Today’s businesses run on data. They collect it from customers at every interaction, and they use it to improve efficiency, increase their agility, and provide higher levels of service. But it’s becoming painfully obvious that all of that data businesses collect has also made them an enticing target for cybercriminals.
With each passing day, the evidence of that grows. In the last few months, we’ve witnessed massive data breaches that targeted Neiman Marcus, Facebook, and the Robinhood stock trading app. And they’re hardly alone. In recent years, the number of data breaches worldwide has averaged close to three per day.
That statistic suggests that the average business has a target on its back and is running out of time to mount a defense of its data. And doing so doesn’t have to be difficult. To help, here’s a simple 5-step framework businesses of all sizes can use to protect their customer data.
Step One: Review and Adapt Data Collection Standards
The first step businesses need to take to increase the security of their customer data is to review what types of data they’re collecting and why. Most companies that undertake this exercise end up surprised by what they find. That’s because, over time, the volume and variety of customer information that gets collected to expand well beyond a business’s original intent.
For example, it’s fairly standard to collect things like a customer’s name and email address. And if that’s all a business has on file, they won’t be an attractive target to an attacker. But if the business has a cloud call center or any type of high touch sales cycle or customer support it probably collects home addresses, financial data, and demographic information, they’ve then assembled a collection that’s perfect for enabling identity theft if the data got out into the wild.
So, when evaluating each collected data point to determine its value, businesses should ask themselves: what critical business function does this data facilitate. If the answer is none, they should purge the data and stop collecting it. If there’s a valid answer, but of a function that’s not critical, the business should weigh the benefits the data creates against the possible harm they’d suffer if it were exposed in a breach.
Step Two: Minimize Data Access
Step Three: Eliminate Passwords Wherever Possible
Even after reducing the number of people that have access to customer data, there’s still another way businesses can make it harder for hackers to gain access to it. And that’s to eliminate passwords as a primary authentication method wherever possible. It’s a small change that can make a world of difference.
One is the use of two-factor authentication. This means accounts require both a password and a time-limited security token, typically delivered via app or SMS. But an even better approach is the use of hardware security keys. They’re physical devices that rely on unbreakable cryptographic credentials to control data access. With them in use, the threats of phishing and other social engineering attacks are greatly diminished. They’re the best current secure authentication method, at least until solutions like Hushmesh go mainstream.
Step Four: Encrypt Data at Rest and in Motion
While it is true that compromised credentials are by far the biggest threat to cause a data breach, they aren’t the only threat. It’s always possible for an attacker to exploit a software flaw or other security loophole to bypass the normal access control methods and gain access to customer data. Worst of all, such attacks are both difficult to detect and even harder to stop once in progress.
Step Five: Develop a Data Breach Response Plan
No matter how you look at it, there’s no such thing as perfect cybersecurity. Attackers are always hard at work looking for weaknesses to exploit. Businesses that prepare well will eliminate or minimize many of them. But that doesn’t mean a data breach will become impossible.
The Bottom Line