How to Address Sensitive Data Sprawl

Every organization has sensitive data—customer data, employee data, or operational data. Sensitive data can come in many forms, including:

• Personnel records
• Credentials used in application code or cloud services
• Personally identifiable information (PII)
• Personal health information (PHI)
• Payment card data that is subject to PCI DSS
• … and more.

Every type of sensitive data has its unique security requirements and associated risks. Compounding those risks is the complexity of infrastructure and applications, which can disperse an organization’s sensitive data across storage locations, cloud service providers, or clusters. This dispersion is known as “sensitive data sprawl.”

Without a proper data governance plan, it’s a massive challenge to track and manage this data effectively. The level of difficulty in maintaining security and compliance is incredibly high.

In this post, we’ll discuss what sensitive data sprawl is and how it happens. Then, we’ll look at the solution to this sprawl: centralizing sensitive data. Finally, we’ll look at the benefits of adopting a solution: What headaches might you avoid, and what opportunities might you seize if you take the critical step of centralizing your sensitive data?

Let’s dive in.

What is Sensitive Data Sprawl?

Sensitive data sprawl occurs as private information spreads across company infrastructure and systems.

Contributing Factors

Sensitive data sprawl is the natural outcome for an organization that’s not intentional about its data governance policies, security controls, and IT practices. Let’s examine these factors one by one.

Lack of Data Governance

As a company grows—and its body of data grows with it—a typical result is missing or inaccurate records about which data is sensitive, where it’s located, and how it’s managed. Data governance establishes policies around data labeling, secure data disposal, and well-defined data ownership.

Without data governance providing a clear picture of organizational data flows, an organization will have unknown and unprotected data floating across its infrastructure and systems.

Sidestepped Access Controls

Access controls—such as role-based access control (RBAC) or attribute-based access control (ABAC)—are critically important for restricting access to sensitive data. Organizations must consider and implement thoughtful security controls to minimize the possibility of insider threats or external attacks which could compromise sensitive data.

However, when an organization implements too many (or overly complex) security controls, employees may sidestep those controls to take the path of least resistance. They may adopt third-party apps or services which aren’t vetted by your security team. This use of “shadow IT,” in which a department handles its datasets its own way, can lead to data silos, duplicate datasets, and further exacerbate sensitive data sprawl.

Poor IT Practices

When an organization needs to implement changes to its distributed system but has poor IT practices, the possibility of human error increases. The result is sensitive data that is untracked and insecurely distributed. These practices include:

• No established or documented change management process
• No risk assessment
• No repeatable deployment process
• Inconsistent application of updates and patches
• Untracked configuration changes
• Unapproved integrations of services or applications

Negative Impact

The potential impact of sensitive data sprawl is not to be ignored. An organization with missing, weak, or often-sidestepped security controls is at high risk of data exposure, and the financial cost of a data breach can be crippling.

Without proper data governance, your organization cannot fully understand the current state of its sensitive data management. The time and resources needed for properly protecting and auditing sensitive records under these conditions can make complying with data subject requests – a common feature of many data privacy laws – a nonstarter.

Finally, you cannot ignore the impact to how your company is perceived. Dispersed and unmanaged sensitive data opens a company up to the risk of litigation, a loss of customer confidence, and a damaged market reputation.

How Should You Face the Challenges?

A proactive approach to addressing sensitive data sprawl promotes awareness around the collection, transportation, storage, and handling of sensitive data. Your company can preemptively create, implement, and follow a complete data governance policy to work toward this goal. It all starts with assessing your current state to determine what you need to fix.

Audit

As a responsible business, you should fully audit your infrastructure to assess your data privacy posture. Start by identifying each piece of sensitive data, along with associated security risks. This is a necessary step for establishing adequate governance policies for company-wide use.

