sensitive data

Sensitive Data – What Should You Be Protecting?

Next Story

How Digital Health is Changing the World - Thought Leaders Meet to Discuss Innovation

User credentials and privileged accounts are the most common data types involved in significant breaches, according to results of a new survey to be released by the SANS Institute onSeptember 6, 2017, There is confusion over what constitutes sensitive data and what you need to be protecting.

“I used to consider data sources such as network and personnel directories as items that need to be protected—although not at the level of ‘sensitive’ data, such as financial and healthcare records,” says Barbara Filkins, SANS Analyst Program Research Director and author of the survey report. “Maybe access information needs even greater protection, given that this survey showed that user credentials and privileged accounts represented the most common data types involved in breaches.”

Access information is most sought after because it grants the attackers the same privilege as their victims. They often use this privilege to escalate and spread their attacks, allowing them to gather more types of sensitive information.

Other key data being targeted in significant breaches includes customer financial data, selected by 31% of respondents, and employee data and intellectual property, each chosen by 28%.

Knowing what the attackers are looking for is half the battle.

“When defenders know what attackers want most, they know how to prioritize their efforts,” says Benjamin Wright, an expert on the legal aspects of data protection and advisor on this project. “This survey shows how much attackers covet user credentials and privileged accounts.”

Understanding how data flows through systems, which is done by less than 4% of our survey sample, is an example of a step defenders can use to aid in both detection and remediation of breaches. Yet 62% indicate that identifying all pathways to their sensitive data is a key challenge.

“Drawing data maps and flows may not be perfect, but the process illustrates a key starting point,” continues Filkins. “A picture—or in this case a map—is worth a thousand words in understanding where to start protecting data.”

Full results will be shared during a Webinar on Wednesday, September 6, 2017, 1 PM EDT, sponsored by Infoblox and McAfee, and hosted by SANS. Register to attend the webcast at www.sans.org/u/vpK

Those who register for the webcast will also receive access to the published results paper developed by SANS Analyst Program Research Director and data protection expert, Barbara Filkins.

Source PR Newswire

The following two tabs change content below.
mm
Carlos Casanova is an internationally known speaker, IT architect, leadership advisor and the co-author of “The CMDB Imperative”. He has over two decades of hands on experience guiding CIOs and Sr. Leadership to achieve effective IT operations and improve ROI from infrastructure investments. His expansive experience enables him to quickly assess their true needs and achieve better business outcomes. He takes the complexity out of today's cluttered IT and business environments to simplify their goals in order to accelerate achievement and success.