Do You Know Where Your Data Is?

Educational institutions are a data treasure trove.

• By Isaac Kohen
• Jun 12, 2018

Data breaches occur on a weekly basis. Educational institutions are not immune to a data breach. Rather, they’re instead a data treasure trove, full of student email addresses, physical addresses and financial information. The reality, educational institutions are not safe guarding their student’s data and that data is being easily exploited by malicious criminals.

These institutions are being targeted and the frequencies of attacks are picking up in volume. According to a 2016 Campus Technology Report, the number of lost, stolen or compromised data records increased to 164 percent in the first 6 months of 2017.

Further, a recent IBM report showed just how costly a data breach is for higher institutions and the true worth of their data. The cost of a data breach for a U.S. educational institution is higher than any other sector. The average cost per compromised data record is $245 in comparison to $225 of all U.S. organizations and $200 of education institutions worldwide. U.S. education data is leading the way.

Educational institutions are being targeted my malicious criminals daily, but when it comes to the news, their data breach exposure becomes buried by more high profile companies like Facebook and Equifax. These educational organizations are being targeted in all facets of their identity from student service accounts to alumni associations. Recent data breaches include the Clemson Alumni Association with data exposure due to a third-party security lapse. And a Fresno State University data breach that lead to more than 15,000 victims affected when a flash drive with information was stolen - insider threat?

The point remains, data breaches need to be on the security priority list for higher institutions and administration needs to look closely into best security practices.

The first step in securing data is to understand where your most precious data is located. It’s very hard to protect everything and keep a watchful eye on all your data. Knowing where your most sensitive data is, is a fundamental first step in data security. To successfully start this process, appoint a data steward to inventory critical data and ensure a robust plan exists for data protection.

Designating a position to lead this movement is important, because often these duties are filtered onto IT employees. IT employees are generally overworked and overwhelmed. By designating a team and leader to head data security, you’re ensuring success. Lastly, data security isn’t an IT problem, or an administration problem. It’s everyone’s problem, and it’s everyone’s responsibility. Once critical data is classified and an employee is assigned to it, upper management needs to be invested in the protection of that data, and the importance of keeping the data safe needs to be talked regularly at board meetings.

Once you have classified sensitive data, you can move on to four important steps to further protect your data.

Create an Incident Response Plan

The longer an organization takes to respond to a data breach, the higher financial consequences. Malicious criminals wish to go unnoticed. The longer they can sit in the system and exploit data, the longer they can collect data and sell it for profit. Creating a robust incident response plan is a proactive approach to eliminating data breach lag time and responding to an incident correctly.

Educational institutions take longer to respond to data breaches than other organizations. But having a response team in place leads to lower data breach costs. Organizations with a incident response team saw a lower average cost by $19 per record. In order for a incident response plan to be successful, the program needs to meet multi-level training and awareness needs for employees.

Encryption, Encryption

Securing sensitive data through encryption is one of the most basic approaches to data security. Encryption works simply by adding another layer of protection through ‘scrambling’ your data that can only be put back in the right order through an encryption key. In order to ensure your encryption strategy is just, you need to encrypt all forms of data - data at rest, data in transit, or data in use - and not to forget the encryption of sensitive backups. Organization with encryption, according to a recent study, saw breach costs on average $16 less per record.

Be Prepared: Employee Training

If a data breach occurs, can you employees react accordingly? Just like a fire drill or medical accident, employees need to be prepared and know how to respond. A data breach is not a separate story, and it should be treated in much the same way as these others. Training employees on how to spot phishing emails, or educating them on reasons why to protect company data is important. An organization is a team and all team members must be dedicated to the protection of its company data. According to the same study, companies with robust training programs saw costs that averaged $12.50 less per record. Training is only the beginning, and the IT team should implement creative and informative ways to keep engaging staff about data security.

Monitoring

In a perfect world, we should be able to stop sensitive data from leaving an organization and know when it’s happening in real-time. This reality is not too far off with recent developments in technology like user analytics and monitoring. Employee monitoring software tracks and records all of an employee’s computer activity, including web searches, emails sent and received, and the time spent using various applications. The software creates a ‘standard’ profile of normal behavior of both the employees and the computer system. When this normal behavior deviates, an administrator can be alerted quickly and directly stating what sensitive information was accessed.

Data security is a problem, but by combining these four additional layers of protection, these organizations will be on their way to data safety success.