06 Feb Infosure Remediation for Unstructured PII Data
by Mark Diedericks
The Challenge for Remediating Unstructured PII Data?
With the constant increase in data breaches and cyber security incidents, and with data being a fundamental pillar of modern business, many organisations are still grappling with their overall approach towards how to best manage their data estates. Compounding this is the growing realisation that data breaches are just as likely to occur within unstructured data stores as structured, systems data.
The problem with unstructured data is that there are typically massive volumes of data, it is largely unmanaged, and without the right process in place, detecting for sensitive PII data is like trying to find a needle in a haystack.
Many businesses are simply ill-equipped to manage their unstructured data repositories effectively!
Take, for example, shared network drives. This type of infrastructure has been operational for decades in many organisations, often resulting in a build-up of tens of millions of files. Many of which have long been forgotten whilst still retaining sensitive PII data. How do you even begin to tackle such a problem?
The good news is that today there are scanning technologies that will help you uncover sensitivity, but given the size of these repositories, it can be difficult to scale these scanning solutions. In many cases, the technologies only work to curb the problem’s future growth without adequately addressing files that already exist. Something like Microsoft’s Purview Information Protection Scanner could be used to scan through the millions of existing files, but what then?
So how do you remediate the risks?
What controls can you put in place? And on what files? How does legislation and policy impact treatment? How do you manage all the stakeholders, potentially hundreds of them? Where do find the man-hours for such a mammoth undertaking?
What is a good remediation process?
Remediation can very quickly and easily become an overwhelming, complex, and costly project — becoming especially true for large organisations that often struggle with strategic alignment and execution.
While working with clients who are actively trying to remediate this problem, we’ve found that you need an approach and solution that will:
1. Work retroactively
Scan the millions of files throughout your organisation’s key repositories and understand the sensitivity they hold.
2. Assess what needs to be remediated
Work within the framework of your organisation’s data governance policies to identify what should be remediated and by whom.
It means weeding out the sensitive files that no longer serve a purpose in a way that’s simple and fast.
3. Target various platforms
Having a single, unified, data platform is great in theory, but it’s a dream in practice. We need a solution that matches the way we work and store our data, not another thing to work around. Having a tool that targets multiple common platforms ensures we don’t have disparate siloes of data for the remediation process.
4. Enable ongoing change
Remediating what’s there is a big step in the right direction, but like your lawn, it needs regular care not to overgrow. Without a solution to keep track of the growth, the problem will just return.
5. Monitor remediation in real time
Remediating files across an organisation requires real-time management and monitoring processes so that an organisation can assess the progress being made. It can also serve as a tool to get executive-level buy-in to the program.
Remediation with InfoSure
InfoCentric’s InfoSure service exposes your organisation’s current risk and ensure the organisation carries forward valuable information, leaving behind years of unneeded high-risk sensitive information. InfoSure has already helped organisations of more than a hundred million files to scan, prioritise, and remediate — significantly reducing potential exposure and harm.
Our clients are using it to:
- Retroactively remediate huge volumes of unstructured data.
- Target platforms such as OneDrive, SharePoint, and network drives.
- Continue to ensure new documents and data adhere to their policies and avoid reopening themselves to the same risks.
- Retaining detailed audit trails of remediation activities.
- Providing a collaborative approach to managing change at scale.
Does your organisation truly understand the extent of risk in the unstructured data it holds?
For more information, reach out to us at InfoCentric to discover how InfoSure can help.
InfoSure Sensitive PII Data Governance Service
Sensitive Data Scanning: Why is it important?
Client Story: Customer Remediation within the Banking Sector
Client Story: Managing the risk of a data breach for a major retailer