How Organizations can Safeguard Personal Identifiable Information (PII) Data

 

Personal Identifiable Information (PII) encompasses any data that can uniquely identify an individual, such as names, addresses, social security numbers, phone numbers, email addresses, and financial details. Cybercriminals actively target this information for fraudulent activities, often causing severe harm to the victims.

A recent example highlights the severity of such breaches: British Airways (BA) faced a proposed £183 million fine by the Information Commissioner’s Office (ICO) for a security breach disclosed in September 2018. This breach affected around 380,000 transactions, compromising names, email addresses, and credit card information. Despite BA’s efforts to mitigate the damage, the attack significantly harmed the company’s reputation and resulted in a substantial financial penalty.

Organizations often store personal data for various operational purposes, including usernames and passwords, passport numbers, social security numbers, and telephone numbers. If this data is stolen or leaked, it can be catastrophic for an organization’s reputation. Research indicates that most data breaches involve PII, which tends to cause the most damage.

To protect PII data, organizations should take the following broad steps:

1. Data Discovery

Regularly review and audit the environment for PII. This includes PII from employees and the PII that organizations handle on behalf of customers and business partners.

2. Identifying PII Data

Identify the PII data that an organization collects, stores, and uses. This step is crucial for effective PII protection.

3. Classifying PII Data

Classify PII data according to its sensitivity level to determine the appropriate security measures for each type.

4. Implementing Security Controls

Implement administrative, physical, and technical measures to protect classified PII data. According to GDPR guidelines, critical business data should not be stored in plain text.

5. Monitoring and Auditing

Continuously monitor and audit the effectiveness of PII security controls to ensure they are correctly implemented and remain effective.

Using data discovery tools can help organizations filter out sensitive data and automatically mask, truncate, or delete data based on timestamp filters.

6. Deleting Unwanted or Old Data

Evaluate and delete any sensitive data that is no longer needed for business functions or legal requirements to minimize risk.

7. Encrypting Remaining Data

Encrypt or mask necessary data, restrict access to this data to a single server or location, and ensure it is not stored on removable media devices.

8. Reviewing Policies

Implement stringent data management and processing policies to prevent inadvertent storage and misuse of data.

9. Awareness, Training, and Education

Conduct regular cybersecurity training and education programs for employees to emphasize the importance of data vigilance and best practices. Encourage employees to report suspicious activities.

Conclusion

Protecting PII data is a critical responsibility for organizations that handle such information. By implementing a comprehensive set of security controls, organizations can safeguard PII data and protect their customers from identity theft and other serious consequences.