Proper Data Management Is a Business Driver as Well as a Responsibility

Based on an article by David Chan, Managing Director, AdNovum Singapore

Data now ranks among the most valuable assets a business holds, writes David Chan, managing director of AdNovum Singapore. It supplies the intelligence behind mission-critical decisions. Because it can also be turned into money, whether sold on the dark web or used directly for fraud, it attracts cybercriminals the way a flame attracts moths.

Chan points to two incidents from April 2021. The details of more than 500 million users of a social networking platform were posted on an underground site frequented by cybercriminals. A week later, a local security firm said that around 62,000 emails from members of the public, businesses and their customers, some containing sensitive personal identification information, may have been accessed by cybercriminals. Breaches like these are happening more often and doing more damage, and consumers have grown more cautious about how safe their data is.

As the threat has grown, Chan says, attitudes to cybersecurity have changed. Data management is still a cornerstone of how enterprises defend themselves, but organisations increasingly see it as a strategic function and a way to gain an advantage over competitors. Handled well, it can create a great deal of value for the whole organisation, both inside and outside its walls.

Trust, intellectual property and talent

Chan cites PwC research showing that close to nine in 10 consumers (87 per cent) would move their business to another company if they did not trust a firm to handle their data responsibly. Governance is a large part of using data responsibly. The right governance policies stop errors from creeping into an organisation's data and guard against misuse of personal information, balancing how data is collected against what privacy rules require. Making a visible commitment to protecting consumer data and using it responsibly can strengthen trust and loyalty in the brand, and bring in new business later.

Robust data management policies can also give a business an edge. Intellectual property sits at the core of every organisation and is what sets it apart. Data protection that cannot be breached keeps that information from being stolen, so the organisation stays in front of its rivals.

Meanwhile, the role of data in business has grown exponentially. Companies depend on it to shape strategy for product development, customer service and efficiency. When data is clean, secure and has not been tampered with, they can trust that the insights they draw from it are accurate, which leads to more innovation and better results.

Chan adds that responsible data handling helps with hiring too. An organisation that shows it takes this seriously can present itself as ethical and focused on people. That reputation draws new customers and also helps it find and recruit the talent it needs to succeed in the new normal.

Building a well-rounded data management strategy

All personal data is now closely regulated under privacy law. Chan gives two examples: the European Union's General Data Protection Regulation (GDPR), which applies to any organisation doing business in the EU, and Singapore's Personal Data Protection Act (PDPA). It falls to businesses to secure the hardware and software that collect and store such data, and to show that their approach to managing it is sound.

Alongside governance policies, backup and protection measures act as a safety net that can prevent breaches or limit the damage. The starting point, Chan says, is knowing what sensitive data needs protecting, where it is kept and how it is used. Data discovery tools are very useful for locating files at any moment. Data classification tools then determine how the data should be handled and protected, which policies should surround it, and which risk-reduction work should come first. They also help separate and manage different kinds of data, so that organisations can put in place the controls needed for compliance.

With full visibility and control over its data, an organisation should next reassess how it protects that data. Older on-premise tools tend to be siloed and give decision-makers little insight. During a breach every second matters, and security teams must be mobilised at once to contain it. Chan argues that moving data protection to the cloud can give real-time visibility into the health of an organisation's networks and trigger the right security measures when they are needed.

Cloud services bring many capabilities and conveniences that suit businesses' changing needs, but they also open more doors for attackers. Chan recommends that businesses consider encrypting their data so that criminals cannot intercept and exploit it.

Under GDPR and PDPA guidance, organisations should also be careful to collect only the minimum data needed to deliver the services they have agreed to provide. Protection should be switched on by default, and consumers should not have to opt in to have their personal data safeguarded. Security has to be built into every step, from the moment data is gathered to the moment it is deleted from the system.

On backups, Chan advises caution over regret and recommends the 3-2-1 rule: keep at least three copies of the data, hold two backups on different devices or storage media, and keep at least one copy off-site. Several copies in several places mean a breach cannot wipe out an organisation's primary data completely.

Preparing for the inevitable

Prevention, in cybersecurity as elsewhere, is better than cure. Chan's view is that organisations which show the additional safeguards they have adopted, and make clear their commitment to protecting customer data, will earn consumers' trust, encourage new products and services, and gain a reputation as socially responsible corporate citizens.