Hindsight can be a wonderful thing, but when it comes to data security and potential breaches, it’s best to ensure that your security policies and tools are able to protect your organisation.

Yet, despite the regular headlines caused by high-profile data breaches, many organisations still do not know how best to react once breached or, indeed, follow best practice to prevent a breach from happening in the first instance.

New research conducted by Bloor Research, in conjunction with Boldon James, highlighted data security as a critical or serious concern for most organisations surveyed, with data classification recognised as a foundational tool for ensuring data security.

>See also: The decade of the data breach – how to cope

Whilst organisations may have the best intentions, some are still missing a trick and suffering with potentially-costly data breaches that not only impact on revenue – particularly with the impending European General Data Protection Directive set to come into effect shortly – but also their reputation within the industry and customer base.

So what measures should organisations look to implement, both in advance of and after a breach, to ensure they have effective information governance strategies in place?

Don’t spend, spend, spend on any old security tool

Imagine the worst has happened and your organisation has suffered a data breach because a highly sensitive document was shared with a third party instead of a colleague. What do you do?

The research revealed that the most common reaction following a data breach (accounting for 86% of respondents) is to pump money into purchasing new data security tools and attempt to tighten security policies, assuming this will diminish the risk of future breaches.

This poses the question of which tools do you actually need? Is it a firewall, a data loss prevention (DLP) solution, a network access control (NAC) device, or security information and event monitoring (SIEM)? Or all of the above?

Organisations are faced with lots of options on new and next-generation tools to purchase, but before they can make a choice they must also decide what it is they need to protect and how they are going to solve the overarching problem of understanding the value of the data to the business. If you don’t know what your data is, how can you decide how to protect it?

Many analysts including Forrester and Gartner now recommend that organisations adopt a data-centric security strategy. This means deploying tools that ensure the security afforded to an email or document (or any data within the corporate network) travels with that data throughout its lifecycle to inform any and all security decisions.

Organisations can no longer just set up security policies and permissions that end at the network perimeter. With an increase in the ways data is shared and also the devices on which data is held in the workplace, data needs to be stored and communicated carefully and correctly to minimise the risk of a data breach, particularly with the advent of the BYOD and CYOD trends within businesses.

Include the users

One of the biggest assets organisations already have when implementing new security arrangements is often the one neglected from the beginning: the users. Historically, anything to do with IT security was kept away from users by IT teams concerned that it was either too complex, too disruptive or required specialist skills to execute.

However, this mindset needs to change and is changing – in reality, users are already on the frontline of data security, as they are the ones creating and handling the data and therefore are best placed to understand its value to the business.

The research revealed that 60.5% of organisations focus on increasing user awareness and training following a breach, which is a positive sign. Including users expands the reach of IT security across the entire business and gets users proactively thinking about how to protect information and prevent a breach.

Such was the case with Allianz Ireland, which implemented a user-driven data classification solution in order to protect sensitive and valuable information assets and distinguish between the different types of data it uses.

>See also: Don’t let a data breach destroy you – a history lesson

The solution forced users to select a classification value before a document could be shared or an email sent. Within several months, the company not only saw a 60% improvement in employee awareness of data security practices, but also found a significant reduction (89%) in breaches.

In order to make a real impact within an organisation, either before or after a data breach, there must be a change not only in the data security tools and policies, but a change in the security culture within the entire business.

Implementing a data-centric security approach, driven by users’ knowledge of the value of the data, can deliver tangible business benefits and reduce the risk of a data leak.

Sourced from Martin Sugden, MD, Boldon James