[{"innerBlocks":[],"name":"core\/freeform","postId":127583,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"

Lessons from the biggest data breaches of 2016<\/h2>
Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

2016 was a record year for data breaches<\/h2>
\u201cBetween the DNC hack, the Panama Papers and Dropbox password leaks, 2016 saw its fair share of data breaches, bringing a harsh reality to light for IT: everybody is a target,\u201d notes Krishna Narayanaswamy, chief scientist and cofounder of Netskope. \u201cWhile cyber security is increasingly top of mind for IT professionals, the C-suite still has much to learn when it comes to keeping pace with the constantly evolving threat landscape.\u201d<\/p>

The move to the cloud puts organizations at greater risk<\/h2>
\u201cEnterprises now use an average of 1,031 cloud apps, a figure that IT often underestimates by 10 times, and which represents just one of many avenues that hackers could breach in order to obtain sensitive data,\u201d Narayanaswamy explains. \u201cAccording to an IBM study of nearly 150 CISOs, nearly half of those polled expect a major cloud service provider to experience a security breach within the next year. As cyber criminals continue to develop more complex methods to infiltrate organizations, corporate leaders must have a clear understanding of how to adapt and adopt more proactive deterrence strategies.\u201d<\/p>

First and foremost, create a formal policy around insider threats<\/h2>
\u201cWith the increase in cloud and mobile usage comes the added issue of insider threats,\u201d Narayanaswamy says. \u201cIt\u2019s clear that most organizations have work to do\u2014according to a recent survey, only 37 percent have formal policies in place. The challenge most organizations face is finding the balance between empowering employees to access and use cloud apps and protecting against the risk of data loss. At the end of the day, organizations must have a formal policy to address this issue, including the fact that many cloud app-based insider threats are mostly unintentional, meaning sensitive business data has the potential for accidental exposure via unsanctioned cloud apps.\u201d<\/p>

Organizations must actually enforce insider threat policies<\/h2>
\u201cWhile having an insider threat policy is an important first step in enhancing security, IT leaders must actually enforce the policy,\u201d Narayanaswamy stresses. \u201cThis also includes regularly assessing risks to update and making changes to the policy as the IT landscape changes. For example, if all employees start using new sync-and-share programs to exchange sensitive information, there may be a heightened risk for an insider threat (both unintentional and malicious). An up-to-date policy that controls who can access what from managed and unmanaged devices, and when, will address issues such as this one.\u201d<\/p>

Encrypt everything<\/h2>
\u201cIT leaders have caught onto the fact that, like it or not, employees are going to sync, share, save and upload sensitive data to the cloud,\u201d Narayanaswamy says. \u201cEncryption is the single most important step to ensure this data remains secure. It\u2019s not a failsafe, but it can make a big difference in a third party\u2019s ability to access data or not.\u201d<\/p>

Regardless of industry, implement a data loss prevention strategy<\/h2>
\u201cConsider how easy it is for an \u2018insider,\u2019 such as someone in Investor Relations, to upload non-public financials to Dropbox, or a bio-pharma researcher to upload clinical trial data to a cloud big data tool, or someone in HR to sync employee data in Box,\u201d Narayanaswamy says. \u201cOrganizations need a data loss prevention strategy in place that will detect, classify and protect against the loss of sensitive data while in transit to or from the cloud, and while at rest in the cloud.\u201d<\/p>

Have a remediation plan in place<\/h2>
\u201cHaving a \u2018when, not if\u2019 mentality will ensure that IT is prepared with a definitive process should a breach or hack occur,\u201d Narayanaswamy stresses. \u201cThis includes developing a proper remediation plan to have in place for when something does go wrong. The plan should address risk, security and compliance questions specific to the organization\u2014both the current and future state. Some sample questions to ask include, \u2018Does any confidential content reside in our sanctioned cloud storage and, if so, who has access to it? Do we have any payment card information residing in our cloud Customer Relationship Management apps? Do I have backup in case my data is rendered useless?\u2019\u201d<\/p>

Conduct regular audits for vulnerabilities<\/h2>
\u201cTo establish credibility and gain buy-in for the security plan, IT leaders must provide corporate leadership an accurate assessment of the current state of affairs, including cloud usage trends and potential vulnerabilities,\u201d Narayanaswamy advises. \u201cFor CIOs who haven\u2019t performed an assessment of cloud usage in their environment, there\u2019s no scarier question than \u2018How are we using the cloud today?\u2019 Address this by understanding how many and what types of cloud services are in use in the organization, what potential vulnerabilities and risks are associated with each, if there are any specific security patches or updates that need to take place in order to enhance security and what that means in terms of cyber risk.\u201d<\/p>

