In recent years, high-profile stories have thrust the issue of data privacy and data security into the public eye. Unfortunately, efforts to pass consistent laws governing consumer privacy and data security are lagging far behind where they should be. Not only are laws and regulations slow to be implemented, they can be very confusing. Varying from state to state, the lack of uncertainty around existing laws should not stop companies from doing all they can to protect themselves and their customers from the misuse of information, data leaks and breaches. In order to better understand and apply the state and federal laws that apply, companies must understand the difference between data privacy and data security. Although commonly used as synonyms, the terms data privacy and data security aren’t quite as interchangeable as one might think – they actually share more of a complementary relationship. Before making the connection between data privacy and data security, let’s take a look at how these two terms are defined:
Data Privacy
Data privacy is clearly defined as the appropriate use of data. When companies and merchants use data or information that is provided or entrusted to them, the data should be used according to the agreed purposes. The Federal Trade Commission enforces penalties against companies that have negated to ensure the privacy of a customer's data. In some cases, companies have sold, disclosed or rented volumes of the consumer information that was entrusted to them to other parties without getting prior approval.
Data Security
Data security is commonly referred to as the confidentiality, availability and integrity of data. In other words, it is all of the practices and processes that are in place to ensure data isn't being used or accessed by unauthorized individuals or parties. Data security ensures that the data is accurate and reliable and is available when those with authorized access need it. An acceptable data security plan should focus on collecting only the required data information, keeping it safe and destroying any information that is no longer needed. A plan that places priority on these three components will help any business meet the legal obligations of possessing sensitive data.
So what is the indelible and critical link between data security and data privacy? A well-designed and executed data security policy that ensures both data security and data privacy. Companies enact a data security policy for the sole purpose of ensuring data privacy or the privacy of their consumers' information. More so, companies must ensure data privacy because the information is an asset to the company. A data security policy is simply the means to the desired end, which is data privacy.
Similar to how a home security system protects the privacy and integrity of a home, a data security policy is designed to only ensure data privacy. Every day, companies are trusted with the personal and highly private information of its customers, making an effective security policy, which is executed as planned, extremely important.
How Companies Ensure Data Privacy with the Help of a Data Security Policy
With the escalation and increase in cybercrime threatening both the public and private sector, it’s important for organizations to have a data security policy in place. Making sure all company data is private and being used properly can be a near-impossible task that involves multiple layers of security, including technology that scans for vulnerabilities continually. When formulating a data security policy, it is important to look at all threats and to cover more than just the basics.
Nine important elements to cover in adata security policy
1. EnsuringData Security Accountability– A company needs to ensure that its IT staff, workforce and management are aware of their responsibilities and what is expected of them. The various types of data should be classified so that both workers and management understand the differences. By categorizing data, employees are aware of how to handle each type and which types they are allowed to distribute. Important classes to include in the policy are:
- Confidential data
- Data that is meant to be sent internally within the company
- General data
- Data that is meant to be sent outside the company
2. Policies that Govern Network Services – This section of the data security policy dictates how the company should handle issues such as remote access and the management and configuration of IP addresses. It also covers the security of components like routers and switches. This category is also where policies regarding the detection of network intrusion should be defined.
3. Scanning for Vulnerabilities–It is important to find any vulnerabilities in a company's IT infrastructure before hackers do. Since hackers will scan for vulnerabilities the minute they are discovered, a company should have a routine in place for checking its own networks regularly.
4. Managing Patches – Implementing code to eliminate vulnerabilities can help to protect against threats. How and when patches are to be implemented in the system should be a part of the data security policy.
5. System Data Security Policies – The security configuration of all essential servers and operating systems is a critical piece of the data security policy. Rules regarding servers that run on the company's networks as well as the management of accounts and passwords must be clearly defined. Firewall, database and antivirus policies also fall under this heading.
6. The Response to Incidents– If a security breach occurs, it’s important to have appropriate measures for handling it already in place. This includes the evaluation and reporting of the incident as well as how to solve the problems leading to it to prevent the issue from reoccurring.
7. Acceptable Use – Employees should be provided with precise definitions of what constitutes acceptable use. Additionally, it is a good idea to have them sign an acceptable use policy so that the company can pursue disciplinary action if necessary.
8. Monitoring Compliance– The use of audits is a good way to ensure that the company’s staff and management are complying with the various elements of a data security policy. These audits should be performed on a regular schedule.
9. Account Monitoring and Control – Keeping track of who is accessing what is an important component of a data security policy. Some of the most common sources of digital compromises are legitimate but inactive user accounts. This can occur when a staff member has been fired or laid off but his or her account not been terminated. If the employee is disgruntled, the ability to still access the organization’s assets can be highly damaging. The security policy should designate specific IT team members to monitor and control user accounts carefully, which would prevent this illegal activity from occurring.
There are many more important categories that a security policy should include, such as data and network segmentation, identity and access management, and more. It should also address the organizations’ entire security posture, monitoring all activity across every IT asset looking for abnormal and/or suspicious activity and activity patterns.
Once the policy is instituted and implemented across the enterprise, it should be reviewed at least twice a year to bring it current. Review should be triggered when significant upgrades are made to a company’s network infrastructure. Organizations that are serious about preventing cyber crime must also consider the important link between data security and data privacy and create the custom policy that will safeguard the data they’re entrusted with is used properly, legitimately and with the confidence that company and customer data is kept safe and secure.
