You Have Big Data, Or Perhaps Just Too Much Data?

There is more data available to organisations today than ever before. In 2015 alone, customers, employees, and other users created about 7.9 zettabytes of data globally, and that number is expected to reach 35 zettabytes in 2020.

The type of information that companies are collecting is also multiplying, from traditional sources such as customer mailing addresses and phone numbers to more advanced demographics, web histories, shopping preferences, and even biometric data.

Advances in technology, computer power, and analytics mean companies can collect and process data in almost real-time. This may lead executives to believe that the more data they have, the greater their advantage. However, collecting a virtually unlimited amount of data can create a serious threat for organizations, because the amount collected often outstrips the ability to protect it.

In fact, when CEB surveyed 54 information risk executives around the globe in 2015, more than three-quarters of them indicated it is harder, or significantly harder, to prevent data breaches than in the past.

If a company does have a data breach containing certain types of sensitive personal information, such as social security numbers or health records, it can trigger additional burdensome legal duties and invite increased regulatory scrutiny, not to mention potential reputational damage.

The simplest way to protect sensitive data is not to have it in the first place. But companies drawn in by big data's tantalizing promises often collect too much information in the hopes they will find the time and resources to analyze it later.

Worse, companies often keep data long after its usefulness has passed. Ultimately, there's a difference between big data and "lots of data," and organizations need to regularly evaluate how they use data and set clear guidelines for what they collect and store.

Assess the Value of Data You Collect

Assessing and evaluating the true value of data, and the potential risk of a breach, will help IT leaders set their data strategy and avoid collecting too much. But IT can't do it alone. Creating a sensible data management strategy requires input from stakeholders across the business.

CIOs and other IT leaders charged with managing and protecting data can get the conversation started by asking these six questions:

1. What is the business need for the information we collect? Too often, companies use a "collect now, analyze later" approach, thinking that more information is better. Instead, leaders should carefully consider how the information will help them achieve their corporate strategy and performance objectives.

2. Do we have the capabilities to use the data effectively? In addition to understanding the data's value, leaders need to evaluate whether their teams have the skills and capabilities needed to collect, manage, and analyze it. Analytic capabilities required to use and apply information in decision making are rare. Without a capable team of analysts and data experts ready to turn data into insight, it may sit untapped, or worse, be misused.

3. How would the public react to the information we collect and how we use it? Merely because companies can lawfully collect an enormous amount of customer and employee data doesn't mean they should. Leading companies are working to better understand how customers and employees feel about providing personal data. They weigh the data's potential value against the potential reputational harm from the public knowing the information is being collected, in order to decide whether to collect it.

4. What information do we need to protect, and at what level and at what cost? Keeping all company information secure is important, but certain types of information like credit card and social security numbers require heightened protection under specific privacy laws or regulations. Losing such sensitive information can turn a data breach into a full-blown privacy failure. Companies need to address and classify these types of information and understand the oversight and compliance costs to retain them.

5. How long should we keep sensitive data? As business changes, previously collected data can be forgotten. Leading companies incorporate the data they collect into their records management policies to ensure the data does not exist indefinitely. Establishing data's shelf life is a critical step in minimizing the risk of a costly data breach involving low-value data.

6. Who needs access to the information? Given the multitude of ways to use data, many employees will need access to collected data or to the results of its application. A comprehensive understanding of who will be working with the data can help prioritize risks and pinpoint potential breach points. When determining this, leaders should identify which functions will handle the data, how they will use it, and who might need continuous (as opposed to one-time) access. Take steps to ensure employees who don't need access to sensitive data don't have it.

Information drives many aspects of corporate performance. That said, failing to secure data, lingering reputational harm. IT professionals have had a role to play in helping their companies adequately assess and evaluate the true value of their data and the potential risk of a breach in order. The best way to do this is to set a successful data strategy and to avoid collecting too much information.

InformationWeek

 

« FBI: Don’t Pay Bitcoin Ransomware
Special Report: CEOs And IT Innovation (£) »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Identity Automation

Identity Automation

Identity Automation is a leading provider of Identity and Access Management software.

Bricata

Bricata

Bricata offers industry-leading IPS solutions for enterprise-wide threat prevention and unparalleled situational awareness.

AFCERT

AFCERT

AFCERT is the national Computer Emergency Response Team for Afghanistan.

Cyber Exchange

Cyber Exchange

Cyber Exchange provides a focal point for UK organisations connected with, or with an interest in, cyber security to connect, engage and collaborate.

Immersive

Immersive

Immersive unifies Cyber Drills, Exercises, Sims, Ranges, and Training into one single, adaptive platform. One Platform. Total Cyber Resilience.

CERT NZ

CERT NZ

CERT NZ supports businesses, organisations and individuals affected by cyber security incidents, and provide trusted and authoritative information and advice.

Cryptsoft

Cryptsoft

Cryptsoft provides key management and security software development toolkits based around open standards such as OASIS KMIP and PKCS#11.

Eclypsium

Eclypsium

Eclypsium protects organizations from the foundation of their computing infrastructure upward, controlling the risk and stopping threats inside firmware of laptops, servers, and networks.

Norwest Venture Partners (NVP)

Norwest Venture Partners (NVP)

Norwest Venture Partners offer entrepreneurs a broad range of services to help them build their businesses at every stage of growth. Key sectors include AI, Infrastructure, SaaS and Security.

Cyber Defence Solutions (CDS)

Cyber Defence Solutions (CDS)

Cyber Defence Solutions is a cyber and privacy Consultancy with extensive experience in the development and implementation of cyber and data security solutions to your assets.

Skudo

Skudo

Skudo is dedicated to creating innovative best-in-class solutions that protect data exchange with the highest level of security and privacy.

Conversant Group

Conversant Group

Conversant Group is an IT infrastructure and security consulting company, providing technical, organizational, procedural, and process consulting internationally.

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV)

Inflection Point Ventures (IPV) is a 6000+ members angel investing firm which supports new-age entrepreneurs by connecting them with a diverse group of investors.

RevealSecurity

RevealSecurity

RevealSecurity's TrackerIQ detects malicious activities in enterprise applications.

Cenobe Cyber Security

Cenobe Cyber Security

Cenobe provides customized solutions to keep you ahead of potential threats and ensure the security of your organization's systems and data.

SecuRedact

SecuRedact

SecuRedact is an AI-powered tool to detect and pseudonymize personal data in text and images. Fast, local, secure, and free to try.