Change passwords often<\/h2>
\u201cA recent survey from Ping Identity revealed that while enterprise employees claim to prioritize online security and understand risky versus safe behavior, they fail to follow best practices consistently,\u201d Narayanaswamy explains. \u201cIn fact, half of respondents admitted that they are likely to reuse passwords for work-related accounts. Account for this in the formal IT policy by ensuring that employees change their passwords regularly and often.\u201d<\/p>

Employ two-factor authentication<\/h2>
\u201cSafely enabling cloud means IT must find, understand and secure the cloud services that are in use or under consideration,\u201d Narayanaswamy says. \u201cThis goes beyond knowing the number of services their associated risks, but also understanding risky usage of and\/or sensitive data in the cloud apps in the environment, both sanctioned or unsanctioned, and applying two-factor authentication as appropriate to ensure further security measures are in place.\u201d<\/p>

Maintain an open dialogue with the C-suite to discuss current policy and protocols<\/h2>
\u201cIn general, there\u2019s still a disconnect between C-level executives and IT when it comes to deciphering and understanding standard cyber security practices,\u201d according to Narayanaswamy. \u201cMany executives don\u2019t feel responsible for the repercussions of hacking, creating a culture of blame that doesn\u2019t help to make enterprises any less vulnerable. It\u2019s important that IT departments plan to work closely with the C-suite to act as transparent administrators and guardians of a company\u2019s security policies.\u201d<\/p>

Educate your employees on why this all matters<\/h2>
\u201cHuman error accounts for 52 percent of the root cause of security breaches,\u201d Narayanaswamy stresses. \u201cMost of the time, employees aren\u2019t acting maliciously but the fallout can be immense in either case, and cloud app security strategies must protect against both risks. Regardless of who might be to blame in the event of a breach, get ahead of this issue with regular employee training on the importance of following the organization\u2019s security policies.\u201d<\/p>

","saveContent":"

Lessons from the biggest data breaches of 2016<\/h2>
Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

2016 was a record year for data breaches<\/h2>
\u201cBetween the DNC hack, the Panama Papers and Dropbox password leaks, 2016 saw its fair share of data breaches, bringing a harsh reality to light for IT: everybody is a target,\u201d notes Krishna Narayanaswamy, chief scientist and cofounder of Netskope. \u201cWhile cyber security is increasingly top of mind for IT professionals, the C-suite still has much to learn when it comes to keeping pace with the constantly evolving threat landscape.\u201d<\/p>

The move to the cloud puts organizations at greater risk<\/h2>
\u201cEnterprises now use an average of 1,031 cloud apps, a figure that IT often underestimates by 10 times, and which represents just one of many avenues that hackers could breach in order to obtain sensitive data,\u201d Narayanaswamy explains. \u201cAccording to an IBM study of nearly 150 CISOs, nearly half of those polled expect a major cloud service provider to experience a security breach within the next year. As cyber criminals continue to develop more complex methods to infiltrate organizations, corporate leaders must have a clear understanding of how to adapt and adopt more proactive deterrence strategies.\u201d<\/p>

First and foremost, create a formal policy around insider threats<\/h2>
\u201cWith the increase in cloud and mobile usage comes the added issue of insider threats,\u201d Narayanaswamy says. \u201cIt\u2019s clear that most organizations have work to do\u2014according to a recent survey, only 37 percent have formal policies in place. The challenge most organizations face is finding the balance between empowering employees to access and use cloud apps and protecting against the risk of data loss. At the end of the day, organizations must have a formal policy to address this issue, including the fact that many cloud app-based insider threats are mostly unintentional, meaning sensitive business data has the potential for accidental exposure via unsanctioned cloud apps.\u201d<\/p>

Organizations must actually enforce insider threat policies<\/h2>
\u201cWhile having an insider threat policy is an important first step in enhancing security, IT leaders must actually enforce the policy,\u201d Narayanaswamy stresses. \u201cThis also includes regularly assessing risks to update and making changes to the policy as the IT landscape changes. For example, if all employees start using new sync-and-share programs to exchange sensitive information, there may be a heightened risk for an insider threat (both unintentional and malicious). An up-to-date policy that controls who can access what from managed and unmanaged devices, and when, will address issues such as this one.\u201d<\/p>

