Wie schützen Sie Ihre Daten in einer Remote- oder hybriden Arbeitsumgebung?

Regarding password encryption: Keeper uses Zero Knowledge architecture, a system where encryption and decryption of passwords always occurs locally on the user's device. A Vault record is encrypted by a unique and client-side generated 256-bit AES encryption key in GCM mode. Each record-level key is wrapped by a 256-bit AES Shared Folder key if it is contained within a Shared Folder. Record and Folder Keys are encrypted with another AES-256 key - the Data Key. For users who login with a Master Password, the keys to decrypt and encrypt data are derived from the user’s master password, know only to that user. For SSO users or Passwordless technology, Elliptic Curve cryptography is used to encrypt and decrypt data at the device level.

I agree but each data set or data type require different treatment. For example the data which does not lead to identification of users in any way could be merely anonymised. Similarly financial details such as bank account or card number or cvv which may cause fraud or financial crimes should be encrypted.

- Implement multi-factor authentication and access controls to limit data access - Encrypt sensitive data in transit and at rest - Ensure devices have updated antivirus and enabled firewalls - Establish security policies for remote data handling - Prohibit public WiFi use and unauthorized data sharing - Regularly backup systems and install patches - Monitor for threats with intrusion detection and data loss prevention - Conduct security awareness training on phishing and protocols - Maintain patch management - Limit data access to only what is needed - Take a defense-in-depth approach with layered controls

The first step in securing data is understanding the risks involved. Conduct a thorough risk assessment to identify vulnerabilities in your remote or hybrid work setup. This should include an evaluation of: - Devices used for work (laptops, smartphones) - Network connections (Wi-Fi, VPN) - Data storage and transfer methods - Employee awareness and training Implementing Security Measures like: 1. Endpoint Security 2. Network Security 3. Data Encryption 4. Access Control 5. Employee Training 6. Monitoring and Incident Response

Hybrid or remote work environment risks are beyond mere encryption. In a way its like third party risk- where someone is connecting from a unknown network. The data leakage risks are high as well in a remote set up. Encryption is must to protect data in transit. The data at rest encryption is important as threat could be theft of device. Add to that, its important to enforce multi-factor, strong password policies, UBEA, monitoring to ensure remote employees and their devices are secured at all times.

Embracing a multi-tiered approach. This should encompass leveraging both cloud-based and on-premises backups, establishing a cadence of hourly incremental backups, and integrating a 24-hour roll-up, reinforced by backup monitoring protocols. This comprehensive strategy will fortify your data resilience and ensure operational continuity.

I would consider ensuring that my backups are encrypted and stored securely, both on-premises and off-site. Just in case in the event that these backups are accessed by unauthorized party.

The ideal set up would be use virtual desktops or create isolation layers like Citrix where all critical data is stored on company servers and not individual machine. This eliminates the need for backups and also potential threats where backups could be infected by ransomware etc. However not all organizations can afford this set up. - Take backup using 3-2-1 rule - Test restores of backup - Keep backup in secured location - Your backups should have same level of access controls and protection - When you don't require data for processing, do not forget to wipe backups. Else they become source of data leakage.

The best known mechanism for Data Availability, during a Disaster or a Ransomware attack is still valid as ever. In any context that is part of a Commercial Value-stream backing-up is relevant. Separation of the back-up from the operational in a back-up strategy is an a-priori requirement. This maybe a combination of Access, Network and Location. If the back-up strategy is one of replication it may also have the advantage of being part of an on-demand scaling-up strategy. However the latter is a secondary priority to the backup being separate, as stated above.

Define and Implement Access Roles: This crucial process ensures that only the necessary roles have access to specific data segments, preventing unauthorized access and safeguarding sensitive information.

One common practice is sharing administrator credentials and utilizing them often. This is extremely common practice can make audit trials useless in detecting fraud activities and exposes companies to high risks. Highest privilege credentials shouldn't be used for day to day tasks and each technical team member should have credentials assigned to their account so audit trial will be helpful to detect issues. This practice needs to be enforced from the IT or infosec leadership.

