IT Security Blog. Mitigating Risks. Enabling Business Strategies. W. Mark Brooks

Targeting High Value Data for Information Governance

Targeting High Value Data for Information Governance

High Value Data comes in variety of shapes, sizes and forms in industry.  Often it’s intellectual property like designs or research information, it can be data that requires extra attention and control because of its sensitivity, it can be data that is specifically regulated by law or statute, or it might be information that is critical in cases of litigation.  Despite their different purposes and uses, all this High Value Data can benefit from applying common and integrated Information Governance.

 

The life cycle of High Value Data domains is very consistent and the decision making and controls around the data are very common.   If you look at the life cycle of information, it’s easy to identify some key steps in the life cycle.  See below:

 
 

For High Value Data like I have described above, often companies will miss an opportunity to align and integrate efforts, and will end up initiating more costly individual investments to govern their High Value Data.  Often you will see these investments referred to as e-Discovery, Records Management, Security, Privacy, or other compliance specific agendas.  Let’s look at a couple of examples of why it makes sense to govern High Value Data in a common and integrated fashion.   Once you see these, I think you will gain an appreciation for how viewing Information Governance from an integrated standpoint can make your efforts more effective and less costly.

1. PLANNING data governance for compliance oriented data, e-Discovery, Records Management or Privacy often require the same subject matter experts (SMEs) in laws, regulations, and policy.   Having these SMEs look at planning holistically for High Value Data, can help eliminate redundant decision making efforts and help them identify complimentary controls that can help address needs across multiple domains.  In addition, these High Value Data domains often require enterprise wide interventions in order to create change (or in this case, drive new Information Governance).   Enterprise initiatives are often difficult to move forward due their breadth and stakeholders that span multiple areas.   By bringing these enterprise needs and initiatives together during planning, you are more likely to have success in mobilizing sponsorship of investments vs. having each High Value Data area make its own individual investment case.
2. Governance for what you CREATE and ACQUIRE can be critically important to the overall life cycle of High Value Data and can help minimize risks.  As an example, both Privacy and Security are interwoven when it comes to this step.  If an organization chooses to ACQUIRE and make use of personal data then there will be a resulting set of risks and costs associated with securing that data.  
3. Most High Value Data requires limiting how it is USED and ACCESSED, specifying who can use it, determining where it can reside, and making use of audit trails to substantiate who did what, to what data.  The decision making processes and how you limit access are often common across these different High Value Data domains.  In addition, the types of technology solutions one can deploy to enable the right access controls, such as Identity and Access Management, Encryption, or Data Loss Prevention are very similar and often are the same solution.
4. DISPOSITION is a step that has an extreme amount of interdependence across decisions, controls and approaches for each of these High Value Data domains.  As an example, the disposition of records and adherence to a retention schedule can have direct impact, good or bad, on e-Discovery efforts.  Often, companies end up storing unnecessary volumes of data because of their lack of governance/compliance to record retention procedures.  This results in sky rocketing storage costs and greater exposure to companies having to process data for legal requests that they weren’t legally bound to keep in the first place. 

------------------------------

Here's a quick summary of the common themes and benefits of integrating High Value Data Governance:

• Decision makers are often common across High Value Data Governance.  In particular, in the area of Legal and Compliance.
• By bringing the enterprise needs and initiatives for each High Value Data domain together during planning, you are more likely to have success in mobilizing sponsorship of investments vs. have each High Value Data area make its case on its own.
• Decisions made on High Value Data type in a step in the information life cycle, can have significant impact on the risks and costs of managing High Value Data elsewhere in the life cycle.
• The technologies available that help enable limited access, appropriate use, and Security are often the same across the High Value Data domains.

Here are some additional resources for you to assist with High Value Data Governance:

ARMA International Maturity Model for Information Governance

Association of Information and Image Management

 

Mark Brooks

Benefits of Data Classification

 

Data Classification has been around for many years.  As companies increasingly open their information networks to external collaborators, move to collaborative environments like SharePoint, and face increased legal exposure, Data Classification is increasingly being deployed as an effective means to help address risks and enable compliance.

  Quite often when the subject of Data Classification comes up, what comes to mind to most practitioners in information management is “You must classify all your information so that each piece of data that you use in the company is labeled – (e.g.  Red, Yellow, Green) based upon the sensitivity of the data.”  This of course feels like an overwhelming amount of effort and Data Classification falters due to fear of failure or because it becomes too difficult to gain approval for the business case. 

In most cases, this isn’t how Data Classification is implemented and often it isn’t how an organization gains the most benefit to Data Classification.  I believe that one of the greatest business benefits of having Data Classification implemented are realized when organization understands and focuses on Data Classification at a strategic level.  By strategic level, I mean at the Policy, People, and Governance level vs. the technology/tool level.

