How to prevent a data breach: 11 best practices and tactics

Building a data breach prevention strategy

Data breaches occur thanks to a variety of ever-shifting cyberthreats, ranging from ransomware and phishing attacks to accidental data leaks and insider threats. With that in mind, cyber hygiene practices and defense in depth -- the strategic use of multiple, overlapping security technologies and processes -- are key to prevention.

Below are 11 best practices that work together to prevent data breach attacks.

Editor's note: While incident response policies, tools and practices should also be part of an enterprise's overall security posture, the following tips focus on data breach prevention.

It's not difficult to convince business leaders that a data breach can cause tremendous pain.

1. Inventory all data sets and identify locations of sensitive information

To protect its data, a business must first understand what and where it is. Identify and classify types of data -- flagging confidential and sensitive information, such as intellectual property and personally identifiable information -- and establish policies for how to handle them securely.

Data protection strategies should keep pace with the ongoing addition, removal and movement of data through regular updates and reviews.

2. Strictly limit privileged access

Even when done with the best intentions, granting privileged access permissions to employees and contractors can get out of hand in a hurry and put confidential information at unnecessary risk. For example, customer data should be accessible only to those employees who need it to do their jobs. Establish and enforce policies surrounding elevated levels of access, with regular oversight. Privileged access management tools can help facilitate and enforce these policies.

3. Identify and patch vulnerabilities

Vulnerability assessments identify security weaknesses within an environment and prioritize them based on the risk they pose to the organization.

Regularly flagging and patching high-risk vulnerabilities is a critical part of preventing data breaches and should be a top priority for any IT security team. The number of known vulnerabilities continues to rise, and cybercriminals commonly take advantage of unpatched software to gain access to critical data.

4. Secure the network

Traditionally, the first line of defense against external threats is network security. This includes the use of firewalls, intrusion prevention and intrusion detection systems, access control lists and zero-trust network access. The goal is to enable business data to flow as needed, while stopping malicious hackers from gaining unauthorized access to it.

5. Secure endpoints

The implementation of endpoint security controls, such as malware detection software, has never been more important. Users and workloads have become highly distributed and often fall outside the protection of traditional perimeter security tools. With proper implementation and management, endpoint security can deliver exceptional safeguarding against common internet-based threats, such as web-based malware.

6. Limit lateral movement

If nefarious actors can successfully penetrate an organization's network security, their next logical step in the intrusion process is to figure out what other systems they can access and potentially infiltrate. Minimize data loss by limiting unsanctioned lateral movement with microsegmentation, which creates isolated network zones.

7. Encrypt data at rest and in transit

No matter where sensitive data is at any given moment, it should be encrypted to prevent anyone capable of accessing the data from reading it. Not only does this include encrypting data where it resides, but also when it is moving from one point to another within a corporate network.

8. Implement proper password policies

Modern password policies should be an absolute requirement for all applications and services running on an enterprise network. Examples of requirements and restrictions that support strong passwords include the following:

• Minimum password lengths.
• Mandatory use of uppercase letters, lowercase letters, numerical digits and special characters.
• Maximum number of password attempts before an automatic lockout occurs.
• Mandatory password changes every 60 to 90 days.
• MFA.
• Use of an approved password manager.

9. Monitor infrastructure using advanced security tools

Advanced network monitoring and threat detection tools help detect and block intrusions and prevent data breaches from occurring or spreading in real time. Behavior-based tools that use automation and AI, such as network detection and response platforms, detect user, network and data flow anomalies that indicate suspicious activity. These tools alert the appropriate IT security staff, who can then conduct further investigation and mitigation.

10. Conduct security audits

Security audits provide formal insight into how an enterprise's cybersecurity controls compare to industry standards and benchmarks. They can help organizations find and resolve problems before they become breaches.

11. Conduct cybersecurity training for employees, contractors and partners

No cybersecurity strategy is complete without ample security awareness training for all stakeholders who access and interact with sensitive corporate data, including staff, contractors and partners. It should come as no surprise that human error represents the biggest threat to data security and the most significant challenge in data breach prevention. Regularly train employees on data usage guidelines, password policies and common security threats, such as social engineering scams and phishing attacks.

If an organization's data breach prevention strategies and security measures fail, data breach response becomes necessary. With this in mind, every enterprise should also have a cyberincident response plan in place.

Finally, it's important to note that, while data breach prevention should be a top concern, organizations must balance it against other, sometimes competing, priorities. Each enterprise must, therefore, find the right, tailored mixture of cybersecurity policies and tools to align with its organizational risk appetite, minimizing the likelihood of a security incident, while maximizing business productivity. Only then will the organization have a data breach prevention strategy that delivers proper levels of protection, speed and agility.

Andrew Froehlich is founder of InfraMomentum, an enterprise IT research and analyst firm, and president of West Gate Networks, an IT consulting company. He has been involved in enterprise IT for more than 20 years.