Millions of people are unaware of and uninformed about how their personal information is being used, collected or shared in our digital society. Data Privacy Week, an international effort to empower individuals and encourage businesses to respect privacy, safeguard data and enable trust, takes place January 24 – 28.
Data Privacy Week aims to inspire dialogue and empower individuals and companies to take action.
To help kick things off, VMblog spoke with various cybersecurity experts from ReliaQuest, Raytheon Intelligence & Space, Ground Labs, AT&T Cybersecurity, Netskope, DeltaNet International, Noname Security and Sailpoint.
+++
Joe Partlow, CTO of ReliaQuest
“While honoring data privacy is a critical piece of the puzzle when it comes to maintaining effective security posture, it means nothing if enterprises don’t have proper visibility across their security tools. In fact, only 13% of security leaders say they have greater than 75% visibility across all security tools. What makes this even more challenging is organizations maintain an average of 19 different security tools, with only a less than a third of those being vital to security objectives. The lack of enterprise-wide visibility, combined with the sheer number of tools, puts organizations and their customers at a greater risk for data breaches and cyberattacks. Security leaders and teams need to constantly be pushing to get visibility into all their corporate data sources while avoiding including any sensitive data into the logging and security tools. Enforcing data privacy and protecting user’s sensitive data, while mitigating the risk of not having complete visibility into the environment, is one of the top challenges for most security teams.”
++
Tom Richey, Vice President, Requirements and Capabilities, Cybersecurity, Intelligence and Services at Raytheon Intelligence & Space
“There’s a growing scale, pace and complexity to security breaches. Data is becoming one of the most valuable resources malicious actors steal. Attack strategies are becoming more sophisticated and vulnerable surfaces are expanding due to the digital transformation taking place in the world. There are over 10 billion active devices on the internet a day, with zettabytes of information existing in the modern world. We must ask if companies know where all of their sensitive information lies. Many companies recognize that they do not need more end-point protection devices, but rather a comprehensive understanding of where their data resides. Not only are scanning tools and software with sensing capabilities more cost-effective to invest in, they also give organizations and countries the ability to see where compromised attack surfaces are so they can build a system that is agile and adaptive in order to respond and recover quickly to data breaches.”
Torsten Staab, Principal Engineering Fellow at Raytheon Intelligence & Space
“Your company’s data privacy strategy starts with employees. Employees are the first people in contact with client records and are often communicating with various vendors, internal teams and stakeholders. Regardless of an employee’s intentions, training or seniority at a company, anyone could be a data privacy and security risk to the organization. Are insiders able to steal trade secrets? How quickly can malware such as Ransomware be detected and stopped? Can a single user or a compromised device bring down your entire enterprise? These are the questions a Zero Trust strategy forces an organization to examine and potential scenarios to prepare for. Multi-level Zero Trust security platforms are designed to provide the necessary fail-safes to protect users and their data, devices, networks, and applications from continuously evolving internal and external cyber threats.”
++
Stephen Cavey, Co-founder, Ground Labs
“I recommend organizations take a two-pronged approach to show their customers they take data privacy seriously.
We find many organizations who suffer a data breach lose data they weren’t fully aware of in the first place. Therefore, the first step to help safeguard consumer information is to understand where all data resides. To achieve this, I recommend using a data discovery scanning tool as a rapid approach to identify and subsequently remove these high-risk unknowns. It is essential for businesses to take ownership when it comes to data privacy and protection – that includes knowing the location, amount and type of information being stored by your company.
Data privacy is a call to action for businesses – and the responsibility is in your hands.
Secondly, your business should embark on a mission of reducing the data it collects from customers to that which is absolutely necessary to deliver your product and service. For example, is asking for gender essential to delivering your service? Ever since the Cambridge Analytica data scandal, consumers are now more than ever aware of providing their data and are easily alarmed when organizations begin to ask for excessive personal information. I believe business leaders have an obligation to be transparent and ethical with the data they collect which is a key step towards building trust. By reducing the data collected and promoting your commitment to responsibly handling and protecting the customer data you do collect, you’re showing your current and future customers that your organization is worthy of their trust and ultimately, their future business.
Take heed of how you treat and ensure data privacy – not only this week – but every week of the year. Proper data handling not only protects consumers from potential negative outcomes but also your business from regulatory fines, compliance breaches and reputational damage.”
++
Bindu Sundaresan, director at AT&T Cybersecurity
“Building trust with customers and third-party vendors is critical to an organization’s success and can only be achieved with an offensive approach to data security and data privacy. Given that businesses today use multiple suppliers, shared networks, cloud applications, and, in some cases, work with multiple vendors, one of the best approaches to enable data privacy and security is through data governance. It is about designing and implementing the norms, rules, and infrastructure that will foster trust by shaping the way people, organizations, and governments can legitimately collect, use, and share data to create sustainable value that is realized equitably. Data governance programs effectively support privacy management by giving organizations a clear look into what data they have, where it is stored, how it is used, and who it’s shared with – also allowing compliance with the current privacy laws and regulations.”