Here are what I see as the Top 5 Benefits of Implementing Data Classification at a strategic level:

· #5    The ability to make more effective management decisions on the level of controls necessary for data protection.  Having a Data Classification program in place that includes the appropriate levels of controls for the various classification levels, helps leadership make more effective investment decisions to meet internal and external control expectations.

· #4    The ability for the rationalization of controls by mapping control requirements to grouped “classes” of information vs. data element by data element.

· #3    The ability to use Data Classification as commonly accepted guidance across the enterprise for the controls that should be implemented to protect data, thus aligning resources and energy of the organization.

· #2    It can be used to reduce efforts and costs associated with controls of less sensitive data.  Often when Data Classification is developed, organizations come to the realization that they are not only UNDER controlling their most sensitive data, but they are wasting money and resources OVER controlling less sensitive data. (CISOs – Here is a great way to gain traction with your business partners by articulating cost savings and productivity gains via your Information Security initiatives!)

· #1  And the # 1 Strategic Benefit for Data Classification, is the Socialization of Data Governance concepts with the business enterprise.

 

Socialization of Data Governance?  If embarked upon from a truly enterprise and cross-functional perspective, Data Classification is also a great way to socialize data governance with senior leadership because the process and experience of defining the data classes and their expected controls is Data Governance.  Once this socialization process begins to gain traction, then organizations begin to realize a number of other strategic benefits.  These can range from:  stronger business sponsorship on specific IT investments to protect the information, better risk based decisions made by the organization, stronger ties of security requirements to business objectives, as well as decreased legal risks by being able to demonstrate due diligence through active leadership engagement in data governance.

Ironically, it is actually when these strategic benefits begin to be realized, that organizations can more effectively drive data classification into processes, procedures, and deploy technology solutions.  I say ironically, because most organization jump to finding a tool to classify data and then they find that once implemented, the organization resists adoption and data classification fails.  The resistance occurs because of lack of understanding, alignment, and buy-in to the need across the business.   Then organizations find themselves right back where they should have started – focusing on Data Classification at a strategic level or unfortunately altogether abandoning Data Classification.

Your comments and thoughts are welcome.

 

Mark Brooks

Why IT Security Organizations Often Fail with Strategy

 

 

I’m often asked why so many IT Security organizations lack an effective strategy and thought I would share with you some of the most frequent reasons I see this occur.

So here are my “Top 10 Reasons IT Security Organization Often Fail with Strategy”:

10.   IT Security leaders and often IT leaders will defer to the business to establish strategy and will view their role as implementing the business strategy.   However, in order to effectively implement the business strategy, IT Security needs its own strategy that is aligned to strategy of their business.

9.    Highly related to #10.   Developing an IT Security requires the IT Security organization and its leaders to fully understand and apply business strategies.   Frequently, security organizations find themselves too busy running their own operations to engage and learn about the business strategy.

8.    Developing business cases for investing in strategy development are difficult to develop and articulate.  Ironically, often these are the exact types of business cases that senior business leaders want IT and IT Security to be initiating.

7.   When a strategy business case is developed and approved, IT Security leaders have difficulty making progress on their strategies, because their day-to-day responsibilities keep them from being able to invest the required time in their strategies (See #9).

6.  Often leaders of IT Security Organizations have grown up as technical subject matter experts and have been promoted by their organizations for their technical knowledge or technology leadership.  As such, they simply focus their attention on areas that they have been rewarded to do so in the past – technology.

5.  The market offers many more technology solutions to IT Security leaders and organizations than it does sets of capabilities to help them develop strategies.  When I was responsible for enterprise risk, security, and compliance in a Fortune 500 company, I very seldom had vendors calling on me to assist me in developing and implementing strategies.  Most of the time, they called on me to sell hardware and software products (Driven also by #6).

4.   Thought leaders, industry groups, and solutions providers haven’t effectively communicated the value and importance of security strategy as compared to the value proposition of available technology solutions.

3.  Truly effective IT security strategies require the full engagement of lines of business and IT Security is unable to marshal the necessary business sponsorship and resources to partner with them on their strategy.   This also results in many IT Security Strategies morphing solely into technology strategies.

2.  Strategies are not as tangible as other interventions, in particular technology solutions.  Their value and return on investment require qualitative measures in addition to quantitative measures to determine their success.   Qualitative measures are often more difficult to define and measure, than quantitative measures.

1.   And the #1 reason why many IT Security organizations fail to have an effective strategy?  They are complex, cross-functional, and often span months to years in their development and implementation.   In other words, it’s hard work.   IT Security is like any other organization in IT or the business.  It is easier to embrace short-term solutions and their incremental gains than taking the long-term view.