10 Ways to Protect Your Organization from a Data Breach

1. Employee re-education of systems and protocols. Employees who go through regular phishing tests may be less likely to engage with malicious actors over email or text messaging.
2. Know your inventory. Inventories can be a part of the overall vulnerability management program to keep all assets up to date. Also, a data inventory or catalog identifies sensitive data and allows security controls like encryption, access restrictions and monitoring to be placed on the most important data.
3. Delete redundant data. Data that resides in multiple locations may not have equal protection in each environment. Understanding what data is required and what can be archived helps to keep control over data.
4. Early detection systems. Today's XDR (extended detection and response) and EDR (endpoint detection and response) systems include automated responses to common attacks. These detection systems can be monitored by internal cyber security staff or third-party security companies, such as managed security service providers (MSSPs).
5. Data back-ups. Having a robust, immutable data backup plan can help an organization quickly recover from an incident. The frequency of the data backup depends on the risk the organization is willing to take. "Can we afford to lose a week's worth of data or a day's worth of data?"
6. Limiting staff access. Establishing processes for provisioning and de-provisioning user access with approvals, audit trails, reports and regular attestations can limit what an attacker may be able to access in the event of compromised credentials.
7. Hire a third-party company to conduct a security audit. An outside assessment of your organization’s security posture, based on established cyber security frameworks such as NIST or CIS, can provide a clearer picture of strengths and weaknesses and a road map to address your greatest vulnerabilities.
8. Establish new passwords with two-factor authentication. Traditionally users are authenticated by one of three ways: What you know (password); what you have (card access or one-time passcode); or what you are (biometrics). Adding a second factor to the ubiquitous password authentication adds another layer of security for access.
9. Update your computer programs with the latest security features. Establishing a vulnerability management program that regularly scans software assets and applies patches is one of the most crucial security activities a company can perform.
10. Physical security. Reinforcing clean desk policies and reviewing physical access controls, including access to secure areas, may be required to ensure assets are not stolen or lost. Work-from-home employees who have company assets should be routinely educated on keeping those assets secure while at home as they would in the office.

“In our role as data security experts, we have found that some companies, especially smaller ones, can be lulled into a false sense of security believing that perpetrators will not bother with them­ — this is absolutely not the case. The results of this survey should serve as a reminder that companies of all sizes must invest in data security protection, resources and education, particularly as we return to in-office activities."