Data risk management: what it means and why it matters for data-driven enterprises

News broke earlier that Johnson & Johnson, along with platform manager IBM, are looking at a potential class-action lawsuit over a data breach at J&J’s patient assistance program, Janssen CarePath. In a complaint filed with the federal court in the Southern District of New York, a Florida resident alleges that the pharma and tech giants failed to adequately safeguard personal identity and health information, a violation of both industry standards and the Health Insurance Portability and Accountability Act, or HIPAA. The lawsuit, seeking a class-action designation and a jury trial, aims to secure damages and demands that J&J and IBM take immediate action to enhance their data security measures.

Businesses, regardless of size and industry, should follow suit before a court orders them to do so.

In the race to stay relevant in the digital experience economy, companies are storing and analyzing more data than ever. “Beyond tracking your viewing habits, purchases, and even location, companies are gathering all the data they legally can, down to your height, weight, hobbies, and pets,” concluded PCMag citing extensive research on what personal info social networks, online retailers, streaming services, sharing apps, and the like are legally collecting about users at sign up or over time. The upside? Smoother, more tailored services, better organizational efficiency, and uncharted revenue streams. The downside is an onslaught of new cybersecurity risks, which often gets ignored.

In this article, we’ll take a closer look at the risks involved in data management, the impact they have on organizations in operational, financial, legal, and reputational terms as well as the data risk management solutions and best practices that can help businesses efficiently mitigate them.

What is data risk management? Definition and key concepts

An emerging area in risk management, data risk management (DRM) is a structured approach to recognizing and managing the threats and vulnerabilities related to the handling of data in an organization. As an integral part of corporate risk management strategy, data risk management aims to minimize companies’ attack surface associated with collecting, storing, and using data while maximizing its business value.

The core of data risk management lies in identifying, assessing, and mitigating data-related risks. The first step of this process is pinning down existing and possible threats to the organization’s data assets, followed by a comprehensive evaluation of each threat’s potential impact. This includes everything from financial loss to damages related to reputation, customer trust, legal and regulatory compliance, and operations.

Companies should make a conscious effort to consider data risk in and outside the realm of cybersecurity, points out ISACA. Poor data governance and management over the data life cycle can be just as detrimental to businesses and their customers as poor data security management, with consequences ranging from infrastructure compromise to staff recovery costs and a dent in brand value and reputation.

Effective data risk management also includes creating a risk management plan tailored to the organization’s needs, regularly updating and testing the plan, and promoting a culture of data privacy and security within the organization. In a broader sense, ISACA offers, it should also support an organization’s efforts to achieve data resilience. That is, having “the reliability, security, usability and capacity to quickly bounce back from adversity.”

Why is data risk management important? 5 key reasons

1. Ensuring regulatory compliance

A sound data driven risk management strategy and program ensures that organizations are in compliance with relevant data protection regulations and standards like the General Data Protection Regulation (GDPR) and the Payment Card Industry Data Security Standard (PCI DSS). Non-compliance with such data privacy and security laws can easily result in hefty fines, legal issues, and a tarnished reputation.

2. Preventing data breaches

Data risk management practices help prevent data breaches, which can lead to substantial financial losses from both the immediate impact of the breach and potential penalties for non-compliance with data protection regulations. Besides, the reputational damage that comes with such incidents often harms customer trust and loyalty as well, affecting the organization's market position and prospects for growth.

3. Securing sensitive information

DRM plays a crucial role in protecting sensitive information from unauthorized access, alteration, or destruction, thus maintaining the confidentiality, integrity, and availability of data. Exposure of sensitive data can lead to severe financial losses, legal repercussions, and irreversible reputation damage. Not to mention a compromised competitive advantage, should the information be leaked into the hands of competitors or malicious third parties.

4. Gaining competitive advantage

A strong DRM strategy not only has the potential to boost customer confidence and loyalty but also enable companies to tap into the power of digital and analytics and accelerate growth. In a data-powered world, that’s worth its weight in gold. Risk executives are up to the challenge, with 72% resoundingly saying that capitalizing on digital transformation initiatives is key to their companies’ growth, according to PwC’s 2022 Pulse Survey.

5. Adapting to a rapidly evolving threat landscape

IoT vulnerabilities, remote working security risks, vishing, phishing and other pretexting attacks, cryptojacking: the cybersecurity threat landscape is constantly changing, with cyber crime incidents now estimated to cost the world economy in excess of $1trillion, or 1% of global GDP, per year. Data risk management programs are crucial for organizations to adapt their data protection strategies and remain resilient in the face of new threats.

