Manny Rivelo is the CEO of Forcepoint.
Archimedes famously said the quickest route between two points is a straight line. He meant geometry, though I argue this concept applies seamlessly to data security.
To secure data in enterprise endpoints—like corporate laptops and tablets—and unmanaged devices—including bring your own devices (BYOD)—across hybrid work environments, the public internet and remote offices, just connect these points for a streamlined path to simplified security.
While security advances and evolves, the core mandate remains unwavering: Safeguard data at all costs. The misconception that only industry giants require robust data protection collapses when we consider that midsized enterprises with limited resources and fewer than 2,000 employees grapple with analogous data security issues.
When every byte is a ransomware target, security teams need to know the location, type and accessibility of critical data, especially in regulated sectors like finance and healthcare.
With tightening global regulations, the financial implications of inadequate protection and non-compliance are profound. Consider Yahoo’s $35 million fine or $47 million derivative lawsuit in 2018, alongside penalties imposed on business titans like Equifax, Uber and Capital One. New regulations, such as India’s recently enacted data privacy law outlining hefty fines of 2.5 billion rupees ($30 million) and the Biden administration’s push for AI safety and security standards, underscore the urgency for robust data security practices and prompt, transparent disclosure of breaches.
Right about now, one might look up and think the sky is falling. But the future is marked not by imminent doom but by a strategic response that points to the need for a single view for data security. For midsized enterprises, their leaner toolkits, budgets and teams require a holistic data security approach that connects all the dots without overburdening constrained resources.
A Strategic Security Approach For The Mid-Market
Amid heightened regulatory scrutiny, the financial well-being of enterprises is intrinsically tied to their ability to fortify sensitive information.
Let’s dispel the notion that data loss prevention (DLP) is exclusive to tech behemoths. Midsized enterprises must prioritize security wherever data resides. Whether Boeing or Bumble, data creation and analysis are a business advantage; the usage of SaaS, BYOD and Wi-Fi is ubiquitous; and the security and privacy concerns are real. The challenge transcends size, especially for midsized enterprises.
The first order of business is ensuring data security everywhere within an organization. This involves deciphering people’s interactions with data, continuous monitoring, visibility, classification and automated security responses calibrated to risk levels. Enterprise-level DLP strategies must be wielded like a sword and shield, providing midsized companies with a fighting chance against potential breaches.
As I’ve written about previously, this can involve the data security lifecycle approach, a continuum of data protection stages. From the initial, automated investigations of data discovery and classification to the vigilant one-two-three cadence of prioritization, protection and monitoring, each stage plays a pivotal role.
The lifecycle approach can extend the protection of data security with capabilities that locate silos of sensitive information quickly, verify compliance readiness and control access and usage 24/7. Finding and protecting data where it lives is not exclusive to industry giants; midsized enterprises, too, can continuously verify all data interactions and foster a culture of transparency, clarity and certainty while securing the most critical information assets.
Connecting The Dots
Once a robust data security policy is in place, companies should consider merging these DLP strategies with technologies such as the cloud-based architecture called Secure Access Service Edge (SASE) to manage and enforce policy everywhere. SASE can encompass security (via SSE) and connectivity (through SD-WAN) delivered through the cloud, providing security services for cloud applications, websites and private applications and connecting the corporate hub with remote branches, managed as one entity.
I’m not proposing only a technical fix; it’s a paradigm shift. You can move forward methodically without interrupting the flow of your business and putting your data at risk. Here’s how:
1. Identify opportunities for convergence. Consider all aspects of your architecture to design an implementation plan tailored to your business needs. Identify policies that you no longer need or can improve. By unifying data security, you’re protecting data beyond physical office confines or corporate devices, embracing SaaS, the public internet, private applications and BYOD.
2. Re-distribute resources after implementing automation. You can avoid recreating disparate data security policies for different products and use cases by synchronizing them through automation. A singular policy can extend security’s reach to everywhere your people go and use confidential business data.
3. Avoid all-or-nothing propositions. Optimizing security at your own speed means you aren’t taking unnecessary risks when moving forward with consolidation. Make sure your vendor partner allows you to use existing tools alongside new cloud-delivered capabilities.
4. Safely embrace AI. AI can help level the playing field for midsized organizations competing against much larger competitors. Your company can effectively harness generative AI by ensuring internal operations, policies and security infrastructure are all data-first. This includes a strategic focus on identifying sensitive data throughout your business and ensuring you can enforce policy automatically for team members who are authorized to use AI.
5. Put insights and analytics into the game. Even if your company doesn’t have a chief data officer or business intelligence team, cloud-based dashboards are available today that help you identify the efficacy and ROI of security investments. Assess what you have and prioritize what will help you achieve value faster and with fewer resources. These insights also help you zero in on potential gaps and identify areas for improvement.
Charting The Course For Data Security Everywhere
When data breaches are averaging 277 days and $4.45 million for recovery, a comprehensive yet pragmatic approach is essential. In this unified world, data security becomes more cohesive and agile as a competitive advantage, not viewed as a back-office cost center.
The responsibility and power reside with every security professional and executive to ensure companies retain customer and investor confidence along with a future path to growth. Today’s digital landscape demands a security methodology that cuts through all the noise and chaos—a proverbial straight line that ensures simplicity.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
