If you follow the news, you know that this is the era of data theft and data regulation.
Incidents of mass identity theft occur on a regular basis and legislators have
passed literally dozens of laws aimed at controlling how businesses handle sensitive
data-financial, consumer and other. These are signs of changing times, where the
definition of a valuable asset has evolved to include the information stored in
business data centers all over the world. Data is not only an essential part of
doing business in the twenty first century it also has a black market street value-like
a precious stone or a luxury car, but much more portable. This street value is
driving a new generation of thieves who target information from Social Security
and credit card numbers to account numbers and passwords. Electronic information
is at greater risk than ever before.
In response to this risk, information with any sensitivity or value is now
being regulated. And regulation is forcing companies to pay close attention
to information assets-including where they are and what is happening to them.
The main demand that regulators are making is that businesses have enough visibility
into information assets to know what's going on- so that they can identify when
something goes wrong and have enough information to right it. In fact, visibility
is the underlying requirement of every information protection law from SOX,
the Payment Card Industry standard (PCI), Gramm-Leach-Bliley, HIPAA and the
European Privacy Directive.
Complying with data-focused regulations has become a huge part of doing business
and considering that virtually all corporate information is linked to IT systems
and data stores, technology plays a huge role. Establishing adequate controls
over what happens to critical corporate information is a major challenge, because
businesses rely on easy access to data to stay competitive. Creating a balance
between enabling business, through easy access to data, and protecting information,
by making sure that only the right people access the right data for the right
reasons, is the end goal.
So how do companies ensure data protection and privacy in the age of smart
thieves and wider access to information in corporate data centers? The first
step is to take a different view of data. Recognizing data as a critical corporate
asset helps in visualizing how it should be protected. After all, every company
has clear guidelines for how they should handle their money, including processes
for who can access that money, and what they can and cannot do with it. In addition,
they have processes for how those funds are tracked, documented and reported.
1