Your organization should use the results of these audits to categorize the sensitive data that’s uncovered and assess immediate security concerns. Don’t treat all data the same. Leakage of some information like application telemetry data or performance logs isn’t nearly as much of a concern as exposure of PII or PHI. Your audit should cover all data sources, including:

• Network file shares
• Log files in a SaaS-based log management solution
• Datasets
• Software source code
• Other relevant data storage repositories

Secure

Next, your organization must consider security controls for all of its sensitive data. Different security controls can all contribute to an effective and overarching security policy. These controls include:

• RBAC and ABAC
• User training
• Data encryption (at rest, in memory, and in transit)
• Secure data disposal
• Regular auditing

While these types of security controls are essential, implementing them while dealing with ever-increasing sensitive data sprawl can be an uphill battle.

Centralize

As your organization reviews the results of its data audit and begins to formulate a data governance policy, you should consider adopting a centralized management solution for all sensitive data that you manage. Identify a solution made of one or many technologies that maintains rigorous security controls.

Consider your business goals and requirements to ensure collaboration across the enterprise and a reduced risk of shadow IT. You should avoid or prevent many of the contributing factors that lead to sensitive data sprawl through central monitoring, analysis, management, and configuration of security controls and sensitive data.

While you might be able to implement a centralized sensitive data storage solution manually, this approach can be very risky, costly, and inefficient. Sometimes, “rolling your own” introduces more problems than it solves. A more reliable option is to use an established, external data privacy vault for centralizing and managing sensitive data.

The Benefits of Centralizing Sensitive Data

Beyond achieving confidence that you’re handling sensitive data responsibly, centralizing sensitive data carries additional benefits: It lets you avoid headaches and seize opportunities.

Avoid headaches

Any company that deals with sensitive data must be ready to handle the following:

• A data subject request, in which a user requests to access or modify the personal information that a company may have about them
• A user’s request to exercise their right to erasure (also known as “right to be forgotten”), in which a company is obligated to delete any personal information that it has for that user
• An audit request by an external regulatory body regarding your company’s usage, scope, or handling of sensitive data

These requests—whether they’re related to GDPR, California’s CCPA, more recent laws like Connecticut’s CTDPA, or any other data privacy law or regulation—are the cause of incredible headaches for those companies that suffer from sensitive data sprawl. Complying with such requests when sensitive data is spread out and untracked across infrastructure and systems can be a time-consuming and resource-draining endeavor.

On the other hand, when all sensitive data for an organization is centralized and tracked in a vault, these headaches disappear. With a data privacy vault from Skyflow, for example, fully accommodating audits or data subject requests only requires a few simple calls to an API. Because all the information collected for sensitive data is managed in one place, you can be sure that responses to audits or data subject requests contain reliable, complete, and accurate results.

Seize opportunities

Data privacy and protection laws are ever-changing and constantly evolving. Your company may have worked tirelessly to meet data compliance requirements for its current markets, but if an opportunity for a new market—in a new region or industry—presents itself, how much time will you need to implement the compliance measures needed to enter that market? With sensitive data sprawl and the challenges of new requirements, your organization might just miss the boat.

However, by centralizing your sensitive data using a vault that keeps up with data privacy and protection regulations across regions and industries, you effectively offload the bulk of your compliance efforts to a trusted expert. When it comes time to explore a new market, your company can do so quickly and confidently, because you’re already prepared to meet the compliance requirements of that market.

Conclusion

Companies looking to efficiently and reliably centralize and manage their sensitive data can look at using a centralized data privacy vault as their answer. Managed through an API, Skyflow is a data privacy vault built on zero-trust principles. You use it to prevent problems like sensitive data sprawl, while enjoying a high level of security maintained through application, infrastructure, and operation-level controls.

Companies experiencing sensitive data sprawl due to poor information management are opening themselves up to significant risks. Manual workarounds can potentially be even more costly and inefficient. Implementing a comprehensive data governance policy and working with a secure and efficient data privacy vault is an excellent solution for controlling sensitive data and avoiding its spread across complex infrastructure and systems. The benefits include headache-free accommodation of audit or data subject requests and agility when exploring new markets with their own data privacy regulations.