Data Storage Vulnerabilities, Principles, and Best Practices
The data that your company holds is its crown jewels. It’s your most valuable possession. Therefore, it pays to invest in effective data security protection and to store it securely and safely. Just like you would your most prized possessions at home. In a fire-proof lock box. Buried on the floor. Under a carpet. In a room secured by a locked door. Preferably dead-bolted. And with an alarm system that detects entry. And a video camera to capture any unauthorized access.
Should you go to such extremes to protect yourself when devising a data storage security strategy?
In this article, we discuss protecting data at rest, in data centers, and on a storage device. We examine potential vulnerabilities, key data storage security principles, and the 12 best practices of data storage protection that will help you defend against unauthorized access and ensure business continuity.
What is data storage security and why is it important?
There are many ways to store data. You might hold your data on hard drives, with cloud services, or external storage services.
However your data is stored, you’ll need to ensure that sensitive data is protected against data breaches and data loss. For example, a malicious attack or hard drive crash could lead to data being lost or unusable forever.
Data storage security measures are designed to ensure that data remains confidential and protected from being stolen. Remember, without data, your business could not function. Data storage security can be the difference between your company’s success and failure.
Potential vulnerabilities of stored data
Okay, so what makes your data vulnerable?
Like any data, poor practices put it at risk.
Take that lock box in which you keep your most treasured family heirloom. Safely stored using a digitally secured code. But what if that code was easy to break — like your birth date, for example?
When storing data, you should use data encryption. A lack of encryption, or using poor encryption practices and weak encryption keys, will put your data at risk.
Another example is when you receive a new credit or bank card, followed by a sealed envelope with your four-digit PIN. Do you destroy that piece of paper with the PIN printed on it (maybe even burn it), or do you screw it up and throw it in the trash can, where it can be retrieved by Heaven only knows who?
Similarly, if your system and work practices don’t destroy data, then that data is at risk.
Tell us, do you leave your house unlocked and your front door open when you go out? Nope, didn’t think so. An open door is a gift to an opportunist criminal. Yet, offices are left unlocked. Often with unmanned computers still buzzing away. If your physical security isn’t robust, then neither is your data security.
And how about if you should lend someone your car? You’d want to make sure that they have a driver’s license, wouldn’t you? So why, when a business ‘lends’ its data to the cloud does it not check that cloud data storage credentials and security?
The three principles of data storage security
Good principles are the foundation on which good practices are developed.
The three principles of data security are confidentiality, integrity, and availability:
-
Confidentiality: data should not be disclosed to unauthorized persons or organizations.
-
Integrity: data should not be modified without authorization, and you should have processes in place that detect and correct any changes to data.
-
Availability: data should be accessible when needed.
What about data storage and compliance considerations?
Data storage and compliance considerations are major issues for companies. You must store data in a way that is compliant with the regulations of your industry, state, and country. If you are conducting business across borders, you’ll also need to comply with international and individual nation compliance regimes.
The more data you have, and the wider your business operates, the more complicated it becomes to store and comply with regulatory compliance. And remember, ignorance of the law is no defense should it come to the legal consequences of non-compliance.
Therefore, on top of developing your data storage protection strategy aligned to the principles of data storage security, you should also ensure that you apply all compliance requirements and maintain your strategy to evolve as regulations evolve.
12 Data storage protection best practices
What do you need to ensure happens (and doesn’t) for a data storage security strategy to be effective?
You’ll need to be aware of the several types of data your business collects and stores as well as the risks associated with each type. You will also need to monitor who has access to that data, what kind of access they have, and how often they can access it. You should audit your current security measures and assess whether they are enough for today’s threats.
Here are 12 best practices for data storage protection.
-
Design and document robust data storage security policies
Your data security policies should be aligned to your business: the type of business it conducts, its customers, vendors, threats and risks, and compliance issues.
Policies should be documented and communicated clearly so that all employees know what they should do when handling sensitive information. Policies should also be updated as necessary to reflect changes in the law or best practices in the industry.
