THE hackers are winning the arms race. AI has turbocharged both the discovery and exploitation of vulnerabilities to the point where you should simply assume that your organisation will at some point be hacked. This is not to say that you should give up on cybersecurity – far from it – but the old adage that “you have to protect everything and they only have to find one flaw” is truer than ever.

So, if you accept that you will be hacked, what can you do to limit the damage? This is where good data protection practices come in. What may once have felt like annoying bureaucracy or frustrating limits on business freedom now looks like good common sense. Here are our top six actions you can take today to limit your exposure.

1. Don’t over-collect

The more data you have, the more data can be breached. Data protection regulations have always required you to stick to the principle of necessity – collecting only the data you actually need and only at the time you actually need it.

Many organisations break this rule, either out of belief that more data is better or because analysing processing to determine what is really needed when has seemed too hard. One great advantage of the same AI tooling that has increased the threat is that it simplifies the response; it can help you analyse your processes to work out what data you need when, and to distinguish data that has real value to the business from that which you’ve collected just because it might come in handy some day.

2. Don’t over-retain

The other side of the data minimisation coin is getting rid of data you no longer need as soon as you possibly can. Just like over-collection, we have a tendency to hang on to data “just in case” – a bit like that box of tangled cables, random screws or half-used batteries we all have in the cupboard somewhere.

Unlike your junk drawer, however, if someone breaks in and steals your hoard you will face regulatory sanctions, ransom demands and litigation. So you need the discipline always to channel your inner Marie Kondo and ask “does this spark joy?” If it doesn’t, bin it – properly and securely.

3. Limit access

Many, but not all, hacks work by compromising a user. In particular this is what attackers are doing when they send you phishing emails. This means that the damage they can do is limited by the permissions the compromised user has been granted.

Start by working out exactly what data each person needs to do their specific job, and think about this in a granular way. It’s not just whether or not they can access a record, it’s which bits of the record they actually use, and whether they need to ability to download, change or delete it. If they can’t, neither can the attacker.

4. Control processing

We all love Excel. Don’t we? Spreadsheets are the application that drove the adoption of desktop PCs and the ability to do extensive and elaborate ad-hoc data analysis is still a big part of many organisations way of working. But every spreadsheet containing personal or commercially-sensitive data is an additional source of breach risk.

And if you don’t know someone has that data, you can’t protect it properly. This is why your Record of Processing Activity (RoPA) is so important: it tells you where all your data is, who is processing it, how and why. Making sure that no-one creates off-record repositories of data not only mitigates your breach risk, it also drives efficiency, deduplication and data quality. It’s a win-win-win-win.

5. Stop using attachments

Combining all of the principles so far, this one is a crucial step in mitigating breach risk. File attachments in emails are evil. They can go to the wrong person, inside or outside the organisation; they persist in people’s inboxes even if the original file has been deleted; they risk reliance on out-of-date information; they don’t appear in the RoPA so you don’t know they exist; the user (or anyone who’s acquired their credentials) has complete control of the file.

Yes, cloud links can be a pain, but it’s good pain – if the receiving user has to verify their credentials to access the file, so does a hacker, and if the link has expired, the underlying file has been deleted or the user’s access has been revoked, that’s entirely the point. And, crucially, your IT department can track every access to every file via a link; an attachment is completely outside your control once it has left the organisation.

6. Encrypt, partition and pseudonymise

Data is an asset; one that can be stolen, vandalised or mislaid. If you have a physical asset like gold or a Picasso, you don’t just leave it lying around, do you? Think the same way about data. If you encrypt it, and keep the encryption keys safely segregated, you need worry less about breaches because the stolen data will be of no use.

If you separate the data values from the keys – putting critical identifiers in one place, and associated data fields in another - you can put your effort into protecting the keys while allowing the values to be easily accessible for analysis. Much of what you are doing with data won’t need the keys, including training AI models, looking at trends and producing aggregated reports, but without those keys the data is of far less value to an attacker.

These are just a few examples of how data privacy can enhance your cybersecurity without hindering operational effectiveness. If you ‘d like to learn more, drop us a line at info@securys.co.uk or visit our website.