T -- that you may want to consider applying:

• Hygiene: dirty hands, dirty environment. Reusing passwords or secrets should be avoided, as should simple passwords and easy self-service questions, especially when that information is readily available on the internet or social media.
• Eyes on the glass: log, track and There is no silver bullet to keep attackers out of your life, and it is not possible to be 100% secure -- just having deterrents or prevention control is not enough. Team up with a few others to minimize the damage by providing continuous visibility, attack context and alerts.
• Air gap solution: if data is easy for you to gain access to, it is probably easy for the attacker, as well. Create a balance between security and ease of access that you are comfortable with; for example, limit or split who or what should have access and knowledge of the data.
• Think like an attacker: once you adopt an attacker's mindset, you will have a better idea of how to handle your safeguard investment.

Conclusion

Protecting high-value data varies from one person to another. But you should apply the H.E.A.T principles, classify the data and identify all the possible threats before dealing with the how. While some data may be intangible, you should assess the mitigating costs and, if the costs are greater than the value of the data, you should think about whether it is worth safeguarding.