Smarter Data Security: Improving Protection across Connected Digital Environments

The movement of business information across cloud platforms, internal systems, applications, and devices has made protecting that data a more complex operational task. Security teams must be able to track the locations of sensitive data, who has access to it, and how it flows through an organization. Manual checkings can be tricky to keep up with, especially as the amount of data increases.

Some automated security controls can take care of mundane monitoring, access controls and policy enforcement, while allowing for experts to dedicate more time to investigating security incidents. Automated data security solutions are thus playing a more crucial role in effective data protection strategies, especially for businesses using sensitive data like that related to customers, finances and operations.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

Market Shifts in Automated Data Protection

The market is progressing towards security platforms that can secure information across multiple environments and not just one repository at a time. Cloud storage, databases, applications and endpoints are frequently deployed under varying configurations, leading to the creation of varied and difficult-to-manage security controls.

Automated discovery tools can search through data stores and mark and organize records based on profiles. Improved classification enables more effective controls to be implemented at higher risk locations, and less significant restrictions to be imposed on routine business information.

Access control systems are also getting smarter. Static permissions can continue to be in effect when employees move to a different role or when they no longer need to access certain information. Automated systems can audit user roles and access activity, and modify permissions based on set policies. Behavioral monitoring takes it further by spotting unusual logon times or file access, which can indicate unusual activity. These controls can enable organizations to keep access at the right level without the security teams having to go through each change in permissions.

Data loss prevention is increasingly linked to automated monitoring. Security systems can monitor data transfers over email, cloud storage and endpoints and compare activity to organizational policies. If a transfer is made that conveys sensitive information, it can be subject to further verification, it can limit movement, or be the subject of an alert for review. Sensitive data can also be automatically encrypted, ensuring it is protected properly at all times, in all places, and across all storage types. With distributed data, consistency can be maintained with centralized policy enforcement.

Security Challenges and Practical Solutions

Security alerts can cause stress for security teams, and it may be harder to identify important events when there are a lot of alerts. An automated risk scoring offers a practical answer and assesses events based on data sensitivity, access history and user behavior. Regular activities may continue following established rules, but those with higher risk levels may be subject to investigation. In cases where there is not enough context in the message or an automated response may impact legitimate business activity, human review can still be valuable.

"An automated risk scoring offers a practical answer and assesses events based on data sensitivity, access history and user behavior."

Secure information across hybrid environments can also provide management challenges. Cloud platforms and internal systems may have different configurations and security policies. A centralized policy management approach can give a single policy framework, and then individual controls can take into account the technical requirements of the individual environments. Gradual integration is helpful when the legacy systems are not capable of supporting modern security interfaces. Gateways and monitoring layers can be used to gain visibility without the need to replace existing applications in one fell swoop.

Governance of automation needs to be done with care, as badly configured automation can lead to operational disruption. It is possible to discover surprising effects when testing security policies in controlled environments prior to deployment. Clear response thresholds can also be used to differentiate between what needs to be done automatically and what needs to be approved. Expensive decisions, such as blocking critical access to business, can still be subject to human authorization.

Advancing Capabilities and Stakeholder Value

Machine learning is being used to help detect patterns of behavior that may not be defined in rules to protect against security threats. Access paths that do not follow the norm, or transfers or changes in system activity, can be assessed against defined behaviors. The best use cases are those that use statistics in conjunction with traditional security measures, not exclusively relying on automated predictions. Even in the face of uncertainty, sound information and good judgment are crucial in determining the way the organization should act.

Security orchestration is also helping to improve the way that various controls interact. When one system identifies a suspicious event, it can trigger a series of events across various aspects of identity management, endpoint protection and access control. A coordinated response can help minimize the time between detection and containment, as well as repetitive work by the security team. It also establishes uniformity in the response process for various types of incidents.

The other functional advantage is automated compliance monitoring. Access permissions and configurations, as well as data locations, can be continually validated against internal policies or regulatory mandates by security platforms. Automated records enable compliance teams to pinpoint areas in need of attention and provide better evidence of the effectiveness of controls. Continuous monitoring can also help to minimize the need for periodic manual monitoring.