How to maximize data sovereignty in your organization?

Data has become the main support of our digital economy. For most companies, the digital strategy relies on a few critical pillars:

• Their data
• The way data are processed (algorithms, apps, compute)
• Who can access data and run operations and reports on them

If you don’t have a clear view of these pillars, you don’t have a clear picture of your business — which means you will soon be out of business. It’s that simple.

As you build your organization, you influence the access rights to your data and application features according to your digital strategy. You must ensure that access rights and identities are compliant with that strategy and based on the sensitivity of your data. That’s the definition of control. Controlling your data is to specify and enforce who can do what with them at any point in time. If those identities and accesses don’t align with your choices and your strategy, it reflects not just a lack of control over the data, but over the business itself.

How can you increase control?

Cybersecurity levers are data sovereignty’s best friend.

To control who can do what with your data, you have to start with identity and access management (IAM) and extend it beyond your employees to all kinds of IT, OT and IoT objects. Since you cannot implicitly trust the underlying layers that host, transport and process your data in clear text, you need to add encryption to protect its confidentiality and integrity in the above 3 mentioned states.

However, IAM and encryption are often entangled in layers of applications, infrastructures and networks to run business applications and facilitate user experience. It exposes them to the flaws and weaknesses in each layer, which requires additional security controls to minimize the likelihood and impact of a breach. These additional controls include antimalware, firewalls, intrusion protection sensors, secure coding, testing amongst others.

Last but not least, there is no such thing as perfect cybersecurity controls, so you must constantly monitor them for compliance and incidents and be able to respond and recover from them in a timely manner. In short, following the major functions of the NIST Cybersecurity Framework (identify, protect, detect, respond and recover) is mandatory.

How much should you increase it?

Sometimes, more is less.

All those levers can be seen as sliders moving between agility and control. Strengthening a security control could indeed come at the expense of agility, even create some user’s friction. The best way to have complete control is to store your data in a vault, inside a faraday cage, 100 meters underground, surrounded by armed guards. Only then would it be truly inaccessible — and utterly useless.

So, for every security control, you should find the proper balance between excess and restraint. The best way to find that sweet spot is at the core of cybersecurity: What kind of risk am I addressing and in which form could it happen? You won’t apply the same level of control to mitigate an espionage risk, external influence, usage/operation prevention, or data loss, whether accidental or malicious.

Are all data born equal?

The denial.

Protecting all assets the same way often results in protecting none of them correctly. Indeed, security controls tend to be attracted by the weakest link. While you may assume that your least sensitive data will benefit from the same strong protection you give your most sensitive data, the opposite is often true. When someone says, “all my data are sensitive,” I often hear, “I don’t know which data are sensitive, and worse, I don’t know that I don’t know.” In risk management parlance, we call this the worst possible treatment: denial!

The double 80/20 rule.

Data classification is a huge program that should never be underestimated. But, to give you a sense of scale, we have observed through many projects that, in average 80% of customers’ data are not sensitive, and that the remaining 20% can further be split into 80% “just sensitive” and 20% highly sensitive. It is not unusual that the split is close to that double 80/20 rule: 80% non-sensitive, 16% sensitive and 4% highly sensitive (maybe even classified). Of course, this is a rule of thumb. Companies working solely on highly sensitive topics (a nuclear plant, a military entity, etc.) will have a vastly different split, and don’t need that rule. Others should focus, as a priority, on the 4%.