Discover Sensitive Data

The ever-increasing amount of data collected by organizations around the world is raising concerns around privacy and could pose a threat to any organization with respect to regulatory compliance.  Further complicating the issue are multiple data systems, shadow IT, and the use of personal devices (BYOD).

​THE RISKS OF DARK DATA

• Do you know if you are required to retain data?
• What can happen to your organization if data is leaked or exposed?
• Are you deleting data you do not need any more?  What if you did not, would this increase liability?

Data is power.  Collecting customer data is a core part of most businesses.  Regulations are creating a need for responsible usage of personal data – not complying with regulations like GDPR can result in fines, withdrawal of license, and lower credibility with regulators and customers.

The rate of change continues to increase as new case law is deployed clarifying existing requirements and new obligations arise such as the California Consumer Privacy Act of 2018 and Brazil’s Lei Geral de Protecao de Dados Pessoais (LGPD) of 2019.

RISKS OF BEING OUT OF COMPLIANCE  
LOSS OF TRUST
This is the number one scare for most organizations.  If customers do not trust you with their data, they will not do business with you.

REPUTATIONAL DAMAGE
If a breach occurs, your organization will be in the news and it will damage reputations and diminish trust.  No organization wants to be known or remembered for the breach that occurred and the data they lost.
​
FINES
Although not the most important consequence according to many organizations, these are still very important and could have a substantial impact on doing business.

DATA SAFETY QUESTIONS TO PONDER 

• Do you know where your business-critical and sensitive data resides and what is being done with it?
• Do you have control of this data as it travels inside and outside of your organization?
• Are you using multiple solutions to classify, label, and protect this data?
• Are you monitoring for suspicious activity such as high volumes of file uploads or downloads?

If you have any responsibility for your organization's data security and answered ‘I don’t know’ to any of these questions, read on for recommendations on possible next steps and assistance.

RECOMMENDATIONS AND NEXT STEPS
LABEL SENSITIVE DATA
Organizations have many different types of sensitive information under their control such as financial data, proprietary data, credit card numbers, health records, or social security numbers.  Microsoft 365 identifies this data using sensitive information types.  There are three solutions to help you protect and govern sensitive data:

• Microsoft Information Protection (MIP) is used to discover, classify, and protect sensitive information wherever it lives or travels.  You can set automated protections whenever the system finds a sensitive information type.
• Data Loss Prevention (DLP) prevents users from inappropriately sharing sensitive data with people who shouldn't have it, such as in email or a Microsoft Teams chat.  With a DLP policy, you can identify, monitor, and automatically protect sensitive items across:
  1. Microsoft 365 services such as Teams, Exchange, SharePoint, and OneDrive
  2. Office applications such as Word, Excel, and PowerPoint
  3. Windows 10, Windows 11 and macOS (Catalina 10.15 and higher) endpoints
  4. non-Microsoft cloud apps
  5. on-premises file shares and on-premises SharePoint
• Microsoft Information Governance manages the retention and deletion of sensitive data in Microsoft 365 to reduce the attack surface and comply with privacy regulations.  It leverages the same sensitive information types as MIP and DLP to automatically apply these lifecycle management policies.

GET FAMILIAR WITH PRIVACY REGULATIONS 

• GDPR: General Data Protection Regulation (GDPR) Compliance Guidelines
• California Consumer Privacy Act of 2018: California Consumer Privacy Act (CCPA) | State of California - Department of Justice - Office of the Attorney General
• Brazil’s Lei Geral de Protecao de Dados Pessoais (LGPD) of 2019: What is the LGPD? Brazil’s version of the GDPR - GDPR.eu 
• HIPPA: Summary of the HIPAA Privacy Rule | HHS.gov

WANT HELP?
A Data Risk Check helps you quickly answer the question of where your sensitive information is.  Only if you know what you have and where it resides, can you start to think about managing, controlling, and protecting.  Reach out to learn more about our Discover Sensitive Data Workshop.

In the meantime, check out our informational video on how to use the M365 Secure Score.

Contact Us