Why enterprises need to adopt ‘need-to-know’ security

Abstract

A host of different cyber attacks – including phishing and ransomware, advanced persistent threats conducted by nation-state actors, zero-day exploits and more – are forcing security professionals to bring their ‘A game’ to work every day. In addition to these attacks, information security professionals must manage information in compliance with data privacy regulations such as the General Data Protection Regulation (GDPR) and Health Insurance Portability and Accountability Act (HIPAA) or else face stiff fines. Massive data breaches and large penalties imposed by regulatory bodies show no signs of abating and continue to make headlines across the world. To thwart new attacks and prevent breaches, you need to develop a new mindset that challenges the status quo and nurtures new ways of thinking, especially when it comes to protecting information assets. Traditional approaches are being rendered ineffective by social engineering attacks, globalisation and the Internet of Things. In the face of these and other challenges, a multipronged approach with a ‘need-to-know’-based security model at the foundation is an effective strategy to secure enterprise information and prevent a breach, explains Aaron Rangel of iManage.