Lock it or Lose It: Why Every Company Should be Concerned About Data Security

Lock It or Lose It:
Why Every Company Should Be
Concerned About Data Security
James Benham
CEO and Co-founder of SmartCompliance.
Entrepreneur & risk technology consultant.

- OUR ITINERARY FOR TODAY -
SmartCompliance, Inc. All rights reserved
• Notable data breaches of the 21st century and learning
experiences.
• Strategies to use Safe Cloud Environments.
• The best tools to assure data is protected.
• My personal 10 golden rules of Data Security.
• Protection of data in work-remote environments.
• Q&A time.

BASIC DEFINITIONS
• Data is the major asset any company has.
• Cloud Data is a necessity and the perfect
solution for storage information.
• Data security is the practice of protecting digital
information from:
• Unauthorized access.
• Corruption.
• Theft throughout its entire lifecycle.
DATA PROTECTION NEEDS ORGANIZATION

NOTABLE DATA BREACHES OF THE 21st CENTUR
Date: October 2013
Impact: 153 million user records
Data Breach:
• Hackers had stolen nearly 3 million encrypted customer credit card records.
• Login data for an undetermined number of user accounts.
Repercussions:
• August 2015 Adobe pays $1.1 million in legal fees.
• Pay an undisclosed amount to users to settle claims of violating the Customer
Records Act.
*Reported: by security blogger Brian Krebs.

Date: 2014 the year of "Cloud celebrity picture leaks fever"
Impact: Jennifer Lawrence stolen photos
Data Breach:
• Phishing scheme that tricked the actress into revealing her usernames and
passwords.
• Stolen pictures from her own Apple iCloud iPhone/iPad-linked accounts.
Repercussions:
• George Garofano form Connecticut was sentenced to eight months in prison for
his part in the hacking of her cloud and private pictures.
NOTABLE DATA BREACHES OF THE 21st CENTURY

• Do you encrypt files when sharing information in the cloud?
• Do you read Privacy Policies when you sign up or update
cloud information?
• Do you study the apps that you are sharing information with?
• Does your team use strong passwords and two
factor authentication?
ASK YOUR SELF THESE QUESTIONS

Data Loss Prevention (DPL) Software
• Classifies what data is sensitive and identifies weak points.
• Uses alerts and preventive measures to prevent accidentally or
purposely sharing private data.
• Digital tools to track and ensure data is not
lost, used or accessed by unauthorized users.
USE TECNOLOGY ON YOUR SIDE

RULE # 1: All employees must have clear rules
for the protection of IT
MY PERSONAL RULES
• Define first what data does your company need to store & protect?.
• Only authorized users can access sensible data.
• Keep company’s IT technologies up to date and regularly update the latest
system version.
• Run tests and "exams" to teach your team to be prepared. Ex: false emails and
security campaign at least once a year.

Secure communication channels
RULE #2
• Secure your home/office WLAN connection.
• Connect tablets, smartphones or PCs of home-office employees to the
corporate network.
• Virtual private networks (VPNs) are recommended.
• Establish connections via a “secure tunnel."
• Stay away from public WIFI and hotspots.

Passwords are the first line of defense
RULE #3
• Password must be strong and don’t contain personal information. Should contain:
• Both upper case and lower-case letters.
• Numbers.
• At least one special character.
• The default administrator password should be replaced with a new one.
• Require your team to change their passwords on a regular basis.
• Always log out when finished using a password protected service or application.
• If a cloud service offers a two-step verification process, then it’s best to use it.

Share files from a cloud secure data center.
RULE #4
• Device-based conditional access to block users on unauthorized devices.
• Sign out users after a defined period of inactivity.
• Send documents through links that expire or require password access.
• Grant limited privileges with customized links.
• Protect data by identifying sensitive documents and preventing them from
being shared.

Always use a cloud service that offers full encryption for
your data.
RULE #5
• Ideally, the cloud service should offer 256-bit AES military-grade encryption
across all its communications and storage.
• Read and review the Terms of Service of the cloud provider.
• Choose cloud services that have an event of a breach or data disaster.
• Microsoft OneDrive is a trusted and reliable platform

Backup your important information
RULE #6
• 30 % of people have never backed up their devices.
• Laptops are stolen every 53 seconds in the U.S. (Kensington)
• Don’t keep all your eggs in one basket.
• Regularly update your computer to fix bugs that open you to risk.
• Schedule backups to external hard drives or in the cloud in order to keep your
data stored safely.
• The ideal frequency is weekly, but you can do incremental backups every few
days.

Basic security measures and antivirus
RULE #7
• Ensure strong anti-malware programs are in place for all your devices.
• Avast.
• Bitdefender.
• F-Secure.
• McAfee.
• Norton.
• Updating is important! Recent updates allow your Data to be more secured.
• Be smart with emails and surfing the web. Downloading apps or files can
infect your computer. Be careful with the sources you find online, or you receive.
Take every “warning box” seriously.

Transparency and legal regulations
RULE #8
• If your business collects, processes, and holds personal information you need
a transparent privacy policy in place.
• Required to ask for consent and explain why you need those details.
• No matter your business’ size, you need a secure network to protect
processed personal data.
• Businesses handling sensitive information like health records or credit cards
require regulations.
• Have a dedicated Data Protection Officer.

Security engineering
RULE #9
• Security controls should be integrated so that security becomes an integral
part of system operations.
• Develop a set of security standards and practices.
• Conduct scans of networks to find vulnerabilities.
• Monitor networks and systems for security breaches or intrusions.
• Test security solutions using industry standard analysis criteria.
• Supervise changes in software, hardware, and user needs.

Monitor vulnerability disclosure
RULE #10
• If you notice a vulnerability in a system you use, report it directly to whoever is
directly responsible.
• If you receive a report that there is a vulnerability in your system, make fixing
this your top priority.
• Use threat intelligence information to understand threats that are currently
targeting or may become a problem for your organization.
• Plan an organization’s information security strategy.
• Educated staff members on information security through training.

DISCUSSION TIME!
Data Security is not a one-time engagement...
It is a daily task!

To receive monthly Industry- Exclusive
information, subscribe to our Newsletter.
smartcompliance.co/newsletter
Thank you for attending!

Lock it or Lose It: Why Every Company Should be Concerned About Data Security

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Lock it or Lose It: Why Every Company Should be Concerned About Data Security

Similar to Lock it or Lose It: Why Every Company Should be Concerned About Data Security (20)

Recently uploaded

Recently uploaded (20)

Lock it or Lose It: Why Every Company Should be Concerned About Data Security