How do you manage your organization's sensitive data?

Not long ago, business data was recorded manually on paper, then stored in boxes and stored in corporate archives or secure storage locations, and the only way for malicious people to get hold of it was through burglary.

Today, times have changed a lot. Digital transformation has gone through this, and data is now mostly digitized and stored on the cloud, where it is more vulnerable to cyberattacks.

The issue of data protection has become a very important issue for companies that must ensure at all costs that their sensitive data remains confidential.

What is sensitive data?

Organizations of all sizes and in all sectors collect, process, and store a large amount of more or less sensitive data on a daily basis.

Sensitive data includes:

• customer and employee informationsuch as social security number, home address, telephone number, telephone number, email address, passport number, but also racial or ethnic origin, health data, political opinions, trade union membership, etc.;
• financial data such as customer payment methods, bank details, employee payslips, etc.;
• strategic business data.

If this sensitive data falls into the wrong hands, the consequences can be disastrous: fraud, identity theft, extortion, industrial espionage, unfair competition, etc. Your company's reputation and image will be affected, you will lose the trust of your customers or your competitive advantage, and all this will have a significant financial impact on your business.

Protecting your sensitive data should therefore be your priority. Here's how to effectively manage your data to avoid leaks or theft.

How to properly manage your organization's sensitive data?

Follow these tips to effectively manage and protect your sensitive data.

1. Inventory all your sensitive data

To get started, you need to:

• make an inventory of all the sensitive information that your company is in possession of;
• identify the movements of this data (how do you get them? What do you do with it?) ;
• draw up a list of persons who have regular access to it or who may have access to it.

This is how you can define where possible security breaches are located.

List sensitive data:

• by type: financial, personal, strategic, etc.;
• by location: computer (fixed and portable), hard disk, USB stick, server, mobile phone, etc.;
• by department: sales, marketing, human resources, finance, as well as your service providers (such as the cloud), call centers, etc.

2. Reduce them to the bare minimum

To keep even the most sensitive data safe, it's essential to only collect or keep what you really need to run your business properly. For example, is it really necessary to keep the credit card number, expiration date, and CVC (Card Validation Code) for each of your customers?

3. Protect the data you keep

Now, you need to protect sensitive data that your business can't do without. To do this, three elements must be taken into account:

• Physical security : whenever possible, dedicate a lockable room for the storage of sensitive data where you will store hard drives, CDs, paper files or even servers. Only a limited number of people should have access to it. Even better, name a single person who is responsible for this room and ensure that they keep a record of who accesses the stored data.
• Electronic security : you need to know the possible flaws in your computer system and call on experts to remedy them. Install antiviruses that you update regularly. Use the end-to-end encryption for all your data, especially the most sensitive ones. Also, use apps to automatically generate new passwords on a regular basis. If possible, avoid storing sensitive data on a computer with Internet access.
• The safety of your suppliers : if you put in place strict security measures but not your suppliers, you will be at risk. Ensure that the businesses you work with also have strong policies in place to protect their systems and data. Choose companies that host your data in France such as Wimi. Also specify that they must inform you of any incident, even if it is not serious.

4. Properly delete what you don't need

Deleting sensitive data must be done correctly to leave no trace that can be recovered and reused by cybercriminals.

Define the procedure to be followed to effectively dispose of sensitive information. Shred or burn confidential papers by installing shredders in the various departments or near the photocopier. Use specialized software to erase all the files on a computer that you want to get rid of. Without it, the information could be retrieved.

5. Educate your employees in cybersecurity best practices

Employees who work with sensitive data on a regular basis should understand the importance of keeping that data confidential and their role in protecting that data. To do this, it is essential that you make them aware of the risks involved and that you train them in the best practices to adopt and the behaviors to avoid (recognize phishing, do not download the attachment of an email whose sender is unknown, etc.). The same goes for employees in teleworking.

You can also train a person or a team specially dedicated to the security of your data, regardless of the size of your business. This team can be responsible for training your employees on the risks of cybercrime, answering their questions and supporting IT teams.

6. Prepare an appropriate response in the event of a violation

Cybercriminals always seem to be one step ahead and it is therefore difficult today to create a security system that is completely infallible. You need to be prepared to respond effectively in the event of a violation in order to minimize the impact on your business, customers, and employees.

To do this, define an action plan describing the measures to be put in place in the event of a security incident and designate one or more persons responsible for its implementation. Document the incident (nature of the breach, number of people involved, type of data, etc.). Analyze the incident to find out what happened and how to fix it. Finally, list the people and organizations to be notified (persons concerned, the CNIL, etc.).