Think about all of the information your organisation holds. Millions of pieces are broadly split into only a couple of categories:

Customer Data

information you hold on all of your customers

Third-Party Data

Suppliers details, Delivery Partners, training and development providers, etc.

Employee Data

Bank details, name, address, performance reviews, achievement, and disciplinary.

Company Data

Strategy, analysis, financials, USP, the direction of travel, Road Map.

All of this data needs to be protected and kept secure so that it doesn’t fall into the wrong hands or get misused in any way. There is also a regulation with which you need to comply called the General Data Protection Review or GDPR for short.

When creating, implementing, and carrying out your operational plans, you need to consider the impact this will have.

For example, when running a marketing campaign, are you complying with GDPR if you send out a marketing campaign to all of your existing customers?

If customers are going to purchase products and services online, how do you protect their data?

If you are completing appraisals and 1-2-1 performance reviews with your managers and employees, how do you ensure that their performance data is kept confidential and secure?

Data security is the process of protecting sensitive information from unauthorized access. Whether it’s your organisation’s servers where all of your customer’s information is stored or your shared documents where employee performance reviews are kept. The sensitive information inside needs to be kept secure.

Data security is important for your organisation because a breach can have very serious repercussions. Here are just three of them:

Breaching regulations can bring heavy fines
Having customer data stolen can cause financial and reputational damage
Having strategic information leaked to competitors could lose you the edge

Consider the conflict it would cause inside your organisation if employees’ details were leaked. How would one manager feel if they found out they were paid more than the other? What issues would it cause if one employee found out others were receiving development opportunities and they were not? This would pale in comparison to losing your employee’s bank details in a cyber-attack.

Most organisations will have an IT team and sophisticated software in place to stop hackers and cyber-attacks, but you need to consider what you must do day to day to support data security.

Let’s look at some of the terminology used and how we can protect ourselves and our colleagues from the associated risk.

Data Security

Data Security

Refers to protecting your data against unauthorised access or use that could result in exposure, deletion, or corruption of that data. An example of data security would be using encryption or password protection on an email or document to prevent other unauthorised employees or external people from gaining access to the information.

Data Protection

Data Protection

Refers to the creation of backups or the duplication of data to protect against accidental erasure or loss. An example of data protection would be creating a backup of your data, so if it was corrupted you wouldn’t lose that data forever. For example, you might make sure that marketing and sales strategies are backed up to a USB stick to ensure they can be recovered.

Data Privacy

Data Privacy

Refers to concerns regarding how your data is handled. Regulatory concerns, notification, consent of use, etc. An example of data privacy is gaining consent to collect data from website visitors by using cookies.

Data Security Threats

When we think about data security threats, we often consider someone hacking our organisation’s servers. However, the truth is that most threats are related to unsafe behaviour by employees. For example, one of the most common root causes of data breaches in 2020 was linked to weak passwords.

One of the other top causes was Phishing Scams which with the right training around data security, all employees should be able to avoid. For example, if you get an email from someone pretending to be your bank, you don’t open the link. You delete the email and call your bank. The same can be said for dodgy emails being received at work.

Your organisation might be large enough for hackers to see it as a target worth engaging with, so teaching your employees how to spot such attacks is just as important as the expensive firewalls and anti-virus software your organisation might have.

Technology – Helping You Keep Your Data Secure

Depending on your organisation, some, or all of these could be technologies you already use or should consider implementing.

Authentication

Authentication is the process of verifying a user’s login credentials (passwords, biometrics, etc.) to make sure it’s really them. For example, some laptops now come with fingerprint recognition and most mobile phones now have Face ID. Authentication is one of the most important parts of your data security strategy because it’s a frontline defence against unauthorised access to sensitive information.

When it comes to software there are new technologies such as Single Sign-On, two-factor and multi-factor authentication (for example, signing in with a password and then confirming it really is you by clicking a link sent to an App on your smartphone), and Breached Password Detection (Used by Google for example).

Authentication isn’t just linked to hardware and software. It could mean restricting access to certain parts of a building. Your offices may have a key card that lets you gain access or there could be a simple pin code locking mechanism.

Encryption

Data encryption scrambles sensitive information with an algorithm so that it can’t be read by someone without the specific information (the encryption key) required to unscramble it. It’s an incredibly important data security tool because it ensures that even if someone gains unauthorised access to your information, they won’t be able to use it. You should always ensure that your encryption keys are stored securely and that access to them is limited to as few people as possible.

Tokenisation

Tokenisation is similar to encryption. However, instead of scrambling your data with an algorithm, it replaces that data with random characters. The relationship to the original data (the “token”) is then stored in a separate protected database table.

Data Masking

Data masking does not transform your data into an intermediate form but rather is achieved by “masking” your data’s characters with proxy characters. Software reverses it once it’s delivered to its end destination.

Best Practice for Data Security

Manage access to sensitive information

Managing who has access to your data based on their employee ID is a great way to keep sensitive information restricted to only those who need to see it. This limits the amount of damage that can be done if someone’s username or login details are stolen.

Encrypt everything

Encryption is one of the best tools that you have to keep data safe. It helps you ensure that hackers can’t use any information they might get hold of. You should also make sure you encrypt sensitive emails and other transmissions to add another layer of security to any information you send.

Train your employees

If employees are trained on things like Password creation and Spotting Phishing emails, they can support you in the fight against data security threats. Leave them to get on with it and then could become the root cause.

Data recovery plan

Have a data recovery plan in place. Losing data or having it stolen is bad and prevention is always the best policy. However, if for any reason information is lost or stolen, failing to recover it could make things worse. Always have backups of business-critical data.

Delete unused data

If you no longer need the information and it can be deleted – then delete it. Make sure you delete electronic and any hard/physical copies so that the data doesn’t get forgotten about and therefore lost or stolen.