Getty Images
What are some tips for storage of sensitive data?
Loss or theft of sensitive data can lead to legal, compliance and business consequences. Be sure to take proper precautions to securely store that data.
Most organizations generate data that, if lost, could be detrimental to business operations, reputation, financial security or competitive position. This is generally considered sensitive data, and its mishandling can lead to business or legal repercussions.
Organizations must protect this sensitive data. Take proper storage precautions to prevent unauthorized access and data loss, theft or ransom.
The following summarizes three main types of sensitive information:
- Personal information. Sensitive personally identifiable information is linked to an individual. If unproperly disclosed, it could result in harm to that person. Examples of personal data include Social Security numbers, credit card numbers, bank account data, medical information and passports. Identity theft is a major business, and organizations must aggressively address it through activities such as multifactor authentication (MFA) and data encryption.
- Business information. This kind of sensitive data can include trade secrets, M&A plans, financial data, and supplier and customer information. Protection of corporate data from unauthorized access is a major part of corporate security.
- Classified information. Usually associated with government entities and military organizations, access to and use of this data are restricted by levels of sensitivity. These levels, from least sensitive to most sensitive, are restricted, confidential, secret and top secret. Changes in classification may be necessary if the sensitivity of the information changes.
Where sensitive data can be stored
Storage of sensitive data can be on virtually any viable storage media, ranging from HDDs to SSDs, if organizations take proper protection measures, such as encryption. When considering the type of storage medium for sensitive data, several factors must be considered:
- The storage media type and unique risks. Examine the risks associated with the storage media in terms of the sensitive data applications. HDDs, SSDs, RAID and tape storage are all fundamentally secure media options, provided users take the necessary precautions to secure each device from theft, physical damage and unauthorized access. For example, take actions to prevent drive failures and ensure tape storage is in a secure facility.
- Accessibility of sensitive data. Based on how the sensitive data is used and how frequently it will be accessed, the application must be clearly defined and, if possible, documented as part of a data protection policy. For example, frequently used sensitive data is best stored on a high-speed medium, such as an HDD or SSD. If the storage media are in a data center, they are much easier to monitor for security and unauthorized access than if the storage media are in a cloud environment.
- Location of the data. User requirements and internal policies for sensitive data may determine where the storage media is physically located. Frequent access may suggest an on-site storage location versus a remote-based cloud. Infrequent access to sensitive data is better suited to tape storage, especially if the tapes are stored in a secure, environmentally friendly location.
If sensitive data is stored in a cloud storage service, it is the user's responsibility to ensure that the data is protected from unauthorized access and possible compromise, such as through hacking. The cloud vendor may offer its own data protection measures, but the user has the ultimate responsibility for protecting the data. Check with cloud storage vendors on how they securely store data in the cloud.
In some cases, it may be necessary to establish sensitive data storage parameters based on complying with GDPR or other data protection standards and metrics.
Techniques to protect and store sensitive data
There are a variety of different ways to hedge against the associated risks of storage of sensitive data:
- Document sanitization. Use document sanitization to delete metadata from sensitive data, and then encrypt and securely store sensitive data that is free of metadata. Metadata adds information to data that facilitates the processing, categorizing, sharing and reuse of data. Unauthorized access to metadata can pose a significant risk to businesses, as metadata may contain sensitive data about the author, characteristics or contents of sensitive information.
- MFA. Manage access to sensitive data through a variety of controls, including the use of multiple types of authentication, such as passwords, tokens and biometrics, including a thumbprint or retina scan.
- Data encryption. Sensitive data at rest or in transit can be encoded with special character sequences to make it difficult to access based on the encryption algorithm.
- User training on protecting sensitive data. While technology may be the primary method of protecting sensitive data, it is important to educate users on proper techniques for securing that data.
- Data masking. Data masking creates a similar but inaccurate version of sensitive data that can protect the actual data and maintain a functional substitute for protecting the real data. This can make it increasingly difficult for malicious actors to reverse-engineer and locate data.
- Data deletion policies. Sensitive data, at some point, may no longer be considered sensitive. When data is no longer sensitive, organizations must decide whether to retain or dispose of that data. From a legal or regulatory perspective, for example, it may be important to archive previously sensitive data for its historical value or content that could be useful in litigation or audits. If newer sensitive data supersedes the older data, the organization may delete or destroy the previous data.
