It may not be easy to go back and closely look at what went wrong following a data breach. No one wants to be the employee that lost a flash drive or failed to meet a compliance requirement. However, acting within an effective information security framework requires organizations to do exactly that and identify their data security shortcomings.

Looking at the information protection measures in place at an organization that has suffered no breaches, Greenville Online writer Tim Smith identified data encryption software as a critical element to protecting digital assets. Beth Stevenson, a spokeswoman for the North Carolina Department of Revenue, told Greenville Online that her organization follows industry standards with both perimeter-based and data-centric security.

"There is absolutely no information sitting on our server that is not encrypted," Stevenson told the news source. "My understanding is that is the number one defense that you have."

PCI risk assessment tips
Any organization that stores or processes payment card data must meet Payment Card Industry standards. The PCI Council recently published a document advising businesses on developing a risk assessment framework. Although the council's document focused on PCI compliance, many organizations can benefit from the key takeaways, which include:

• Companies must develop clear risk assessment methods and policies that account for organizational needs
• The framework must allow for continuous evaluation to identify points of weakness as new threats emerge

"By performing this risk assessment, businesses are better equipped to determine the appropriate controls for reducing the likelihood and/or the impact of potential threats to their business," the document explained.

A comprehensive framework is adaptable, so that it can be applied as technology needs evolve. Organizations must also view security as an ongoing process, particularly as new solutions emerge. Having a flexible data protection paradigm in place allows businesses to best identify where to use data encryption software.