Securing Unstructured Data: A Best Practice Guide to Balance Data Protection and Accessibility

An important component of the current data-driven landscape that businesses operate in is the sheer diversity of sources and formats contributing to the ever-increasing volume and wide distribution of data stored within their IT environments. One outcome that businesses strive in today’s Big Data world for is to analyze the deluge of data at their disposal and uncover valuable insights that can improve operational intelligence or result in a competitive advantage.

However, data security is a concern that needs to take precedence even above the undisputed benefits of analytics. Privacy regulations protect many categories of information, and noncompliance is costly. Internal sensitive documents also need to be kept from prying eyes. Complicating matters is that up to 80 percent of enterprise data is unstructured, which creates unique security challenges. This article clarifies what unstructured data is and overviews five best practices for strengthening its protection.

What is unstructured data and why is it so hard to protect

Unstructured data is information that doesn’t conform to a predefined data model and isn’t organized into a standard database structure. Sources include reports, contracts, emails, audio recordings, video files, presentations, survey results, and more.

Unstructured data is an analyst’s dream because its purpose is adaptable due to it being stored in its native format. There is also the potential to spark much greater insights from all this data because there is so much of it, although specialist data science skills are necessary.

Some characteristics of unstructured data make it harder to protect than the structured datasets you find in Excel spreadsheets or SQL databases:

• Wide dispersal — In contrast to structured datasets used within centralized applications, unstructured data can end up anywhere from on-premises to cloud storage to employee devices. Employees with access to a file server might download sensitive files to their own devices or share them on unsecured personal cloud storage accounts. This wide dispersal makes it hard to track where the data ends up and ensure it’s properly protected.
• Complexity — The heterogeneity of data sources makes it tricky to ascertain what data needs protection. Businesses have thousands of files ranging from innocuous anonymized survey findings to highly sensitive intellectual property. Furthermore, the complexity extends to how unstructured data could quickly change from non-sensitive to sensitive whereas this categorization is far more stable in a structured dataset.
• Difficult access control —  for traditional database applications, fine-grained access controls are easy to implement and manage by administrators or IT security personnel. With unstructured data, users are often left responsible for using these files in a secure way, and all it takes is one error to compromise sensitive data if there is no client-side security mechanism in place.

Best practices for securing unstructured data

Effective modern cybersecurity strategies take advantage of defense in depth practices to protect information and systems. By layering multiple controls, you enable superior security. The following best practices for securing unstructured data focus on encryption, the last line of defense that ultimately safeguards information when all other measures fail.

Client-side encryption

Client-side encryption applies encryption to data locally on a user’s device before it’s transmitted from that device to any other system, including on-premise servers or the cloud. This type of encryption mitigates datad exfiltration in the face of a cyber attack.

The often chaotic flow of unstructured data assets within an IT environment makes client-side encryption a useful security tool. There is also comfort in the fact that you know your data files are protected before they leave your devices and your network.

Encryption for Cloud storage

There are a few approaches to encryption for cloud storage, each presenting its own pros and cons. PII protection and protection for other sensitive types of information are imperative in the cloud, and encryption goes a long way to secure critical data assets in cloud storage systems.

Conventional encryption solutions entrust the cloud provider to generate, store, and manage the keys used to encrypt your company’s unstructured data files. Even if the vendor is reputable and the encryption algorithm is strong, this approach is unpalatable for companies that care about having total control over sensitive information assets.

Other options depend on managing a centralized key architecture, such as BYOK where you generate your own encryption keys but the cloud service provider ultimately controls them, and HYOK where you never pass the keys to the cloud provider. Newer solutions aim to decentralize the process and remove the risky link between encryption key management systems and identity and access management controls.

File-level and folder level vs full disk encryption

With unstructured data existing in myriad formats and often moving around in a frenzied fashion as users copy, share, and move files to many locations, file or folder level protection makes sense as the chosen encryption method versus full disk. More important than file-level encryption is persistent file encryption which ensures that a file or all files within a folder remain protected with encryption no matter how many times users copy, move, or share the data.  

Logging and auditing of file-level encryption

The hampered visibility over data flows that distinguished unstructured data calls for robust logging and auditing of encryption. Logging ensures that you have a record of each encrypted file while auditing enables spot-checks to see if there are any discrepancies between what the logs tell you is encrypted and what a sample of data files from your environment reveals.

Don’t rely on traditional encryption practices

Not to negate any of the previous advice, but there are some issues with relying on traditional encryption practices for protecting unstructured data. Of particular concern is the centralized key management system architecture typically deployed in conventional practices. Not only is a KSM resource-intensive, but having a central key store with keys often based on user account passwords creates a single point of failure. User friction regularly hampers traditional practices too.

Multi-Factor Encryption: The Last Line  of Defense

Don’t leave your data at risk for exfiltration with outdated and default encryption. Instead, opt for a more modern approach that ensures a last line of defense to protect data, simplify the user experience, and visualize data usage and security trends. 

Atakama delivers unrivaled data protection by redefining the encryption landscape. Atakama’s decentralized, multifactor approach to cryptographic key management protects organizations from data exfiltration. With Atakama, security practitioners and end-users alike realize true data protection and unimpeded business performance.

By enabling a last line of defense that provides unrivaled data protection, critical assets remain secure when identity and rules-based access controls fail. This is achieved through the utilization of AES-256. A unique key for each object is automatically fragmented and distributed across workstations, mobile devices, or Atakama Key Shard Servers (KSS). Eliminating central points of attack and central points of failure.

With Atakama, organizations gain greater transparency to visualize and analyze encryption status and usage of data for compliance, reporting requirements, and operational decision making.

Atakama’s multifactor encryption removes the conventional trade-off between data security and convenience. A simplified administrative and end-user experience facilitates productivity without sacrificing security.

Atakama supports all major platforms across desktop and mobile devices. Request your demo today to learn more.