Encrypt everything<\/h2>
\u201cIT leaders have caught onto the fact that, like it or not, employees are going to sync, share, save and upload sensitive data to the cloud,\u201d Narayanaswamy says. \u201cEncryption is the single most important step to ensure this data remains secure. It\u2019s not a failsafe, but it can make a big difference in a third party\u2019s ability to access data or not.\u201d<\/p>

Regardless of industry, implement a data loss prevention strategy<\/h2>
\u201cConsider how easy it is for an \u2018insider,\u2019 such as someone in Investor Relations, to upload non-public financials to Dropbox, or a bio-pharma researcher to upload clinical trial data to a cloud big data tool, or someone in HR to sync employee data in Box,\u201d Narayanaswamy says. \u201cOrganizations need a data loss prevention strategy in place that will detect, classify and protect against the loss of sensitive data while in transit to or from the cloud, and while at rest in the cloud.\u201d<\/p>

Have a remediation plan in place<\/h2>
\u201cHaving a \u2018when, not if\u2019 mentality will ensure that IT is prepared with a definitive process should a breach or hack occur,\u201d Narayanaswamy stresses. \u201cThis includes developing a proper remediation plan to have in place for when something does go wrong. The plan should address risk, security and compliance questions specific to the organization\u2014both the current and future state. Some sample questions to ask include, \u2018Does any confidential content reside in our sanctioned cloud storage and, if so, who has access to it? Do we have any payment card information residing in our cloud Customer Relationship Management apps? Do I have backup in case my data is rendered useless?\u2019\u201d<\/p>

Conduct regular audits for vulnerabilities<\/h2>
\u201cTo establish credibility and gain buy-in for the security plan, IT leaders must provide corporate leadership an accurate assessment of the current state of affairs, including cloud usage trends and potential vulnerabilities,\u201d Narayanaswamy advises. \u201cFor CIOs who haven\u2019t performed an assessment of cloud usage in their environment, there\u2019s no scarier question than \u2018How are we using the cloud today?\u2019 Address this by understanding how many and what types of cloud services are in use in the organization, what potential vulnerabilities and risks are associated with each, if there are any specific security patches or updates that need to take place in order to enhance security and what that means in terms of cyber risk.\u201d<\/p>

Change passwords often<\/h2>
\u201cA recent survey from Ping Identity revealed that while enterprise employees claim to prioritize online security and understand risky versus safe behavior, they fail to follow best practices consistently,\u201d Narayanaswamy explains. \u201cIn fact, half of respondents admitted that they are likely to reuse passwords for work-related accounts. Account for this in the formal IT policy by ensuring that employees change their passwords regularly and often.\u201d<\/p>

Employ two-factor authentication<\/h2>
\u201cSafely enabling cloud means IT must find, understand and secure the cloud services that are in use or under consideration,\u201d Narayanaswamy says. \u201cThis goes beyond knowing the number of services their associated risks, but also understanding risky usage of and\/or sensitive data in the cloud apps in the environment, both sanctioned or unsanctioned, and applying two-factor authentication as appropriate to ensure further security measures are in place.\u201d<\/p>

Maintain an open dialogue with the C-suite to discuss current policy and protocols<\/h2>
\u201cIn general, there\u2019s still a disconnect between C-level executives and IT when it comes to deciphering and understanding standard cyber security practices,\u201d according to Narayanaswamy. \u201cMany executives don\u2019t feel responsible for the repercussions of hacking, creating a culture of blame that doesn\u2019t help to make enterprises any less vulnerable. It\u2019s important that IT departments plan to work closely with the C-suite to act as transparent administrators and guardians of a company\u2019s security policies.\u201d<\/p>

Educate your employees on why this all matters<\/h2>
\u201cHuman error accounts for 52 percent of the root cause of security breaches,\u201d Narayanaswamy stresses. \u201cMost of the time, employees aren\u2019t acting maliciously but the fallout can be immense in either case, and cloud app security strategies must protect against both risks. Regardless of who might be to blame in the event of a breach, get ahead of this issue with regular employee training on the importance of following the organization\u2019s security policies.\u201d<\/p>

","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Lessons from the biggest data breaches of 2016<\/h2>Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

Lessons from the biggest data breaches of 2016<\/h2>Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

Lessons from the biggest data breaches of 2016<\/h2>
Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

Lessons from the biggest data breaches of 2016<\/h2>
Organizations are taking more of their data and applications to the cloud, increasing the risk of a cybersecurity incident. Here are 10 lessons IT can learn from 2016\u2019s biggest data breaches.<\/p>

10 lessons learned from 2016’s biggest data breaches

More for you