-
Data classification (based on sensitivity and application requirements)
Sensitive data is any data that can be used to identify a person, either directly or indirectly. It may also be other data that is confidential to your business.
It is important to classify the data based on the level of sensitivity and the application requirements before storing it. The following list provides some examples of data classification:
Data classification can be done by using labels and levels of protection that are appropriate for the type of information being stored on it.
-
Access control mechanisms
Controlling who has access to certain types of data is crucial. Access control policies ensure that only those people who are authorized to view and use data can do so. This doesn’t only cover digital access, but physical access to workspaces, too.
-
Multifactor authentication
Multifactor authentication is one of the most secure ways to protect your data from unauthorized access. This is an extra layer of protection that makes sure only authorized employees with the right credentials can access sensitive information in the database. It’s like having two locks on a door — you need both keys to gain access.
-
Layered/tiered storage security architecture
Tiered storage security architecture is a system that has different levels of security depending on the sensitivity and business value of the data. The higher the level of data sensitivity, the more protection is needed. This type of architecture is also called ‘defense in depth’.
-
Encryption
Encryption can be used to protect data from unauthorized access, tampering, and loss. Data encryption is a process of converting information or data into a code that is unreadable without the correct key.
A variety of encryption methods exist, with each one having its own set of benefits and drawbacks. The method you choose will depend on what type of data you are encrypting, how it is being used, where it is stored, and the level of security required.
-
Segregation of administrative responsibilities
Data segregation is one of the best practices to protect sensitive information. It ensures that distinct types of data are stored on different servers, hard drives, or databases. This helps minimize the risk of a single breach compromising all your sensitive information.
Administrative responsibilities should also be segregated to provide better protection for your company’s sensitive data. This means that different people should oversee maintaining the data and configuring the system.
-
Data loss prevention
It’s crucial to embed data loss prevention tactics in your data storage security policies. These range from backups to using uninterruptable power supplies, to using only authorized software and having a robust disaster recovery plan.
Read more in our article ‘16 Tips to Reduce the Risk of Data Loss in Your Company’.
-
Strong network security
Network security is a process of protecting networked resources against exploitation by malicious users and unwanted computer activity such as spamming or denial-of-service attacks. Network security includes firewalls, intrusion detection systems, and protective measures such as updating operating systems with available patches. It also includes issues such as securing buildings and property from unauthorized access, theft, or damage.
-
Solid endpoint security
Endpoint security provides an additional layer of protection for the data that is stored on the device and is a crucial component of data storage protection.
Endpoints are often the most vulnerable part of a network and include devices such as laptops and desktops, tablets, smartphones, etc. Securing these is vital because if a hacker manages to break into the network, they can then access the systems or databases where your information is stored.
-
Redundancy
A data storage system must be redundant to protect against data loss. Redundancy means that there are two or more copies of the data, which are stored in separate locations.
The most common type of redundancy is called ‘mirroring’. It involves copying all the data on one hard drive onto another one. Another type of redundancy is called ‘striping’, which involves dividing the data into blocks and storing them on two or more hard drives.
-
Optimal backup and recovery systems
Backups are crucial to a business. By backing up your data, you ensure that, should you suffer a data loss, your business can continue operating.
You can back up your data on a different server or external storage device, or by backing up data in the cloud.
If you use cloud-based services or cloud computing, you should ensure that the service provider is adequately protected.
When backing up your data, you should:
-
Identify the data that needs to be backed up and recovery systems that need to be in place
-
Ensure that backups are done on a regular basis, preferably daily
-
Store backups offsite so that they can’t be compromised by a fire or natural disaster
-
Keep backup copies as close as possible to the original data source so they can be recovered quickly
Is your stored data protected?
Unprotected stored data is easily lost or stolen. The impact of data loss on business can be devastating, with many small businesses closing their doors within 12 months of a major data loss event.
Is your data in storage protected? When was the last time you audited your security policies?
We specialize in helping small and medium businesses (locally and nationally), as well as government contractors, implement effective data security. Contact us today to ensure your company is fully protected.