What is Data Protection? A Complete Guide

Remote and hybrid work. Frequent job changes. Expanded use of contractors. Layoffs and hiring freezes.

The workforce is evolving rapidly, which means keeping an organization’s data secure can be a constantly moving target.

That’s where data protection comes into play.

In this article, you’ll discover all you need to know about protecting your data — including how to prevent damage to your company’s finances or reputation without disruptive policies that impede employee productivity.

What is data protection?

Data protection is the set of systems and processes that guard an organization’s data against loss, leak, theft and unavailability. A robust data protection practice monitors all data by sifting through trusted data movements to detect risky behaviors — allowing security teams to use their time efficiently.

Why is data protection important

Data protection is essential as it helps companies prevent data breaches, exfiltration, downtime and damage to reputation and finances. Organizations must also enforce data protection to restore lost or corrupted data and meet regulatory requirements. 

This practice has become increasingly necessary as workforces grow in volatility and risk unauthorized data removal.

Principles of data protection

There are two guiding principles of data protection: data availability and data management. Here’s a closer look at these fundamental components.

Data availability

Data availability is the process of ensuring data is available to applications and end users like customers, employees and vendors when and where they need it. 

While data availability might seem independent of other facets of data protection, like security and regulation, it goes hand-in-hand. 

Hybrid and remote work has forced companies to adjust security protocols to ensure data is available in situations that traditional on-premise security protocols and firewalls didn’t support — like employees using poorly secured home networks. Another example is collaborating with contractors or vendors, which requires data availability on more cloud storage and applications. 

Of course, increased availability necessitates new and innovative data management approaches.

Data management

Data management is the practice of storing, transmitting, maintaining and monitoring data. This concept is crucial in developing a data protection strategy as it defines how employees and other stakeholders work with data.

With data becoming more available at the permitters of networks such as remote employee laptops and personal cloud applications, data management has taken on a new role. Security teams must now track data movements on these remote devices and applications and understand trends of this activity to detect and flag risky behavior that necessitates intervention.

Types of data protection technologies

Since data protection pertains to security, availability and management, there are many technologies that aim to help companies accomplish these goals:

• Tape or disc-based backups: This technology consists of physical devices that security teams use to store or “back up” data assets. 

• Storage snapshots: In the form of an image or other reference point, storage snapshots reflect data at a specific point in time. 

• Continuous data protection (CDP): Also called continuous backup, CDP is a system that backs up data on a computer system every time someone makes a change.

• Firewalls: These devices monitor traffic to or from a network. They allow or block traffic based on a defined set of security rules.

• Encryption: Encryption is the process of securely converting data to and from scrambled text so you can store or transfer it between devices without compromising the raw information. 

• Endpoint protection: This data protection technology focuses on monitoring and preventing threats on endpoint devices — items on the edge of a network — like laptops and mobile phones. 

• Data loss prevention (DLP): DLP solutions detect potential data leaks and exfiltration. They require extensive classification of data in order for network administrators to monitor and control what data users transfer. If a company doesn’t classify data, it goes unmonitored by a DLP.

• Insider Risk Management (IRM): IRM solutions are a risk-based approach to data protection. Unlike conventional DLP methods, IRM solutions monitor all data, not just data a company has already labeled, making it an ideal approach to managing a quickly changing workforce. IRM helps security teams prioritize what data matters most to their unique needs and respond promptly to data risks without impeding employee productivity.

Awareness of all the possible technologies for protecting your data can help you evaluate what solution would work best for your organization.

Data protection trends

As computing environments evolve, several new trends are emerging that are affecting the data protection landscape:

Workforce volatility

Since the COVID-19 pandemic, the workforce has become more volatile with people changing jobs frequently. Several factors have driven high turnover at companies: 

• Resignations due to pay, benefits, work arrangements or desire for more fulfilling work
• Potential recession fears
• Increased use of contractors
• Layoffs and hiring freezes

This workforce unpredictability has led to an increased risk of departing employees taking data with them as they go — whether maliciously or because they feel ownership over their work.

With this augmented chance of data exfiltration, security teams must implement new data protection protocols to confront this risk. In addition to monitoring and risk management, they can conduct training measures to ensure employees know what data is not legally theirs to keep.

Hyper-convergence

Hyper-convergence is an IT infrastructure that fuses storage, computing, and networking into a single system. Under this framework, IT administrators can interact with a single interface — often through virtual machines (VMs) — rather than managing the complexity of distributed hardware and resources.

The benefit of hyper-convergence from a data protection perspective is that it reduces the surface area a security team needs to manage. Additionally, it can automate much of the complexity around resource allocation, data duplication and backups.

Ransomware protection

Ransomware is a type of malware that encrypts crucial data so users can no longer access it. Typically, it demands a ransom payment from the victim to the attacker for decrypting the data. This act leaves the victim with the tough decision of losing data or paying a hefty ransom with no hard guarantee the attacker will fix the problem.

Companies can implement ransomware protection technologies to help monitor common malware entry points, such as phishing campaigns. These solutions can also help isolate infected devices to prevent lateral movement and minimize the attack area.

Zero trust

Zero Trust or zero trust architecture is a security model that requires all users to go through continuous authentication when accessing internal applications, data and servers. 

