By Moinul Khan, Vice President & General Manager, Data Protection, at Zscaler
In 2022, Gartner established its first ever Magic Quadrant for Security Service Edge (SSE), a new security industry category. SSE acknowledges that protecting a distributed digital business from malicious actors requires three integrated technologies: secure web gateways (SWG) to control internet access, zero trust network access (ZTNA) to control private application access and cloud access security broker (CASB) to fix misconfigurations and oversharing from cloud apps. The message is clear: data protection is not a stand-alone endeavour but should be part of a broader security strategy in which organisations should attempt to disrupt attacks at every stage. The ideal outcome is to block malicious actors outright. The next best thing is to mitigate attacks by limiting access and the ability to exfiltrate.
Protecting against malicious and accidental data exfiltration requires complete visibility into all encrypted data; both, while in motion and when at rest; along with a sophisticated DLP solution which can accurately identify, and protect it from exfiltration.
Consider following best practices to help you build a solid foundation when it comes to protecting your data, users and business from malicious or accidental data loss.
1.) Know your data: Before you can protect your data, you need visibility and insight into what you’re protecting. Scope, understand and prioritise sensitive data based on how valuable it is for your business and what is potential risk if compromised. Zscaler data protection leverages AI based, ML powered state of the art algorithms to simplify data classification with unmatched accuracy to help you build a solid foundation for your data protection program. Zscaler data protection can classify and tag sensitive data that contains:
- Financial statements (accounts payable, stock, liabilities and others)
- Credit card information
- Intellectual property (source code and more)
- Personal identification numbers (SSN, NIN, tax IDs and others)
- Health records (medical information, IDs, insurance)
- Contact lists
- Business property (i.e., CRM data in Salesforce)
- Other regulated data types for your industry
2.) Identify your data loss channels: Identify and flag which channels are utilized and require scrutiny. Traditional approaches to data protection are typically limited to corporate devices and sanctioned apps. However, as we make an unprecedented shift to work from anywhere, from any device; data protection program requires unconventional thinking and needs a broader approach as per your risk tolerance. Zscaler offers exceptional protection across all your data loss channels including physical storage devices. With its ground up design, Zscaler can dramatically reduce ramp-up time compared to traditional approaches as new devices, apps and users are rapidly added.
3.) Define your risk profile: Security and convenience require a fine balance. Tipping the scale in either direction can negatively impact productivity and/or security. Developing risk-based policies can help strike that perfect balance that your business requires. But first, it is important to identify what data is critical for your business, , Second, which applications or storage mediums that data resides in and third, the channels from which that data can be compromised.. Your risk profile is not just limited to DLP policies, but proactively implementing zero-trust strategy for an all encompassing data protection strategy for greater security.
Learn more about how Zscaler can help you with your data protection program by protecting your attack surface, inspecting encrypted traffic, implementing granular micro-segmentation and by deploying identity-based multi-factor access control.
4.) Invest in an integrated data protection technology: Just as too many chefs in the kitchen can spoil the broth, too many products can make your data protection journey cumbersome when it comes to implementing, configuring and fine tuning DLP policies. Similarly, you should invest in a DLP solution that is tightly integrated with major vendors across all channels such as Google, Microsoft, Salesforce etc.
A tightly integrated solution can greatly reduce complexity when it comes to remediating risks; identifying and correcting misconfigurations, policy violations and assessing permissions and entitlement based on user identity.
Learn how Zscaler with its extensive integrated partner ecosystem can give you watertight security and prevent your data from leaking.
5.) Build your response workflows: Start by defining security groups and team distribution lists. Document your response workflows and develop detailed playbooks that leverage automation using a security orchestration, automation and response (SOAR) solution, if available. When these tools are integrated into the platform, you get a streamlined way to assign, triage and manage incidents and policy in one single location
6.) Don’t operate in a bubble: Data protection is more than technology; it needs to be part of the company culture. From executives to all employees, contractors and partners, DLP should be consolidated under a larger data management protection program with continuous C-suite support. Leverage end user notifications and deliver timely security awareness training to educate your employees and the third parties you do business with about data protection. The more they understand goals, expectations and best practices, the more successful your data protection program will be.
7.) Be accountable to metrics and the board: Establish meaningful metrics around your data protection program to track and improve upon. Use these to communicate value and improvement to the C-suite. Many companies track metrics such as IT incidents, data breaches and hours to investigate. Commit to continuously monitoring and improving your metrics.
8.) Anticipate supply chain attacks: Mitigate the impacts that a third-party supply chain attack has on your organisation by assuming that any vendor in your network of suppliers can be breached and expose your business to downstream risk. Conduct data security evaluations of potential vendors and include requirements in your contracts. Address critical supplier dependencies in your business continuity and incident response plans and apply strict zero trust access policies and controls to third-party users.
9.) Implement zero trust architecture: Transform your hub and spoke network infrastructure by upgrading to a secure access service edge (SASE) platform that helps stop data loss, eliminates the attack surface and prevent lateral movement by enforcing the zero trust principle of least-privileged access using context-based identity and policy enforcement.
10.) Review your DLP strategy regularly: DLP policies should be updated on a continual basis. As a leader, you should conduct an annual review of your DLP program (policies, practices and products) to identify gaps and roll out any major updates needed to keep up with your changing business needs.
To learn more about how Zscaler can help secure your sensitive data, download our ebook.
