Many business are unclear about data protection. What data is sesisitve and how do you protect it?
User credentials and privileged accounts are the most common data types involved in significant breaches, according to results of a new survey to be released by the SANS Institute on September 6, 2017, There is confusion over what constitutes sensitive data and what you need to be protecting.
“I used to consider data sources such as network and personnel directories as items that need to be protected—although not at the level of ‘sensitive’ data, such as financial and healthcare records,” says Barbara Filkins, SANS Analyst Program Research Director and author of the survey report. “Maybe access information needs even greater protection, given that this survey showed that user credentials and privileged accounts represented the most common data types involved in breaches.”
Access information is most sought after because it grants the attackers the same privilege as their victims. They often use this privilege to escalate and spread their attacks, allowing them to gather more types of sensitive information.
Other key data being targeted in significant breaches includes customer financial data, selected by 31% of respondents, and employee data and intellectual property, each chosen by 28%.
Knowing what the attackers are looking for is half the battle.
“When defenders know what attackers want most, they know how to prioritize their efforts,” says Benjamin Wright, an expert on the legal aspects of data protection and advisor on this project. “This survey shows how much attackers covet user credentials and privileged accounts.”
Understanding how data flows through systems, which is done by less than 4% of our survey sample, is an example of a step defenders can use to aid in both detection and remediation of breaches. Yet 62% indicate that identifying all pathways to their sensitive data is a key challenge.
“Drawing data maps and flows may not be perfect, but the process illustrates a key starting point,” continues Filkins. “A picture—or in this case a map—is worth a thousand words in understanding where to start protecting data.”
Full results will be shared during a Webinar on Wednesday, September 6, 2017, 1 PM EDT, sponsored by Infoblox and McAfee, and hosted by SANS. Register to attend the webcast at www.sans.org/u/vpK
Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst Program Research Director and data protection expert, Barbara Filkins.
Source PR Newswire
