20 May Client Story: Managing the risk of a data breach for a major retailer
Client Story: Managing the risk of a data breach for a major retailer
THE CHALLENGE
Our client, a leading retailer, wanted to uncover potential data breaches within their business and ensure compliance with the new mandatory data breach notification laws.
To achieve this, they needed deep and accurate insight into their information assets. And that meant access to a team of experts who could assess their complex and unstructured databases.
That’s when they engaged InfoCentric.
OUR BRIEF
- To perform a qualitative risk assessment on the client’s Personal Identifiable Information (PII) and Payment Care Information (PCI).
- To give the client a richer understanding of how much sensitive data is stored in their large databases.
- To provide the client with greater insight into their sensitive data’s usage, age, recency and risks.
OUR APPROACH
- We developed a detailed privacy exposure assessment process for the client’s structured and unstructured databases.
- We used intelligent scanners to record, catalogue and provide the data lineage for every file the client possessed.
- We presented our assessment, which included a high-level summary, key findings and next steps. It also covered recommendations to help our client safeguard their sensitive data – and meet the data breach notification laws.
- We gave the client access to an interface which covered:
- A catalogue of all the files recorded through the intelligent scanners
- The quantity of sensitive data in each file
- Data flow between files
- Data profiles that identify the sensitivity types and volume
- The data’s usage, age and recency
- Total asset exposure ratings
KEY OUTCOMES
- Out of the 13.5 million files scanned, approximately 30% contained sensitive data
- The client developed the means to comply with the new legislation.
- We accurately classified all sensitive data, which helped with remediation.
- We consolidated the data – minimising organisational risks.
- The client optimised their internal controls decisions to reduce the risk of sensitive data exposure.
- The client received greater insight into the sensitive data held within their business.