Focusing Solely on Regulatory Compliance Could Make Your Data Less Secure

Last Updated on January 21, 2019 by Ashok Kumar

Of course, complying with data protection regulations is necessary if you want to avoid hefty fines and costly lawsuits; however, many organizations hold on to the belief that if they are compliant, they are automatically immune from cyber-security threats.

Since the threat landscape is dynamic and continuously evolving, our approach to dealing with security threats must reflect this and adapt accordingly.

Data protection regulations, such as the GDPR, may serve as a useful framework for securing our data, however, it should be treated as baseline from which to build a more sophisticated defense strategy. For example, many regulations require that organizations implement a web application firewall (WAF) to protect their website from SQL injection, cross-site scripting and various other security misconfiguration; however, companies may simply install a WAF in order to achieve compliance, but not actually leverage its features to their advantage.

The Costs of Data Breaches

Of course, expecting businesses to go the extra mile when they are not mandated to do so could be seen as idealistic, but it’s not just fines they need to be concerned about. After all, there are many hidden costs associated with data breaches.

Such costs may include patching and restoring affected systems, conducting a forensic investigation to mitigate the chance of a repeat attack, and let’s not forget about the damage a data breach could do to a company’s reputation. This could also spill over onto any suppliers, retailers or third-parties that are connected to them in some way, which could lead to a further loss of business.

Go Beyond Compliance Mandates

Once you have checked the necessary boxes associated with the regulations you are mandated to comply with, you need to take some time to review some of the latest security trends.

For example, the number of data breaches associated with cloud-services is on the rise, as using these services makes it harder for companies to enforce security policies. As a starting point, look into implementing multi-factor authentication, and consider adopting a real-time auditing solution that is able to aggregate and monitor events from multiple cloud platforms.

Naturally, auditing sensitive data is an essential part of complying with data protection regulations. Some of the latest DCAP (Data-Centric Audit & Protection) solutions provide a large number of features. They can provide real-time alerts and customizable reports about a wide range of user-driven events, such as suspicious file and folder activity, privilege abuse, and unauthorized mailbox access. The can also monitor events based on a threshold condition, such multiple failed login attempts or bulk file encryption, and provide password expiration reminders.

Monitor the Latest Cyber-Security Trends

Another thing to watch out for is crypto-mining, which is starting to replace ransomware as the most popular type of malware. You will need to monitor CPU usage, install browser extensions that detect/block crypto-mining scripts, and monitor DNS traffic and IRC communications on your network.

It may also be good idea to get up to speed with the latest decentralized technologies. While these technologies are still in their infancy and storing data on a blockchain is unnecessary for most organizations, there are still a number of solutions which can improve the security of our network and data.

For example, GunDB, which is an open-source, P2P, graph database engine written in Javascript, can enable companies to store their data in an encrypted format without the need for a centralized server. Other technologies, such as the SAFE network, will provide unparalleled network and application security, when/if it is eventually released.

DDoD attacks are also becoming more frequent. As such, it might be wise to look into adopting a specialized DDoS protection solution. Finally, in order to stay one step ahead of the attackers, it might be a good idea to consider adopting AI and machine learning solutions.