External hackers and insider threats. Customer expectations and government mandates.
Data protection is a complex challenge, and it demands attention at every level of an organization. PKWARE's in-house experts are here to help you stay up to date on best practices, emerging trends, and new resources for enterprise data security.
In the 15 years since its introduction, the Payment Card Industry Data Security Standard (PCI DSS) has redefined data protection for banks, merchants, and every other organization that handles credit card data. Companies around the world design their networks, build their applications, and assign user permissions with PCI requirements in mind.
One data security risk, however, often goes unaddressed, even by organizations that take an aggressive approach to PCI compliance: credit card numbers in unstructured data.
What's the best way to protect sensitive data?
The answer, of course, is "it depends." Organizations have too many different types of sensitive information, and too many ways to store and share it, to allow for a one-size-fits-all approach. Each of the common methods of protecting data—encryption, tokenization, masking, and redaction—might be the right solution for a given use case.
Every year, we look forward to the RSA Conference, the cybersecurity industry’s biggest event. No other conference lets us meet as many security professionals, or get as many different viewpoints on what’s happening in security and where the industry is heading.
Here’s a summary of the top storylines we heard as we talked with customers, industry analysts, and other folks in the security world this year.
PKWARE is proud to announce that CRN, a brand of The Channel Company, has once again named Rick Hofmann, Vice President of Worldwide Channel Sales, to its prestigious list of Channel Chiefs. The top IT channel leaders included on this list continually strive to drive growth and revenue in their organization through their channel partners.
Not that anyone needed another reminder, but a financial services vendor has provided an illustration of the fact that sensitive data should never be left unencrypted.
As first reported by TechCrunch and security researcher Bob Diachenko, millions of records containing Social Security numbers, tax information, credit scores, and other mortgage data were discovered, unencrypted, on a publicly-available server in early January. The company directly responsible for the breach has already taken its website offline and stopped responding to questions, but the repercussions may only be beginning.
From the moment Europe's leaders began discussing the law that would eventually become the GDPR, it seemed almost inevitable that the United States would some day pass a national cybersecurity law of its own. After all, as the center of the world economy, America presents the largest attack surface for anyone looking to steal consumer data, trade secrets, or other sensitive information.
America's GDPR may still be years in the future, but the country appears to be taking another step in that direction. Recent comments from Senator Mark Warner and other high-profile politicians, in the wake of the recently-uncovered breaches at Marriott and the National Republican Congressional Committee, suggest that there may be growing support in D.C. for a national solution.
Faced with staffing shortages, skill gaps, and evolving cyber threats, security professionals around the world are beginning to recognize that automation is the future of information security. There’s simply no way that security managers—or end users—can be expected to evaluate every risk and apply appropriate protection to the constantly-multiplying volumes of data they handle.
Automation is a difficult idea to accept for some, especially those who have tried automated technology in the past, only to abandon it after watching it disrupt workflows, frustrate users, and overwhelm already-busy IT staff with a flood of false alarms. So how can an organization automate its data protection activities without throwing a wrench in its critical business processes?
Back when they were new on the scene, HIPAA's privacy and security rules didn't get much respect. Beginning with the privacy rule's introduction in 2003, the Office of Civil Rights received thousands of complaints and investigated thousands of infractions each year, but took little or no corrective action. In fact, the OCR didn't issue a single fine for a HIPAA privacy or security rule violation between 2003 and 2008.
It's easy to understand how HIPAA got a reputation as a toothless mandate, but things have changed over the last ten years. If anyone needed a reminder of the fact, the OCR delivered one this week with its $16 million fine for the Anthem data breach. The penalty is nearly triple the previous record for a HIPAA fine, and sends a clear message that organizations can expect to pay a heavy toll for neglecting their data protection obligations.