Safeguarding strategic data in the digital age has been saved
Perspectives
Safeguarding strategic data in the digital age
Moving toward managed data protection
As data becomes more valuable, voluminous, and vulnerable, data security needs have outpaced most organizations’ skills, knowledge base, and technologies. As a result, data privacy management demands often exceed available resources. Explore how our Managed Data Protection capabilities can help your business with new risks and opportunities.
Data is now a strategic asset
Executive teams and boards now recognize data as a strategic asset. They commercialize it. They value it when they buy or sell a business, seek partners, or engage in innovation. They want it organized, leveraged, and protected.
Data has business value, and it has cost value. Here’s why:
- Business value translates to increased revenue and profitability. The business value of data stems from opportunities to grow the business, develop products and services, enter markets, create efficiencies, attract partners, and win customers.
- Cost value translates to lost or forgone money, intellectual property, partners, customers, privacy, and reputation. The cost value of data stems from the risk of loss, theft, misappropriation, corruption, or exposure of data.
Moving to value-based data risk management
Since organizations can’t completely protect all data, they must develop a program to help the enterprise leverage data for business value and protect its cost value. This is value-based risk management.
After identifying data elements and their value to the business, data protection initiatives can then be prioritized and planned. Failing to create an effective data protection program—or creating one that doesn’t account for the value of various data—invites problems. These problems include too many alerts; a false sense of data security; and wasted time, money, and effort.
A value-based approach:
- Assesses the business value and cost value of the enterprise’s data
- Develops a governance structure geared to the data’s value, uses, users, and locations
- Creates goals and a roadmap to building the data protection program
Looking to better manage new sources of data?
Data protection is no longer a DIY proposition
Single or disparate tools alone can’t protect data, and organizations often struggle to manage them. Challenges include the following:
- Organizations have a massive list of “crown jewels” and lack the ability/authority to prioritize. In addition, they’re rarely positioned to tie value of data elements to the business.
- Extending data protection programs to the cloud requires careful assessment of staff skills, processes, and tools. Cloud adoption can take years, requiring data protection for a hybrid environment of premises and cloud applications.
- Data loss prevention (DLP) and cloud access security broker (CASB) tools aren’t set-it-and-forget-it applications. Out-of-the-box rulesets rarely deliver real value without customization and tuning by experienced engineers.
- Finding and retaining staff with skills to manage technology, and to work with lines of business to translate requirements into controls, can be difficult.
In addition, cloud migration, data commercialization, post-merger or acquisition integration, or new or evolving regulations can place impossible demands on IT.
Where data security management fits
DLP and CASB are complex, high-maintenance technologies and few organizations find it feasible to design and maintain a true data protection program, which entails:
- Addressing the value of data, regulatory requirements, data access and use policies, operational processes, and end user training awareness
- Integrating tools and processes for ticketing, reporting, monitoring, and asset management, and hiring and managing full-time staff
- Assessing outcomes and driving improvement, including remediation, risk reduction, and analysis of trends
Organizations also benefit from broad industry and regulatory expertise and knowledge of leading practices for protecting data in software as a service (SaaS), platform as a service (PaaS), and infrastructure as a service (IaaS) environments.
Stay one step ahead with cybersecurity risk management
Why Deloitte Managed Data Protection?
Deloitte Data Security Management provides people, processes, and systems for:
- Conducting data discovery and prioritization, so you know what data you have, where it is, who uses it, and for what purposes.
- Valuing data both on a business-value and compliance basis and on a cost-value and risk basis, so you can assess and prioritize your data protection needs.
- Developing a tailored ongoing data governance model for your organization.
- Monitoring data access, exfiltration, and restricting download of valued data to unsanctioned devices, so you have far greater control over your data.
- Providing greater visibility and control over your content and context of data use so your users remain productive. This includes who’s accessing your data, what they’re doing with it, and whether or not that access is permitted under certain circumstances.
- Providing visibility into a potential data breach to remediate more quickly and lessen the impact.
This comprehensive, programmatic approach to data protection provides better scalability than tools-focused approaches and relieves some of the unmanageable burden placed on IT departments.
Our Data Security Management capabilities and outcomes include:
- Program management. Achieve business-focused results by aligning program priorities with the value of data, applying best practices, and translating requirements into action.
- Ruleset management. Create and customize data protection rulesets considering your specific industry and regulatory environment. Accelerate time to value with Deloitte’s leading practices and experienced engineers.
- Alert handling. Provide a timely response and notification to the client when our analysts detect risk behavior.
- Application heath and updates. Monitor and manage application health. Track, test, and deploy software updates adhering to stringent change management processes. Conduct periodic system health checks.
- Reporting and analysis. Provide trend analysis and risk-reduction recommendations.
Put Deloitte's people, processes, and systems to work
Make the move to Deloitte's Managed Data Protection
Organizations must prioritize data security management and place it on an equal footing with traditional information and network security. Given the value of data today, data protection is often the driver that propels an enterprise toward new levels of excellence in managing risk. That’s why it’s crucial in adopting a holistic approach to data protection using the managed services model.
When the value of the enterprise’s data is clarified, executive teams generally see data protection in a new light.
Get in touch
Andrew Morrison
Cyber & Strategic Risk Board and Executive Programs Leader
Kent Cinquegrana
Managing Director | Deloitte & Touche LLP
Recommendations
Protecting against the changing cybersecurity risk landscape
Future of risk in the digital era
2021 future of cyber survey
Cyber everywhere. Succeed anywhere.
