Despite the obvious need for data-level security, many organizations are struggling to implement security strategies that address today’s challenges. Uncertainty about the extent and nature of sensitive data, together with concerns about software usability and effectiveness, can leave an organization unable to commit to a data-centric approach to information security. Integration between data discovery and data protection is the missing link.
Why Network Protection Stopped Being Enough
Most companies still run a security model built decades ago around networks and devices. Firewalls and passwords have a place, but recent history shows that an attacker who believes there is something worth taking will find a way in. Adding another layer of the same thing only postpones the problem.
Cloud computing and decentralized teams have made the limits obvious. Restricting access to an internal file server does little when employees save their work elsewhere, or send it to partners and vendors by email or FTP. The only reliable answer is to protect the data itself, so that a file stays safe after it is copied, shared, mishandled, or stolen. Encrypted information is readable only by someone holding the key, which makes it worthless to anyone else.
Three Obstacles That Stop Organizations
Defining sensitive data comes first, and every organization defines it differently. Regulated industries have mandates that name account numbers and Social Security numbers, but those same companies often struggle with the categories nobody has written down. Less-regulated companies frequently have no framework at all, and leave the question alone until an incident forces it.
Locating and quantifying it is the second obstacle. Unstructured data, meaning documents, images, messages, and similar files, accounts for 80 percent or more of what most organizations store. Without a discovery capability running across the network and the endpoints, there is no way to say how much sensitive data exists or where it sits. Encrypting an entire server is a common substitute. It protects what is on that server and leaves the same uncertainty about everywhere else.
Endpoints are the third. Employees save sensitive data to laptops, tablets, and phones routinely, often without noticing. Several high-profile breaches began with a lost or stolen device. Cloud sync adds to it. When someone connects a company device to a personal storage account, whatever they carry over from a former employer or customer arrives in the organization too, along with the fines and lawsuits that can follow.
Discovery Alone Is Not the Answer
Large organizations often decide against a data-centric approach for practical reasons rather than philosophical ones. Discovery-only tools identify sensitive data and then stop, which means buying a second product to act on what the first one found, and that is a poor return. Traditional public key infrastructure has the opposite problem. It protects data but is notoriously difficult to deploy and support at scale. Integration between discovery and protection is the missing link, because identifying and encrypting in one step is what removes both objections.
Download this whitepaper and gain insight into:
- A new model for information security
- Obstacles to strong data protection
- How PK Protect can help