Cyber Defense eMagazine February Edition for 2023

Step 1: take inventory.
First and foremost, organizations need to have full visibility into all the data and assets they hold. One of
the defining hallmarks of CPRA/CCPA is that it gives consumers the “right to know” what data is collected
and what it’s being used for. And as the organization, it is your responsibility to ensure full transparency.
I’m a firm believer that you cannot possibly protect what you can’t see. As companies continue to migrate
entirely to the cloud, their exposed data and resources need to first be identified before they can ever be
properly protected. Further, you need to understand who has access to that data, and this isn’t just
physical users. Often, malicious activity is done not by individual users with direct access, but by any
user who can trigger a cloud component to run activities for them. This is a blind spot security teams
should always be aware of – what components have access to the crown jewels within my organization?
Is there an open door because of mismanaged Identity and Access Management (IAM) policies that
potentially make the organization noncompliant? The new CPRA/CCPA regulations introduced two key
amendments that will make IAM even more critical in organizations – the “right to correct” and the “right
to limit use and disclosure” of sensitive information. Taking full inventory of what you hold is the first step
to remaining compliant.
Step 2: don’t neglect encryption.
Once data is identified, there are a few best practices all companies should employ to protect this
sensitive information. For one, don’t overlook encryption, which is probably the most useful yet simplest
technology to use. It is incorporated into almost every cloud and SaaS service that you have, so there’s
no excuse for organizations not to take advantage of it! One mistake I’ve encountered as both a leader
of Research and Development (R&D) teams and as an entrepreneur working with these teams, is the
tendency to disregard pockets of data as insignificant. But as we see with CPRA/CCPA, there is no data
that is not at risk of slipping through the cracks which could ultimately result in hefty fines. For example,
teams might spend time testing a data set and then proceed to delete it afterward, without realizing the
sensitivity of the data at hand. Although it may seem small, this exposed data can open the door to more
access, and in turn put your organization at risk. You must enforce the encryption policy at all times.
Remember, as the IT security team, it is your responsibility to control the data flowing in and out of your
organization. Encryption allows you a stronger hold over your data security in the cloud.
Step 3: maintain a least privileged state.
Cloud applications differ from legacy applications in that they are dynamic and change frequently. You
cannot employ a “set and forget” approach to the identity and access management of data in the cloud.
Rather, you need to ensure your security permissions are changing and adapting to the application
throughout time. Do you have the technology and processes in place that can alert you of any
unnecessary entities that can read your sensitive data? By constantly maintaining a least-privileged state,
you will reduce any exposed attack surfaces and limit the potential blast radius of a breach. Every
organization is different, depending on a variety of factors, including company size, processes and the
type of data they hold. Finding that perfect balance in granting privileges is key, especially where
CPRA/CCPA is concerned. For example, having too few permissions could result in denied actions, but
Cyber Defense eMagazine – February 2023 Edition 70
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.