Blog: Data breaches: how do you mitigate the risks?

In the first part of this two-part series, we told you what a data breach actually is and what the consequences can be. In this second part, we look at how you can mitigate the risks of a data breach.

In today's digital world, where data is invaluable, preventing data breaches is paramount. Most data breaches occur when organisations share data. To ensure data security and prevent data breaches, there are three key areas to put in place in the internal organisation: legal, processes and governance.

Legal

The first domain, legal, covers the legal aspects of data sharing. Before data can and should be shared at all, certain legal aspects need to be established. A crucial step for data sharing is drawing up a processor agreement between the controller and the processor. This agreement contains agreements on what the processor may/should and should not do with the personal data supplied by the controller. Security policies and the purpose of processing are some of the things that should be included in this agreement.

Processes

The processes domain plays an essential role in preventing data breaches. This is where all data sharing steps and procedures are defined and implemented. First of all, it must be determined what data will be shared. The principle of minimisation is important here: if certain data is not needed, it should not be used or shared.

In addition, it is important to know where data comes from and how it is brought together. Because, separating data that does not need to be stored together is also important for data security. Then it is essential that if the data are to be linked, the right procedures are in place for this. This is where data quality and data management come in. Data quality is a crucial aspect to ensure that the data is reliable and accurate and therefore the right links can be made across different databases.

Once these links are made and a unique customer view is created, consideration must be given to what form of data is shared. If data is leaked for any reason during a step within the process, you want to limit as much damage to the consumer as possible. Therefore, techniques such as hashing and encryption are often employed to ensure that if data is leaked it is not readable. Here again, data quality comes into play. Encrypted data can only be recognised and matched if the data match exactly. Quality and uniformity therefore form the basis for effective use of these techniques.

Once data is minimised, encrypted, linked and quality optimised, it can be processed. The important consideration remains: for what purpose do you share data, how important is it for you as a company and, above all, what impact does it potentially have for consumers. In this context, it is therefore always important to weigh up which data you share and whether you subsequently achieve the intended purpose. Next, processed data must be delivered to the data controller. Although it sounds logical to have delivery take place via secure channels, it often happens - even in large organisations - that files are ‘simply’ shared via e-mail. For instance, because unauthorised persons or employees not involved in data processing play a role in this process. This is one of the most common data breaches. Ways by which data can be securely delivered are channels such as an SFTP, an API or Cloudsharing. This then also ends the process of data sharing and processing.

Governance

The third pillar, Governance, is crucial for ensuring data security during sharing. While much of the responsibility is determined in the legal domain, the steps in the process must ultimately be carried out by people. It is important to determine what positions these people hold and whether there is segregation of duties or whether one person can do everything. It is essential to have clarity on who performs which steps. Not everyone should have access to all data during the process. Specific data specialists can be responsible for certain data sets, while others do not have access. Data visibility should also be considered during the process. Data can be encrypted to prevent it from being inadvertently visible and if leaked, damage is limited. Finally, there should be oversight of the processes and their security. This oversight can be done by the Data Protection Officer (DPO), the legal team or other relevant stakeholders.

Holistic approach

Preventing data breaches requires a holistic approach integrating legal, process and governance aspects. Organisations should ensure that they have a solid foundation in terms of legal, in which clear agreements are laid down. Processes should be optimised and data sharing should be done according to a well thought-out plan. In addition, governance structures should be put in place to assign responsibilities, set access restrictions and monitor security. By observing these three areas, organisations can take proactive steps to prevent data breaches and ensure data confidentiality and integrity.

Tips to prevent data breaches

So preventing a data breach does not have one golden rule or approach. Danger can come from a small corner. A holistic approach reduces the risk of a data breach, but it is not integrated into day-to-day operations overnight. Therefore, we provide 5 pragmatic tips from our domain that will reduce your data breach risks as much as possible tomorrow.

Data minimisation

Within your organisation, ensure data minimisation. Only use data you really need. At each step where data are used, ask yourself: ‘Do I need this data? Do I need to extract it?’ And if the answer to the questions is ‘no’, don't request it and don't use it. So for example, if you don't need BSN numbers, despite being allowed to have them. Then don't use them either and delete them from the database. This way, you limit the severity of a data breach, should it occur.

Security

Make sure you have good firewalls and up-to-date software. It is important to secure data on devices with multiple authentication. Should a device be lost, you limit the damage in case of a data leak. Here, as mentioned earlier, hashing or encryption can also help.

Create awareness among employees

Make colleagues and employees aware of the possible risks. Where necessary, provide training to minimise the risks. Use secure passwords and do not leave them lying around the office. Do not use public local networks. Criminals can misuse or even mimic these networks to look in on your computer.

And always think critically when sending sensitive data or being accessed by people you don't know. How sensitive is the data you are working with? Is this the most secure way of transferring data? Are you being approached by a person you don't know. What do they want? What questions are they asking? Are there any irregularities? Et cetera. Don't trust it? Then contact the privacy officer within your organisation.

External help

While some components, such as creating awareness, are relatively pragmatic solutions to prevent the risk of a data breach, components such as setting up a secure infrastructure, unifying data, hashing and matching are not so easily done for many organisations. Especially considering you want to focus on your core business. Fortunately, there are organisations that can help secure your organisation and processes as much as possible, so you don't have to step away from your core business. These trusted third parties help you as a company to set up and carry out these steps.

Thus, EDM helps organisations improve and standardise personal and address data by means of data quality. Data are hashed if necessary. And matching can be facilitated through smart and secure matching routines. The legal aspect is also a prominent part of the service. With knowledge and experience in data processing, engineering, data delivery and cloud, EDM offers pragmatic solutions tailored to your specific needs, which will have an impact tomorrow on data security, process optimisation and risk mitigation.

If you want to know how EDM can make your organisation future-proof, read more about our data & cloud expertise. Or contact us and we will be happy to discuss this topic with you.