7 types of data risks every organization should be aware of

The Wall Street Journal defines data risk as “the exposure to loss of value or reputation caused by issues or limitations to an organization’s ability to acquire, store, transform, move, and use its data assets.” Let’s have a look at what type of risks fall into this category.

1. Cyber attacks: cybercriminals can exploit data vulnerabilities to steal or manipulate sensitive data assets, leading to financial loss for companies and distress for customers.
2. Data breaches: unauthorized access, disclosure, or theft of data, often due to weak security measures, can result in severe penalties and damage to the company's image.
3. Data loss: accidental deletion, hardware failures, or natural disasters can lead to the loss of crucial data, disrupting operations and potentially leading to financial damage.
4. Insider threats: misuse of access privileges by employees, either intentionally or unintentionally, is a significant risk that can lead to data breaches or loss.
5. Non-compliance: failure to comply with data protection regulations can result in hefty fines and legal penalties, as well as loss of trust among customers and stakeholders.
6. Third-party risks: Companies often share data with partners, vendors, or contractors, increasing the risk of data breaches if these third parties lack adequate security measures.
7. Lack of employee awareness: without proper training, employees might not follow data protection protocols, jeopardizing the company’s data privacy and risk management efforts.

Building a data risk management framework: 10 must-haves

1. Regular updates: Keep all systems, software, and applications up-to-date. This helps fix security vulnerabilities and enhances protection against cyber threats.
2. Data encryption: Encrypt sensitive data both in transit and at rest to ensure that even if the data is accessed by unauthorized personnel, it remains unintelligible.
3. Multi-factor authentication (MFA): Implement MFA wherever possible so your data assets are not easily accessed and misused by simply cracking a password.
4. Employee training: Regularly train employees on the importance of data security and the role they play in preventing breaches, from identifying to handling potential threats.
5. Strict access controls: In line with the principle of least privilege (POLP), only grant data access to employees who need it for their job functions.
6. Regular audits: Check if your DRM strategy is still effective and aligned with your business needs as well as to uncover fresh vulnerabilities or previous data risk assessment blindspots.
7. Secure physical storage: Keep physical storage devices in a locked, monitored location with restricted access to prevent data from being stolen, misplaced, or damaged.
8. Third-party security: Ensure that any third-party vendors or partners that you share data with have robust security measures in place to mitigate the risk of supply chain attacks.
9. Data backup: Regularly back up data and test restoration procedures. This can help recover lost data in case of a breach, human error, power outage, hardware failure, and more.
10. Incident response plan: Create a detailed plan with all the tools and protocols for spotting and handling security incidents in a timely, efficient and coordinated manner.

How Tresorit can help you keep data risks at bay and cloud collaboration productive

A zero-knowledge, end-to-end encrypted cloud storage and collaboration platform, Tresorit empowers you to:

1. Make the cloud a safer place with E2E encryption

Every file and relevant metadata on our users’ devices are encrypted with randomly generated encryption keys. Accessing files is only possible with a user’s unique decryption key that no one else, not even Tresorit, has knowledge of. Meaning that even if our servers were breached, no one would be able to read their contents.

2. Keep access secure and limited

Monitor and decide which devices are allowed to access which files and from where users are allowed to log in to their company account to safeguard business-critical documents. Manage files and tresors at a granular level to ensure they’re only accessible to those who need them and limit downloads or revoke access at any time.

3. Stay in control of what happens to your data

Implement data protection measures, including controlling who has access to what data, logging file activities, and creating internal security policies for data management. No file content can be modified without you knowing about it, thanks to cryptographic authentication applied to all encrypted data in the form of HMAC or AEAD.

4. Set up and enforce enterprise security policies in one place

Make sure that everyone on your team is on the same page when it comes to using crucial data security tools and processes. Apply policy templates, including 2-step verification, IP filtering, timeout policies, and sharing policies, create different policies for each template and modify them at any moment through a single interface.

5. Encrypt attachments automatically in Gmail and Outlook

Empower your teams to work efficiently and send encrypted emails by integrating Tresorit with Google Workspace or Azure Active Directory and Office 365. The add-ins offer a fast and easy way for users to replace risky email attachments with encrypted share links and password-protected files using their existing email addresses.