Data Privacy Is Our Birthright - national cybersecurity month

Never before in history has the concept of identity been so vital. To a large extent, everything we rely on to live our lives depends on who we are… or perhaps more accurately, who we can prove ourselves to be. Our data has come to be the standard by which we define ourselves. Because this identity-defining data is online, the protection of our data is of paramount importance.

Thus, data privacy is as much a given right as freedom of speech or access to healthcare. Yet actually safeguarding this privacy has become a hot-button issue. According to online statistics portal Statista, 53 percent of online users are currently more concerned about their online privacy compared to a year ago. The rising incidence of online identity theft and data breaches speaks directly to this concern. Thus, for the end of National Cyber-security Month, we’ve got five important tips on how to bolster your existing data protection scheme.

1. Start by moving security to the cloud in your cloud journey

Many, if not most businesses have begun a digital transformation by moving their on-premises infrastructure to the cloud. The benefits are many: cost efficiency, hardware reduction, promotion of a mobile workforce, ease of disaster recovery, etc.

Cyber-security in an online system has also been optimized for the cloud, maintained by automated policies and procedures that protect user data. These policies and controls act on many different levels, from access points to traffic filtering to incident response. Regardless of the type of cloud employed -- public, private or hybrid -- cloud security combines the advantages of cloud computing with the assurance and compliance required by business organizations. 

2. Shift security to the left and consider using a DevSecOps approach

The traditional security implementation model is to apply it to the very end of the development pipeline. While this does tend to speed up the development process, it leads to situations in which security checks performed at the end of the cycle reveal vulnerabilities, at which point code must be rewritten or any number of security patches must be deployed. This either delays release or leaves exploitable security holes in an active product, respectively.

DevSecOps, or Development Security Operations, applies security to each step of the traditional DevOps chain. Enabling this practice in your development team does not require hiring someone with special skills; the tools for DevSecOps are readily available. Some of the keys for a successful DevSecOps practice are applying automation as much as possible; requiring that your team practices secure coding at all stages of development; and the “shift left” methodology, which simply means testing earlier in the development cycle as possible, rather than leaving it for the end of the process.

3. Consider tool consolidation for security, configuration, and compliance using a simple cloud-native tool

For those concerned about baking data privacy protections into their practice, there are a great number of tools available, which can lead to confusion and feeling overwhelmed. While it’s great to have a single solution for a single problem, there’s no guarantee that all solutions will mesh together operationally. As with most things, simplicity is the best policy.

A better approach to managing multiple issues is to apply a single solution that can handle the various issues from a single viewpoint. The main benefit of this kind of tool is in its administration of all aspects of security, configuration and compliance. All processes have been built to interoperate, which allows for ease of use and overlap in the different sections the solution covers. Reporting allows a great deal of insight into operations from a single interface, which makes it easy to quickly assess the state of the environment.

4. Enterprises should consider using threat intelligence services to stay current with existing and emerging threats

Keeping up-to-date with the ever-evolving cyber-threat landscape can be a full-time, all-consuming position. It might be too much to ask of your existing security department, if you even have a dedicated group devoted to the task. There are simply too many vectors, operators and shady organizations extant for any business not specifically concerned with research to counter.

Fortunately, these security and threat assessment companies do exist, and they provide the oversight and experience required for a comprehensive, ongoing look into modern cybercrime. They fill gaps that may exist in your environment and reduce exposure to threats by anticipating and identifying risks, aligning an organization’s assets to better shore up defenses.

5. Modernize your SOC in the cloud

A security operations center, or SOC, is responsible for meeting cyber-threats head-on as, or potentially before they occur. An SOC will operate with an organization’s incident response team to ensure that all threats are properly assessed and contained. It’s incumbent upon an SOC to maintain the highest levels of awareness and knowledge of the threat landscape. 

Once a business has achieved transition to the cloud, there is an even greater number of potential surfaces for cyber-criminals to exploit. Thus, it’s important to modernize a company’s SOC to keep its lists updated with the latest methodologies, tools and adversaries. Its policies, architecture and analysis must be assiduously maintained and response teams’ readiness must be cultivated to ensure the highest-responsive team possible.

Data privacy is a right for anyone with data at risk on the internet. However, just like all rights, it must be protected and promoted. It’s the responsibility of gatekeepers like enterprise organizations to protect its users, employees and vendors by taking steps to transform their security posture in the cloud. New cloud-native tools, modern threat intelligence and a security-focused DevOps initiative help protect us all.