Companies are faced with myriad threats, both existing and emerging, that can lead to catastrophic consequences, hence the words “cyber-attacks”, “ransomware”, “data breach”, “zero trust”, “resilience”, “data security”, “data protection”, “recovery plan”, etc. are becoming more and more common in today's IT world, and all play pivotal roles with regards data risk or keeping sensitive data safe, but each of them have their own goals and characteristics. See also "The security and software industries learned some hard lessons in 2021".
A lot of people use the terms "protection" and "security" interchangeably, but even though may have some similarities, they involve distinct processes, resources and outcomes. In the IT world, these words have more complex meanings as data has unique attributes and challenges.
While Data Security is addressing the defense of digital information against internal and external, malicious and accidental threat, Data Protection is referring to the processes of safeguarding important information from corruption, compromise or loss1.
Digital data has become an asset shared by many systems, and across many different applications in the recent years.
Data Security is part of a given customer’s overall security plan, both for a single data center and for the organization as a whole. It would make no sense to carefully protect the data but leave the system wide open to the external threats. It should be recognized that security plans will likely have different levels to address the varying security requirements of a diverse number of databases and applications. Read also "Rethink and Build Data Privacy and Protection".
Data Security must prevent and protect, against a variety of threats, not all of which can be anticipated in advance. We need to keep in mind that security is referring to a set of procedures that defines access rights, as well as authority for managing devices, and defines an appropriate response when security issues occur.
In many cases, it is no longer enough to protect a single system, since data is created, sent and distributed by different users, throughout the company and through different applications and devices, and stored in multiple systems; all of which must be protected against unauthorized access, modification or destruction by anyone with access from other systems.
Security is therefore a very broad topic, addressing not only data security, but device security as well, and should start with the goals, environment, local or industry regulatory constraints, and risk tolerance of an organization. That direction, in turn, leads to choices in having doors that lock and security guards, in due diligence choosing employees for positions of trust, in how records are kept and how their integrity is maintained, and in plans assuring that the organization can continue to operate.
Zero Trust Journey
As cyber threats are escalating, aging apps and processes (and new ones) are full of unforeseen risks. Privacy and compliance requirements are mounting. And point solutions were not offering the scope, vision, or cross-silo analytics needed to address these company-wide challenges. So, a new vision was required to move security focus from static, segmented, network-based perimeters to focus on users, assets, and resources.
The Zero Trust security model (ZT), is a concept developed several years ago, to provide a collection of activities working together to give customers the best protection possible as their information travels across devices, apps, and locations around the world and based on the idea "never trust, always verify”. On the other side, the Zero Trust Architecture (ZTA) is a cyber security plan using zero trust concepts.
The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-207 provided the following operative definition of Zero Trust and ZTA2:
Zero trust provides a collection of concepts and ideas designed to minimize uncertainty in enforcing accurate, least privilege per-request access decisions in information systems and services in the face of a network viewed as compromised.
ZTA is an enterprise’s cybersecurity plan that uses zero trust concepts and encompasses component relationships, workflow planning, and access policies. Therefore, a zero trust enterprise is the network infrastructure (physical and virtual) and operational policies that are in place for an enterprise as a product of a ZTA plan.
As you can see, these concepts don´t refer to a single technology, although they are sometimes described in that way, but a collection of solutions that, working together, provide customers with the best possible protection as the information travel across devices, apps, and locations around the world. Read also "Zero Trust is a Way of Thinking".
The aforementioned solutions must cover needs ranging from access control or privilege management, to the monitoring of certain events or data classification.
CyberRes, a Micro Focus line of business, has a broad portfolio of security solutions that can help to prepare, prevent, detect and remediate the vulnerabilities and risks related to the previous requirements. These solutions can provide:
- Identity and Access Management. Centrally managing identities for all users, devices, things, and services. For example, with Advanced Authentication, preventing credential theft from being effective or preventing a normal user from acquiring account privileges.
- Application Security. Eliminating risks of attacks on business applications and detecting vulnerabilities.
- Data Privacy & Protection. Identifying critical, personal data and giving them protection based on Encryption.
- Security Operations. Accelerating effective detection and response to known and unknown threats.
- Analytics, Machine Learning. Based on behavior patterns, identifying attacks or preventing them when it is not possible in real time.
Are you ready for April Fool's Day?
BUT complete security does not exist, it is a state to aspire to, as customers must trust many different variables, including internal users. As an example and according to Verizon’s 2019 Data Breach Investigations Report, 34 percent of data breaches come from insiders. The proportion rises to 60 percent in healthcare and 36 percent in financial services—sectors containing information especially valuable to thieves.
After all, data protection solutions, with their recovery capabilities associated and aligned to the required service levels, are the ones that save organizations.
The most important countermeasure for any critical breach or data loss is a comprehensive backup and recovery strategy — planned, tested and regularly updated and documented that provides the last line of defense. This strategy must be based on an enterprise backup and recovery solution that can fits the different SLAs required by a specific company, and providing a unified data protection approach with the latest functionalities that address customer needs.
Keeping in mind all the above, one can ask the following questions when considering how to protect and recover our most valuable assets.
- Do you have backup and recovery strategy in place?
- How and where do you store backups?
- Is data safe from fire, floods, and human error?
- Will the necessary data be available whenever it’s needed after an accident has happened?
- And the most important one, are you really ready for April Fool's Day?
March 31st is the world backup day, is the day to backup your data, be ready in advance with an Enterprise Backup Solution!
1. Techtarget: Comparing data protection vs. data security vs. data privacy
2. NIST Special Publication 800-207
We’d love to hear your thoughts on this blog. Comment below.
The Micro Focus IM&G team
Know your data | empower your people | drive your future
Join our community | @microfocusimg | www.microfocus.com | What is InfoGov?