Access control, proper training and awareness combined are vital. Especially given a typo can result in a misconfigured network environment vulnerable to exploitation.

The principle of least privilege fails when you have a large volume of data as this leads to an explosion of data access roles. Best approach would be to create data access policies only when needed based on the criticality and sensitivity of data.

I think a 2 step verification is the way to go. Businesses and their customers can benefit from using two-factor authentication. It increases security safeguards, enables monitoring, and lessens the possibility of account hacking. Of course, there are some disadvantages to 2fa that you should be aware of, but overall, any organisation will gain from it

Training your staff must also happen on a regular basis to ensure awareness and knowledge of latest mitigations and vulnerabilities are addressed and understood.

Teach them specifically about phishing attacks, social engineering techniques, and how to identify and report suspicious activities. These are the most common attack vectors. Moreover, encourage strong password practices and the responsible use of company resources.

In speaking to privacy compliance training, it needs to be bespoke to select groups of people. C-suite has wildly different needs in comparison to direct data-facing staff for example. C-suite needs to know the implications of potentially intrusive new processes that might infringe on the rights of data subjects. Contrarily direct data-facing staff need to be able to identify a breach/DSAR, know who to contact for help, where and how to fill out the relevant form, where the procedure is, etc etc..

Train staff in how they can become paperless, even more important if the remote roles is in a different state or country. Share best practices on how this can be done and encourage coauthoring platforms that drive live sharing of comments and notes.

Key selling point for experts in the world of Privacy/Data Protection. New regulations are coming into effect almost weekly at the moment, knowing what regs are in effect in which jurisdictions for the data you process is critical to maintaining compliance. AKA: you can't follow the rules if you don't know what the rules are..

The NIST Framework has struggled to bring industry and government aboard the cybersecurity framework and regulations it has worked for over 2-3 decades on. It is incredibly helpful to have insights on working groups related required updates to the framework, however socializing it and ensuring it is comprehensively adopted is a MUST. Not enough focus is there.

Updating privacy policies for your business and your clients show you care. Taking the time to ensure you are working within the framework of US and international regulations saves time. Be sure to connect with reputable companies and sources to make this an easy security administrative task.

Nothing says 'we've not checked this page in a while' like a Privacy Notice that refers to the Data Protection Act 1998 (replaced in 2018), or reference to Privacy Shield as a mechanism for international transfer (invalidated in 2020, and since replaced by the EU/U.S. Data Protection Framework).

As Two-Factor Authentication (2FA) enhances security in the banking domain, implementing Multi-Factor Authentication (MFA) in a remote or hybrid work environment can significantly improve data security. MFA adds an extra layer of protection by requiring users to provide two or more verification factors before granting access to sensitive systems, applications, or data. This makes it much more challenging for unauthorized individuals to gain access, even if they manage to obtain login credentials.

Monitor and audit: Implement security monitoring and logging mechanisms to detect and respond to potential security incidents. Collect and analyze logs from various sources, such as firewalls, intrusion detection systems, and endpoint protection solutions. Conduct regular security audits to identify vulnerabilities and ensure compliance with security standards.

All of these approaches meet best practices. Depending on the size and complexity of your organisation, Data Governance can assist with creating the overarching frameworks to treat "data risk" holistically and help ensure that data privacy, information security, and information technology are aligned.

In my experience, another way to increase data privacy would be to use synthetic data, instead of the real data. Synthetic data is artificial data trained to reproduce the original data structure and components. This is one of the many privacy enhancing techniques. Some of the other useful ones are pseudonymization and data masking. When it comes to data security, the architecture plays a big role. There’s an increased awareness in setting up a federated network for preserving data ownership, security and privacy.

Insist on virtual / remote work environments such as virtual desktops. It ensures that by design it’s already much harder to take data out of a secured and protected environment - you’d have to very deliberately take it outside of the berouwvol desktop. Similarly, encourage going paperless - keep data in the respective digital environment.