Unlike a traditional network that relies heavily on firewalls to protect an isolated network, a Zero Trust system does not assume traffic is coming from a trusted source.

The Zero Trust model is becoming increasingly important for modern data protection, as companies can no longer assume cloud applications and remote workers are within the confines of a secure local network. Systems must authenticate users through other methods, such as single sign-on (SSO) and user access control.

What data protection helps prevent

Ultimately, organizations implement data protection to solve specific security problems. While these can be wide-ranging depending on the type of business, some common issues span most companies that data protection can help prevent:

Data loss with departing employees

Organizations tend to view the risk posed by departing employees in black or white terms. They either assume most of their employees would never take any information or think anyone who takes data is doing so maliciously. 

The reality is that it’s not black and white and that there’s instead a substantial gray area. With 76% of data exfiltration incidents being non-malicious, most people aren’t trying to steal information. They’re doing things like:

• Pulling together their best work to help them land a new job
• Taking the projects they’re most proud of with them
• Grabbing templates or guidelines with them to use in their new position
• Collecting “their” client information
• Deleting files to “help” clean up their devices for the following user

The vast majority of employees have the best intentions, but these actions put company data at risk regardless of intent.

Data protection systems can help companies mitigate departing employee data loss threats — even before an employee submits their two weeks — by detecting anomalous behavior. Security teams can also provide situationally relevant training to ensure employees know how essential it is to not take anything with them that the company owns. 

See how Code42’s Instructor solution can help you provide micro-trainings as an education response control for data risk events by reading this article.

Intellectual property (IP) theft

The theft of intellectual property (IP) like unique ideas, inventions or other information by parties without permission to borrow or reuse it isn’t limited to departing employees. Current employees and outside actors can be threats, too.

Companies can alleviate the risk of IP theft by monitoring data flow in and out of an organization and conducting employee training on safe data handling procedures. These data protection strategies will help ensure data stays safe, and in the rare occurrence of a breach, the business can quickly resolve it to minimize the damage.

Data corruption

Data corruption is the occurrence of an error(s) in data storage or transmission, reducing the usability of data or even making it completely inaccessible. This problem can happen for several reasons, including hardware failure, software bugs and even solar flares.

Since one of the principles of data protection is making data readily available, a data protection strategy must have protocols to monitor and fix data corruption. 

For example, many security systems will maintain checksums — a sequence of numbers and letters for checking data for errors — of files and regularly scan the files to ensure they haven’t changed. If the data protection system detects a mistake, it can use its backup and restore protocols to revert the file to a previously uncorrupted state.

Notable data protection regulations

The trends and changes in data protection aren’t only of interest to companies and their security teams. Governments worldwide are diving into data privacy and security regulations, significantly impacting how these systems operate. 

Some of the most prominent laws include:

GDPR in the European Union (EU)

The General Data Protection Regulation (GDPR) is an EU law published in 2016 that gives individual users of digital services more rights and control over their personal information used by corporations and other organizations. 

Companies that operate in or work with countries in the EU that don’t comply with these regulations are subject to steep fines — up to 4% of a company’s global revenues or 20 million Euros.

Data protection laws in the U.S.

Unlike the EU, the U.S. has no single principal data protection legislation. Instead, hundreds of federal and state laws aim to protect Americans’ data. Here are a few examples of those laws:

• The Federal Trade Commission Act: This law prohibits unfair methods of competition and requires organizations to respect consumer privacy.

• The Health Insurance Portability and Accountability Act (HIPAA): HIPAA regulates health information storage, confidentiality and use.

• The California Consumer Privacy Act (CCPA): This 2018 law gives Californians the right to know about the personal information companies collect about them, request deletion of such data and opt out of its sale.

As data protection continues to grow as a priority in an increasingly digital world, U.S. laws will likely evolve in the years ahead.

CPS 234 in Australia

Australia introduced the Prudential Standard CPS 234 in 2019 to regulate how organizations in the finance and insurance sectors protect their information security from cyber threats. It also requires strict auditing reporting systems to be in place to ensure systems stay compliant.

Differences between data protection, security and privacy

While people in your organization may use the terms data privacy, data security and data protection interchangeably, there are some critical differences between them:

• Data privacy: This practice focuses on controlling who has access to sensitive data, often personal, and relies on data protection regulations to achieve compliance.

• Data security: A subset of data protection, data security is the practice of protecting the integrity of data against manipulation and risky behavior from external and internal threats.

• Data protection: As outlined in this guide, data protection is the set of systems and processes that protects data from misuse, ensuring it’s available to those permitted to use it while supporting employee productivity.

Knowing the differences between these terms can help prevent misunderstandings, especially when working with departments outside of security.

Start protecting your data without disrupting collaboration

Data protection is essential for businesses to mitigate risk, promote uptime of services and prevent loss or misuse of data. However, accomplishing these goals requires monitoring all files, vectors and user activities, without hindering employee collaboration and productivity. 

An Insider Risk Management solution like Code42’s Incydr can help you do this while meeting the complex requirements of a rapidly changing workforce.

Gartner ranks Code42 as a leading data protection solution

Find out why Insider Risk Management is the fastest-growing category in data protection and security when you download Gartner’s IRM Market Guide.

Download Market Guide