“The common denominator for a more effective security strategy is data governance. With it, organizations have a wider lens through which to monitor all of their data and its activity, protect data throughout its lifecycle and build a data privacy and security strategy that is better prepared for the evolving threat landscape. As organizations work to build customer-focused, digital business models, it’s critical to consider the role of trust and privacy in the customer journey. Delivering digital trust isn’t a matter of publishing a highly secure website or app, or avoiding a costly, embarrassing data breach. It is about creating a digital experience that exceeds customer expectations, allows frictionless access to goods and services, and helps protect customers’ right to privacy while using the data they share to create a customized and valuable experience. Today’s security strategies are, in large part, still responding to yesterday’s challenges. From reports of exposed personal information to data misuse, trust incidents are becoming increasingly visible to the public.”
++
James Christiansen, VP, Security Transformation, Netskope
“Prior to the pandemic, businesses only had a handful of remote workers signing in to the corporate network. Things have changed since then. By 2025, it’s expected that 22% of the workforce (36.2 Million Americans) will work remotely. With this shift, the need for “Zero Trust” today has evolved since the term was first coined, and is much broader than the idea of going from “zero” to “full trust.”
For organizations to provide effective data protection in today’s privacy first era, it’s more than just not trusting authentication because the user isn’t on your network any longer. Organizations should assume the devices they’re running, applications they’re using, and networks they’re traversing are vulnerable. The attack surface has broadened because of the rising volume of data that now resides in the cloud. This not only increases opportunities for cyberattacks, but it also complicates data security and regulatory risks.
Understanding data flows, as required under many of the privacy regulations, requires constant discovery of cloud services and the ability to “geofence” data so it doesn’t cross international borders. A strong data protection program is required to be able to inspect the traffic, determine if it is regulated data, and then enforce restrictions to stay compliant with the laws.”
++
Jason Stirland, CTO at DeltaNet International
“Data Privacy Day is a yearly reminder for organizations of the importance of compliance. Data plays such a mission-critical part of an organization’s infrastructure that they must make it their utmost priority to ensure that cybersecurity procedures are in place to safeguard data from getting into the wrong hands.
Ultimately, all stakeholders care that their data is protected – employees, customers, or partners. For organizations to build and maintain that trust, they must embed a culture of compliance with data protection throughout the organization. This culture involves closing knowledge gaps by educating and regularly refreshing data protection or GDPR training with everyone in the business.
Every employee has a part to play in maintaining compliance with data protection regulations. Through training, organizations can avoid any financial and reputational sanctions aligned to non-compliance. With hybrid working here to stay, organizations must ensure the infrastructure is in place to protect data, which is accessed while an employee is working remotely – and employees understand how careless activities could result in a data breach to prevent it from happening. Using varied techniques such as gamified and scenario-led training – allows employees to consider the best practices with data protection.”
++
Val Dobrushkin, Security Risk Officer, Global, Noname Security
“Securing APIs is a top priority for many organizations in 2022; however their privacy implications deserve closer examination as well. Every application and device connects or communicates with an API making them the cornerstone in the data-sharing machine. Today an increasing number of services provide APIs that give other third parties, such as advertisers and app/website developers, direct or indirect access to data about a service’s users. Companies leverage these insights to better target potential customers with relevant ads; however it raises concerns about how user data is being stored, who can access it and how easy it is to access.
To ensure this data remains private and secure, businesses should implement proper authentication and authorization protocols. Implementing protocols that limit the access that third-party apps can gain from an API can help prevent too many parties from accessing and sharing the data too much. Consumers on their end should, as always, consider what companies might learn about them via the information they provide, both directly and indirectly, and their online activity.”
++
Heather Gantt-Evans, CISO, SailPoint
“Collectively, are we on the right side of history with data privacy? I would argue not yet. We are going to look back at this era as if we were data barbarians. In our increasingly “Ready Player One-Esque” environment, we must set aside time to think about our privacy and how to protect it. Organizations need to communicate clearly how collected data is used in order to provide value back to the customer, how it is protected, and clearly articulate customer privacy options. This can be particularly challenging for data involved in proprietary machine learning, but algorithmic transparency demonstrates that an enterprise is conscientious about data privacy. This includes Disney, who recently agreed to privacy changes for children’s apps, effectively removing tracking software for targeted ads. In addition, companies should seek to embed customer privacy as one of their core values and communicate this value as part of their customer-facing messaging. Let’s usher in a new phrase, ‘the customer is always right secure.'”
##
