This Sensitive Data Discovery assessment identifies potentially sensitive information that may be out of regulatory compliance or may violate industry security best practices at a particular point in time. While this is an important step, it should only be considered one aspect of an ongoing security process that requires organizations to take preventative measures, respond to specific incidents, and resolve the root causes of security issues.
Sensitive organizational information can reside anywhere. It can be on laptops, mobile devices, on shared file servers, on portals, or in document management systems, in databases or USB drives and DVDs. With so many forms of storage, sensitive information isn’t always properly labeled or stored. Most organizations have few methods of verifying whether sensitive data may be at risk or how it moves into and out of the organization.
Sensitive data can be credit card and Social Security numbers, healthcare information, spreadsheets and word documents, proprietary source code or legal documents and more. An organization may have a process to designate and store sensitive information but not all users may follow the process or even be educated about the process.
Users, however, will still build spreadsheets full of sensitive data and store them on the file server or right on their laptops. Data can even exist locally for accidental reasons, such as a critical table in a database backed up before an upgrade and never purged, even though the data in it could lead to a hefty fine for the company if it’s ever compromised.
This discovery project will develop an integrated security strategy that: