Protecting Aggregated Data

In their ongoing quest for improved operational efficiency, organizations have come to rely on the ability to collect, access, and process large volumes of electronic data (aggregated data). This reliance has evolved with the development of sophisticated database software and the growing availability of hardware with storage capacity measured in terabytes. By possessing such large volumes of data, however, organizations assume certain risks and responsibilities:
•
Large data stores are valuable informational assets that have become targets for cyber criminals.
•
Electronic data can be easily copied, modified, and distributed, making the total retrieval or destruction of compromised or stolen data assets impossible to confirm.
•
Owners and custodians of large data stores assume responsibility for maintaining the privacy and integrity of the information under their control.
Theft or compromise of customer, partner, or other data held by an organization has a number of shortand longterm consequences. The dollar value of these consequences can exceed that of the data itself. These consequences include
•
interference with an organization’s daytoday operations
•
interference with an organization’s ability to fulfill customer and partner transactions
•
erosion of trust relationships between the organization and its customers and/or partners
•
violation of federal and/or state laws governing the protection of aggregated data
•
exposure to civil litigation claims
By applying sound management principles and good security practices, organizations can mitigate these risks and better protect the aggregated data under their control. Organizations must understand the nature and disposition of the data, determine its value, and calculate acceptable risk. Their data management and security strategies must make leaders accountable for effective oversight of data security, heighten data security awareness, ensure legal compliance, and require regular data security audits and the development and execution of incident management plans. Leaders and the strategies they develop should also address sound security architecture and design, physical security management, the management of partner processes and activities that affect data security, vulnerability management, and business continuity. By working to ensure the security of the aggregated data in their charge, organizations can not only avoid the negative consequences associated with a data security breach, but strengthen their relationships with customers and partners and enhance their reputations in the community at large.