Should data security be a focus of data governance? While we agree that data security is the realm of the Chief Information Security Officer(CISO), typically reporting to the Chief Information Officer(CIO), data governance programs and frameworks provide business oversight and guidance for data security priorities. Using the popular seven-layer model for data security, we explore the role of data governance in guiding the process.

1. The Seven-Layer Model for Data Security
2. Level 1: People – Mitigating Human Error and Insider Threats
3. Level 2: Perimeter – Bolstering the First Line of Defense
4. Level 3: Network – Securing the Internal Highway
5. Level 4: Endpoint – Shielding the Data Outposts
6. Level 5: Application – Strengthening the Vulnerable Gates
7. Level 6: Data – The Jewel of the Citadel
8. Level 7: Mission Critical – Protecting the Crown Jewels
9. Conclusion

The Seven-Layer Model for Data Security

The people-centric seven-layered data security model focuses on human elements as crucial components of the security equation. It emphasizes the importance of proper awareness training, access control, and social engineering defences for securing data.

The seven layers of cyber-security act as a defensive framework, safeguarding your data and systems from unauthorized access, manipulation, or destruction. Think of it as a series of concentric rings, each layer adding another line of defence to protect your information at different levels. Let’s delve into each layer:

• People: Building a security-aware workforce through training and education.
• Perimeter: Physical and network security controls to defend against external threats.
• Network: Secure internal communication channels and segmentation.
• Endpoint: Securing individual devices like laptops and phones.
• Application: Protecting software applications from vulnerabilities.
• Data: Safeguarding the data itself through encryption and access controls.
• Mission-Critical Assets: Focusing on protecting your most sensitive and valuable information.

Level 1: People – Mitigating Human Error and Insider Threats

This layer focuses on the human element, recognizing that people are both assets and potential vulnerabilities. It incorporates:

• Security awareness training: Educating employees and users about cyber threats, phishing scams, and best security practices minimizes human error and insider threats.
• Access control and permissions: Establishing clear policies and procedures for who can access sensitive information and systems helps prevent unauthorized access.
• Phishing and social engineering defences: Implementing email filtering, multi-factor authentication, and awareness campaigns protects against social engineering attacks that target human psychology.

Data governance empowers your people with clear policies and training, reducing the risk of accidental data leaks or misuse. Studies show that 88% of data breaches involve human error, highlighting the importance of building a data-aware culture. (Source: Stanford University) Data governance fosters ownership and accountability, making individuals actively invested in protecting their entrusted data.

Level 2: Perimeter – Bolstering the First Line of Defense

This layer acts as the outer wall of your cyber fortress, guarding against external threats:

• Firewalls: These act as gatekeepers, filtering incoming and outgoing traffic, and blocking malicious attempts at access.
• Intrusion detection and prevention systems (IDS/IPS): These systems constantly monitor network activity for suspicious behaviour, alerting you to potential breaches before they occur.
• Web application firewalls (WAFs): These specialized firewalls shield web applications from vulnerabilities and common attacks like SQL injection or cross-site scripting.

While firewalls and intrusion detection systems guard the outer castle walls, data governance acts as a drawbridge, controlling access at the point of entry. Data classification policies should ensure that only authorized users access sensitive information, minimizing the impact of successful perimeter breaches. A Ponemon Institute report revealed that 66% of organizations lack proper data classification, significantly increasing the potential damage from compromised credentials. (Source: Forrester Research, The Data Security Money Pit report)

Level 3: Network – Securing the Internal Highway

This layer secures the internal communication channels within your network:

• Network segmentation: Dividing your network into smaller, isolated segments restricts the spread of malware and limits the damage caused by breaches.
• Data encryption: Encrypting data in transit and at rest ensures only authorized individuals can access it, even if attackers intercept it.
• Virtual LANs (VLANs): These logically separate network segments based on function or department, further enhancing security and restricting unauthorized access.

Data governance lays down traffic rules for your network’s internal data pipelines. Access controls and activity monitoring act as vigilant guards, detecting and preventing unauthorized data movement. Gartner research finds that 52% of organizations fail compliance audits around implementing effective internal data access controls, leaving information vulnerable within their walls.

