In-Depth
Security Expert Details Steps to Protect Enterprise Data Against Modern Threats
In a live, online Virtualization & Cloud Review
event today titled Securing Enterprise Data Against Modern Threats, presenter Brien Posey discussed tactics for protecting enterprise data against breaches, leakage and ransomware attacks. The March 3 webcast was sponsored by Rubrik, a leader in Zero Trust Data Security, and is available for on-demand replay.
Posey, a freelance technology author and former Microsoft MVP, focused on "defending the data layer," describing how modern attacks unfold, where common defenses fall short and what steps security teams can take to reduce risk before incidents escalate.
"Security is every bit as much about behavior as it is about technology. You can have all the technology that you want, but unless you condition your users and your IT staff to follow security best practices, all of that technology that you've implemented is only going to get you so far."
Brien Posey, 22-time Microsoft MVP
Why the Data Layer Keeps Getting Targeted
Posey opened by defining the data layer in plain terms: "the data layer is where an organization's important information lives." He said that could include customer records, employee data, financial details and intellectual property. Using an analogy, he added, "if your applications are a storefront, then the data layer is the vault in the back of the room," and emphasized, "without protecting the data layer, nothing else really matters."
From there, Posey described how data leakage and breaches can start with routine mistakes or common gaps. In the leakage context, he cited examples like a weak password being compromised, an attacker using a hacked employee account to download large volumes of data, and "misconfigured cloud storage that's left open to the internet." He also reviewed the downstream impacts organizations often face after sensitive data escapes, including financial loss, reputational damage, legal and regulatory consequences, and operational disruption.
Posey also stressed that breaches often look nothing like dramatized "hacking" scenes. "Most data breaches don't look anything like Hollywood hacking scenes," he said, before walking through typical attack paths such as phishing, exposed databases and password reuse. He said attackers increasingly aim to obtain valid credentials and blend into normal activity long enough to move through environments and access data. Posey also highlighted the human element in many incidents, pointing to examples such as phishing clicks, incomplete offboarding that leaves accounts active, and overly broad access. "Security is every bit as much about behavior as it is about technology," he said.
Core Protection Principles
After outlining how organizations commonly lose control of sensitive data, Posey shifted to "core protection principles" that he described as basic but important. The session covered multiple principles; below are the first four, which Posey introduced as practical starting points for reducing risk.
Know What You Have
[Click on image for larger view.] Know What You Have (source: Brien Posey).
Posey said inventory and visibility are prerequisites for protecting sensitive information. "You can't protect data you don't know exist," he said. He recommended identifying sensitive data across the organization, confirming where it is stored and being able to determine "who is able to access that data and what level of access each account has."
Limit Access
[Click on image for larger view.] Limit Access (source: Brien Posey).
Posey framed least-privilege access as a way to reduce blast radius after initial compromise. "Only give people access to the data that they truly need," he said, adding, "if everyone has access to everything, then you don't really have security." He noted that even with perimeter defenses in place, once an attacker gets through, broad internal access can make "everything" effectively available.
Encrypt Data
[Click on image for larger view.] Encrypt Data (source: Brien Posey).
Posey described encryption as a way to reduce the usefulness of stolen information. "Encryption turns readable data into unreadable code," he said. "If somebody steals it, they can't use it unless they also happen to steal the key."
Use Strong Authentication
[Click on image for larger view.] Use Strong Authentication (source: Brien Posey).
On authentication, Posey emphasized strong, unique passwords and steps to reduce reuse and exposure of compromised credentials. "I'm talking about requiring strong, unique passwords and taking steps to ensure that passwords aren't reused and the compromised passwords haven't been used," he said. He also pointed to password managers and options such as "biometrics or hardware tokens," adding, "I do really like the idea of using hardware tokens."
Posey covered additional principles beyond these four during the session, along with broader guidance on preparedness and response. Those remaining principles are available in the on-demand replay, where you can find the rest of Posey's core protection principles and much more.
And More
Posey also shared much more guidance around defending the data layer and preparing for incidents, which can be seen in the on-demand replay. While replays are fine, especially if timely (this was just today, after all), one of the best things about attending such online education summits and events is the ability to pose questions to the presenters, a rare opportunity for expert, real-world, one-on-one advice (not to mention, prize giveaways, in this case $10 Starbucks gift cards provided by Rubrik). With that in mind, upcoming Virtualization & Cloud Review webcasts and virtual events can be found on the publication's webcast listing page here.
About the Author
David Ramel is an editor and writer at Converge 360.