“Threat actors are having more success with breaching and exfiltrating sensitive unstructured data targets.”

Your organization’s sensitive unstructured data is a rapidly growing threat surface increasingly targeted by cybercriminals and threat actors. While more attacks are directed at structured databases, cybercriminals are having greater success in stealing sensitive unstructured data.

It’s because this type of data poses a unique series of security and privacy regulation challenges, many of which are not addressed by today’s investments in network, device and application security, cybersecurity frameworks or traditional vulnerability management strategies.

Unlike structured data that resides in well protected IT perimeters, sensitive content exists in unstructured formats such as office documents, CAD/CAE files, or images and are distributed and published via file sharing, social media and email.

You generate it when HR collects personal employee information, your sales teams add customer contact information into your customer relationship management (CRM) system, your engineering/security teams collaborate with third-party intellectual property (IP), and so on.

Sharing and storing sensitive information in free-form documents that live outside carefully monitored or secured databases is now a widespread practice. This creates a gap that presents countless opportunities for unauthorized disclosure through inadvertent handling by employees, actions of malicious insiders, and cyberattacks.

Businesses are mobilizing to combat these threats. The first step is to ensure your organization understands the character, significance and challenges surrounding sensitive unstructured data. Focus on these topics to drive better organizational insights into why and what can be done now to close the gap

“Who cares about sensitive unstructured data?”

Unauthorized access or loss of sensitive data hurts your competitive advantage, damages your brand, and can incur significant regulatory penalties.

In addition to customers and potential loss of revenue,

• Breach of partner information exposes the business to legal damages and seriously impacts the relationship and reputation of both parties.
• Regulators are responding to increased threats and individual rights. Over 80 countries now have published privacy laws. Non-compliance penalties are increasing and more strictly enforced. Your data may be subject to overlapping and often conflicting requirements.
• Corporate Governance, Risk and Compliance(GRC) committees define the level and handling policies of sensitive information. New threats and trends must be reflected in policies to guide activities to implement systems and procedures to safeguard this content.
• Security and IT professionals have spent considerable time focused on network perimeter tools and gap analysis shows shortfalls in safeguarding unstructured data. To fix this, they are turning to data-centric approaches and tools to protect the data itself rather than its location.
• Employees create and share unstructured office documents, PDFs, CAD/CAE, internally and externally daily, and should work to protect content appropriate to its sensitivity level (e.g.,confidential, internal, public).

“What are the types of sensitive unstructured data?”

Sensitive data is any information that must be safeguarded from unauthorized disclosure. The broadest categories are regulated or unregulated. The former, as required by laws, must be handled as sensitive. Unregulated data includes both business sensitive and publicly known
information. It’s up to the business to determine what content it deems sensitive.