Microsoft Protect center

Data in motion – how to protect it – 5 Key Considerations

Ciara Gallagher

Ciara Gallagher

Senior Project Manager

Read Time, 5 min.

Data in motion – how to protect it – 5 Key Considerations 

Now, more than ever, it’s critical to protect your data at the file level.

Data is the most valuable asset you control. Losing intellectual property, a customer’s personally identifiable information (PII), financial information, and confidential memos can cause substantial damage. But it’s not just malicious attacks you must worry about—it’s crucial to prevent data from escaping during everyday operations.

The nature of work itself is changing rapidly. Employees are no longer tethered to a single computer or device – they are often using multiple devices to get their work done. That means that information is being created and shared in a variety ways, across a variety of locations. This is all hugely impactful for increasing productivity and improving collaboration but it makes protecting our sensitive data much more challenging.

The growth of cloud-based services means that companies are more and more likely to have sensitive data in a cloud environment, in addition to on devices or even on premise.  Recent research shows:

  • 8 out of 10 employees admit to using non approved Saas apps¹
  • Data theft has more than doubled²
  • 88% of organisation feel they are losing control of data³
  • $158 is the average cost of each lost or stolen file containing sensitive info 4
  • 1 in 5 mobile devices will be lost or stolen in their lifetime 5

A typical network today is only secure in that you have control over your data inside your network boundaries. Once it leaves your network, beyond the firewall, you lose the ability to protect or track it.   In today’s environment this is not enough. And your perimeter is very much dissolving.

Protect your sensitive data at the file level 

Every day, data is traveling between users, devices, apps, and services outside of your control. Now, more than ever, it’s important to protect your data in motion and at the file level. In our environment today you need to be able to classify and add security directly to your sensitive data so that it’s always protected and identifiable no matter where it travels.

Here are 5 key things to consider when creating a data protection framework for your organisation’s sensitive data 

  1. Configure: create policies for data labelling, classification and protection. Typically on my customers’ sites, all data and documents created within the finance team will be automatically labelled as confidential, and only people in that team have the rights to access those documents but if the documents move beyond that team, say into HR, no one in HR can open, save or do anything with those documents. So protection is automated.
  2. Classify: ensure when files are created they can be automatically (or manually) classified so automated encryption and permissions occur. Remember your teams and users don’t always know the correct label, or level of confidentiality that should be attributed to certain information? So this type of automation is very powerful. But in general when it comes to security and compliance, it is vital to educate your people so they understand which information is sensitive and how it should be treated. But I’ll talk more about that in a moment.
  3. Label: make sure your metadata defining sensitivity of information stays with the file. So this means only identified and authorised people can open, print, save or copy the document. The caching of names in any email systems (when you’re prompted to send an email to Ciara Gallavan instead of Ciara Gallagher) make it so easy to send information to the wrong person, sometimes without us even knowing it. Let’s face it we’ve all done this once! This little gem of functionality completely mitigates this risk.
  4. Protect: set up encryption with permissions to ensure only authorised users can access the file, so even if a file containing sensitive data gets emailed to somebody in error, they are unable to open the file. A word of caution here, is NOT to label everything sensitive with encryption. If you do, you will indeed impact your people’s productivity and inhibit a sensible level of data sharing
  5. Monitor: track shared files everywhere they go. Not only is this great to see who has reviewed your work? But If a file does get sent to an unauthorised user in error then you get notified and you can recall the document immediately.

So you can see how technology can help protect your sensitive data in motion but a key factor is adopting a culture where your  teams truly understand why you must be vigilant and what their roles is in the process. Most breaches are not made through malicious intent but by human error.

Technology is making great strides in helping you to create a secure framework for your organisation’s sensitive data, whereby you mitigate risk but your people and your processes will always be at the heart of the solution.

If you would like to learn more about implementing your own underlying data protection policies and framework. Watch our OnDemand webinar series.

  1. “McAfee Finds Eighty Percent of Employees Use Unapproved Apps at Work.” McAfee. December 4, 2013. http://newsroom.mcafee.com/press-release/mcafee-finds-eighty-percent-employees-use-unapproved-apps-work (accessed 1/26/17)
  2. “Turnaround and transformation in cybersecurity: Key findings from The Global State of Information Security® Survey 2016.” PwC. 2016. 24. http://www.pwc.com/sg/en/publications/global-state-of-information-security-survey.html
  3. “Creating trust in the digital world: EY’s Global Information Security Survey (GISS) 2015.” EY. 2015. 4. http://www.ey.com/Publication/vwLUAssets/ey-global-information-security-survey-2015/$FILE/ey-global-information-sec urity-survey-2015.pdf
  4. “Cost of a Data Breach Study: Global Analysis.” Ponemon Institute. June 2016.
  5. “Bring your own device: Security and risk considerations for your mobile device program.” EY. September, 2013. http://www.ey.com/Publication/vwLUAssets/EY_-_Bring_your_own_device:_mobile_security_and_risk/%24FILE/Bring_your_ own_device.pdf (accessed 1/26/17).

Free eBook: A crash course in security management - the keys to a better security posture

The way you manage your data and device security is a top priority in an evolving cyberthreat landscape

Discover more related articles per industry:

Government

  • Surface Go

    Put more power in the hands of your Firstline Workers, wherever they are

    Firstline Workers are the day-to-day heroes of our public services; they’re often the first to engage with citizens, the first to represent your organization, and put your services into action. However, they’re often the last to get access to the latest technology. Better technology makes productivity more effective, by saving time and money, streamlining operations […]

Discover more related articles per dossier:

Customer Stories

  • Security Considerations for a Hybrid Working Environment

    Security Considerations for a Hybrid Working Environment

    Over the past 20 months, we’ve seen significant changes in the cyber security threat landscape that are having a major impact on organisations of every size in every sector. The frequency and sophistication of cyber events have increased significantly. Unfortunately, this has security implications, which need to be closely managed to mitigate the risks across the organisation. Microsoft recently released […]

Digital Transformation

  • Sofie using Surface in airport lounge

    Why technology is key to keeping a creative team connected

    The one-size-fits-all approach no longer works. Set working hours and rigidly defined job roles are out; flexibility and creativity are in. Everybody wants a ‘fluid’ workplace, where the boundaries between our work and our passions are blurred. Work should be fun. It should be empowering. It should be fulfilling. Defining how, where and when you work is a huge pull for talented […]

Security & Privacy

  • Cyber Signals: Defending against cyberthreats with the latest research, insights, and trends

    Cyber Signals: Defending against cyberthreats with the latest research, insights, and trends

    We’re excited to introduce Cyber Signals a cyberthreat intelligence brief informed by the latest Microsoft threat data and research. This content, which will be released quarterly, offers an expert perspective into the current threat landscape, discussing trending tactics, techniques, and strategies used by the world’s most prolific threat actors. As such, we hope it’s a valuable resource to Chief Information Security Officers, Chief Information Officers, Chief Privacy […]

Tips

  • Surface Go

    Put more power in the hands of your Firstline Workers, wherever they are

    Firstline Workers are the day-to-day heroes of our public services; they’re often the first to engage with citizens, the first to represent your organization, and put your services into action. However, they’re often the last to get access to the latest technology. Better technology makes productivity more effective, by saving time and money, streamlining operations […]