Guidelines for Handling Sensitive Data Inside Your Business

 

Restrict Access Based on Authorization and Location

The first step to safe sensitive data handling in the workplace is to restrict access. It’s probably true that only a handful of specific employees need direct access to a company’s stored sensitive data. Likewise, only a few processes and programs run on company computer systems might have a legitimate reason to directly access sensitive data. In many circumstances, there’s no need for sensitive data to ever be accessed or transported outside a physical space. 

So close all other points of access. Only give employee authorization to those who need access. Limit access only to specific monitored workstations inside the office. Or only permit a specific program with decryption codes to access the data under any circumstances.  

 

Create a List of Approved Uses for Sensitive Day

What is sensitive data being used for in your company? For example, you would use a customer’s financial data to bill them and possibly to build analysis models for trend-spotting. You might use a customer’s home address to geo-target advertisements, or you might use a customer’s IP address to provide better local online services. But the number of things your company does with sensitive data can be written in a finite list.

Determine all the approved uses of sensitive data inside the company and make that your White List. Prevent and ban all other uses of sensitive data and excuses to access it.

 

Prevent Unauthorized Copies of the Information

Copying sensitive data is a huge risk. Whether employees make a digital or printed copy or even jot down notes on a scratch pad, this is now sensitive information that could leave the secured and encrypted confines of the company. An employee with a copy of information can lose that copy in public or give it to another person who will misuse the sensitive data. So don’t allow copies unless through an approved data use process. Prevent anyone from copy-pasting text, block digital file copies from being made without authorization, and do not allow printing by default.

 

Trigger Notifications When Sensitive Data is Accessed

One of the best ways to prevent accidents is with constant oversight. Create a log for routine and approved sensitive data access. And if any sensitive data is accessed outside of 100% expected conditions, then create a notification for the security admin. This quick heads-up that sensitive data is being accessed might be enough to detect and prevent a major breach. Any time your servers containing sensitive information are accessed without the right authorization, decryption, timing, etc. will create a security incident that will need to be checked out and cleared. This concept is much like when Google alerts you to a new device login. Just in case it’s a hacker in another state.

 

Automate Complete and Audited User Removal

A critical element of sensitive data security is data deletion. When a customer deletes their account or asks for data to be destroyed, it must be destroyed completely. This means removing all lingering sensitive, personal, and possibly public information about that account-user from your servers. No identifying information can remain when an account is closed.

To do this, build a system of combined automation and auditing. Start with an automated clearing and complete deletion of all known information about the removed user. Then alert an admin to run a data audit to identify any residual sensitive data of the user and remove it. This way, the user leaves no revealing data behind when they complete their business with your company.

 

 

Control Visual Display of Digital and Printed Sensitive Data

When sensitive data is being displayed on a screen, control where those screens point. Do not allow unauthorized or uninvolved employees (or non-employee persons) to see the sensitive information being displayed. Just because they are not controlling the device does not prevent them from discovering something private about a customer, partner, or employee.

Likewise, print safety is a must. Consider limiting sensitive data printing to one printer in a private room. Require that sensitive data printing is done directly, from the same as room as the printer, so that there is no possible loss of control over the data as employees run to the printer room. Prevent printed sensitive data from being displayed, waved around, or left unsecured on a desk.

 

Lock Up Printed Documents Containing Sensitive Data

Always lock up printed documents that contain sensitive data. An inbox and outbox on a desk is insecure and anyone could fish through the files while the desk occupant was away. If your business must keep sensitive data on paper, it’s required to store them in locked boxes or filing cabinets to prevent unauthorized access or the possibility of physical data theft.

 

Fully Encrypt All Stored Sensitive Data

Encryption is essential for digital data security. Encryption encodes all the data you have stored so that only a program or user with the exact right decode can read the data. For anyone else, your encrypted data looks like garbled gibberish. It can’t be read, which means the data is secure even if it’s stolen. So encrypt everything from end-to-end. Especially stored sensitive data. Ensure that your sensitive data servers are encrypted and that decryption is not automatic for every device in the building. If you transfer data, make sure it is encrypted during transit.

 

Never Send Sensitive Data in Plain Text Communications

Speaking of transferring data, communication has become one of the key sources of sensitive data breaches. Emails, text messages, and chats can be intercepted by hackers or screen-shotted and shared. For these reasons, never send sensitive data as plain text in communication. If you must share this information, like confirming a shipping address with a customer, use secure links or shared online documents that only authorized customers can open. This removes another potential layer of sensitive data exposure. 

 

Delete Sensitive Data After Its Use is Complete

Last but not least, if you make a copy of sensitive data then make sure it is fully deleted once the purpose is done. The company needs only to have one central store of sensitive data (plus backups). No need for employees or teams to carry around their own copies of your company’s most security-vital data on their phones and laptops.

Create protocols that ensure all locally stored or copied sensitive data is deleted once the local purposcovae is complete. This way, there are fewer instances of the data to access and steal. Contact us for more information about data classification and how to secure your business’ sensitive data.