Level 4: Endpoint – Shielding the Data Outposts

This layer focuses on individual devices like laptops, desktops, and mobile phones:

• Antivirus and anti-malware software: These tools detect and remove malicious software threats on individual devices.
• Endpoint detection and response (EDR): These solutions provide deeper monitoring and analysis of endpoint activity, enabling rapid response to potential threats.
• Patch management: Regularly updating software and firmware on all devices ensures vulnerabilities are addressed and patched before attackers can exploit them.

Data governance extends its protection to every laptop, server, and mobile device. Encryption policies and data loss prevention measures become the knights guarding each remote outpost, securing data even beyond the central castle walls. A 2023 WatchGuard study revealed that 88% of corporate endpoints are hit by data breach attacks.

Level 5: Application – Strengthening the Vulnerable Gates

This layer focuses on securing the software applications you use, both internally and externally:

• Secure coding practices: Developers must follow secure coding principles and use reliable code libraries to minimize vulnerabilities within applications.
• Application security testing: Regularly testing applications for vulnerabilities helps identify and patch security gaps before attackers can exploit them.
• Vulnerability management: Tracking and prioritizing known vulnerabilities across your applications ensures they are addressed promptly.

Applications are often the gateways to your most critical data. Data governance ensures rigorous security testing and vulnerability management, effectively patching any breaches in the castle gates before attackers can exploit them. According to a Veracode report, almost 70% of applications have at least one critical vulnerability, demonstrating the importance of proactive application security measures within the data governance framework.

Level 6: Data – The Jewel of the Citadel

This layer focuses on protecting the data itself:

• Data classification and labelling: Classifying data based on its sensitivity and applying appropriate access controls ensures that only authorized users can access it.
• Fine-Grained Access Control: FGAC restricts access at an attribute and row level, even for authorised users. This limits the impact of any breach.
• Data encryption: Encrypting data at rest and in transit protects it from unauthorized access even if attackers breach your systems.
• Data loss prevention (DLP): This technology prevents sensitive data from being leaked or exfiltrated from your systems.

At the heart of the castle lies the data itself. Data governance defines policies to identify and protect confidential data, with 66% of respondents to a Gartner survey listing improved data security as a key benefit. (Source: Gartner, Data Governance Frameworks and Challenges)

Level 7: Mission Critical – Protecting the Crown Jewels

This layer focuses on protecting your most critical and valuable data and systems:

• Backups and disaster recovery: Regularly backing up data and having a robust disaster recovery plan ensures you can quickly restore operations even in the event of a major attack.
• Incident response planning: Having a clear plan for identifying, containing, and mitigating security incidents minimizes damage and helps you recover quickly.
• Continuous monitoring and analysis: Actively monitoring your systems and analyzing security logs helps you identify potential threats and take proactive measures to address them.

Finally, data governance safeguards your most critical information, the crown jewels of your data kingdom. Access controls, data loss prevention, and backup and recovery strategies become the royal guard, ensuring vital data remains secure and readily available. A Harvard Business Review study found that organizations with strong data governance practices are 60% more likely to successfully recover from data breaches, minimizing downtime and financial losses. (Source: Harvard Business Review, Data Governance: What Leaders Need to Know)

Conclusion

Data governance is not a single layer; it permeates every facet of your data security posture, weaving an invisible armour that strengthens each level of your digital fortress. By implementing a robust data governance program, you can mitigate risks, prevent breaches, and ensure your data remains the valuable asset, not the vulnerable target, in today’s increasingly complex digital landscape.

These seven layers work together to create a comprehensive defence against cyber-attacks. By focusing on each layer and implementing appropriate security measures, you can significantly reduce the risk of data breaches and protect your valuable information. Remember, cyber-security is an ongoing process, not a one-time event. Regularly assess your security posture, implement new technologies and practices, and educate your users to stay ahead of evolving threats.

Remember, the journey to data security excellence is ongoing. Start by assessing your current security posture, identify gaps in your data governance framework, and build a strategy that suits your unique needs. With data governance as your invisible armour, you can confidently walk the walls of your digital citadel, secure in the knowledge that your information is protected and empowered.