Disruptive situations force businesses to change the way they function. Stringent data security used to be an afterthought for some businesses, until privacy issues gave rise to GDPR regulations. Now, data security is an essential element of all business strategies. The principal challenge of an organization is to keep critical business functions running while maintaining adequate security.

Security threats in the current state

With more employees working remotely now – either on a device issued and managed by the company or on an unmanaged personal device – company data faces greater risks than it did in the workplace. Public Wi-Fi networks, for example, are less secure than private networks. In many cases, employees are taking home workplace desktops, which have not been equipped with the technology to manage them remotely and ensure security is maintained, and hackers are taking advantage of the vulnerabilities. But the highest risk for any business involves privileged users who have access to sensitive information in database. Without adequate security, remote access by these users can provide hackers a foot in the door to critical company information.

For many organizations, the rush to provide remote-working technology has led them to cloud platforms and SaaS providers. However, cloud service providers treat cloud security risks as a shared responsibility with their customers. Without the proper defence mechanisms, there is always a possibility of data theft from cloud applications by malicious actors. Bring your own device (BYOD) programs have encouraged the adoption of shadow IT, which can put an organization’s security at risk as employees process and store company data on unapproved cloud services without much thought.

How businesses should respond

The current coronavirus pandemic has created significant security challenges for businesses. It’s also provided an opportunity to build more resilient environments for remote work. All organizations need are the proper information, tools, processes, and the right training for their employees. 

Build a robust environment

There are many tools and approaches for data protection, including data governance, access control, classification, encryption, and data loss prevention.

One of the first steps an organization should take is to protect data at the source by enabling content security on centralized repositories. Sensitive data should be available remotely to employees based on permissions: Employees should have access only to the data they need to do their jobs. Companies must identify the precise levels of access needed by remote employees and implement least privilege rights to ensure employees only access what they’ve been permitted to. Organizations should also assess cloud data access policies, as access from unmanaged devices will increase. This will enable IT to maintain control, even remotely, and identify any irregularities which could indicate data breaches or threats. Businesses must also enable data loss prevention policies at endpoints to prevent data exfiltration, and support remote compliance with data-protection legislation by applying policies to sensitive data directly.

Device encryption should be enabled to secure data in case a device is lost or stolen. For employees using their own devices, information rights management solutions must be applied to control access to files and ensure they’re shared only with approved audiences.

In a multi cloud environment, cloud access security brokers (CASBs) must be employed to establish security parameters for data, which can help organizations achieve zero-trust security.

Shadow IT is not going away. Organizations need to take steps to minimize the security risks. IT departments need to know which applications are being used and the risks that they pose to data security. They need to improve visibility and optimize monitoring procedures.

How Wipro can help

Wipro’s data security practice has over 13 years of experience in the field, enabling global enterprises (including many fortune 500 companies) to manage their data security requirements. We help organizations define processes, identify solutions, and enable controls based on their current needs. We perform data protection impact assessments, and provide end-to-end data governance services including data loss prevention, information rights management, encryption, data privacy and data security in cloud. Together, with clients, we build comprehensive data security frameworks to ensure they have the support they need to continue business operations while strengthening the security of their critical data.

To learn more about how Wipro helps enterprise clients secure their data, contact us.