Any company, regardless of its size, collects customer information as part of its business operations. Whether they accept orders or provide a service, organizations process sensitive customer data on a regular basis and, oftentimes, at a large scale. In recent years, the protection of customer information has been increasingly regulated, creating a new set of challenges for business owners.
Personally, identifiable information (PII) that includes phone numbers, passports, and social security numbers and other types of customer data such as Credit card information is a serious obligation for any organization.
Sensitive customer information is also the type of data most sought after by cybercriminals. According to the Cost of a Data Breach report 2020 released by IBM and the Ponemon Institute, customer PII was compromised in 80% of all data breaches, making it the type of record most often lost or stolen. Customer PII is the costliest type of data compromised in a data breach.
Compromised customer data also leads to reputational damage, the worst consequence of which is lost business. In most of the cases, a customer would stop doing business with a company if their data privacy or security had been compromised due to a security incident.
Taking all this into consideration, it’s clear it is in the best interest of each company to protect their customer information. Here are some of the steps organizations are taking to protect sensitive customer data against security breaches and data loss.
Basic cybersecurity measures
One of the easiest ways companies protect customer information is by adopting basic cybersecurity measures. These are usually aimed at protecting customers’ data from cyberattacks and include the implementation of antivirus and anti-malware solutions and firewalls, but also the enforcement of strong password policies.
Businesses can also require employees to change default passwords on all work devices and keep their operating systems and security software always up to date. In this way, malicious outsiders cannot exploit unpatched security vulnerabilities.
Protect customer information from insider threats
Cyberattacks and data breaches are not the only risks that customer information faces. Insider threats are also responsible for a big chunk of security incidents. Most of the data breaches are caused by human error. Employees are responsible for malicious attacks as well, intentionally compromising sensitive data or falling victims to phishing and social engineering attacks.
To avoid data exfiltration and loss, companies adopt Data Loss Prevention (DLP) solutions. Through DLP technology, organizations can define what sensitive data means to them in the context of their business and then control and monitor that data through policies. DLP tools help protect not only customers’ personal data but also intellectual property and financial data.
Using content inspection and contextual scanning, DLP solutions can search for sensitive information in hundreds of file types in real-time, whether it is in transit or stored locally on employees’ computers. Once identified, they can monitor sensitive data, block its transfer and encrypt or delete it when it is found in unauthorized locations. DLP tools also log any attempted policy violations and produce reports of all security incidents.
Use encryption
Encryption is another effective way to safeguard customer information. By making hard drive encryption a requirement, companies ensure that in the eventuality that a work computer is lost or stolen, no one will have access to the data on it without a decryption key. Hard drive encryption is a cost-free solution most companies can easily apply as the most popular operating systems today carry their own native encryption tools: Windows has BitLocker and macOS, FileVault.
Limit access to customer information
Another way companies protect customer data is by limiting access to sensitive information. Companies first evaluate their employees’ responsibilities and see which require access to customer information to fulfill their duties. They then implement a unique ID credentials system and grant access rights to employees based on their job scope.
Train employees
Security measures are useless if employees are not aware of the risks customer information faces. A lack of awareness can lead them to disregard policies and circumvent measures put in place for data protection and compliance reasons to simplify their tasks.
To protect customer information, companies provide employees with training that aims to inform them of the importance of data protection and the consequences of a data breach but also educates them on how to handles attacks that target personnel directly such as phishing and social engineering.
By using DLP solutions’ monitoring capabilities, companies can also discover how data is being used and transferred by employees, helping them identify bad practices and employees that might require additional training.
The above article is authored by Filip Kotfas, Channel Manager at CoSoSys.
