Data Privacy Concerns Prompt Companies to Improve Deletion Practices

Companies today collect and store sensitive data from their employees, customers, and partners. However, the mishandling of this data can lead to serious breaches, which may expose private information to the public. Cybersecurity vendor ESET reported last month that 56% of decommissioned routers sold on the secondary market contained sensitive corporate data such as authentication keys, IPsec and VPN credentials, and hashed passreplaces. Confidential data, including proprietary code and corporate secrets, are often stored in GitHub and other software repositories.

Cloud-based vulnerabilities resulting in data leaks usually arise from misconfigurations of the systems. Despite these concerns, there’s a lack of proper attention given to identifying potential data vulnerabilities. This article will discuss the risks of exposing confidential data and offer recommendations on the best practices for preventing data breaches.

## Hardware and Software Inventories

Having both a hardware and software inventory of all systems in place is essential. A comprehensive list of all hardware devices is necessary for maintenance and compliance purposes. In contrast, a software asset inventory can help protect cloud environments where security teams might not have access.

When a hard disk is retired, application deletion might not remove all data from an unattended.xml file in the Windows operating system. This file can still contain confidential information that can lead to breaches. As a result, physically destroying disks or overwriting the entire disk is advisable to ensure confidential information is removed entirely.

## Risks Associated with Unstructured Data

Unstructured data, which includes data from nonrelational databases, data lakes, email, and call logs, can pose significant risks if not correctly handled. Mark Shainman, senior director of governance products at Securiti.ai, suggests that specific policies safeguard unstructured data to protect confidential data. Access intelligence policies can control who has access to data and what level of access is appropriate.

## Third-Party Risk Management

Sharing data with third parties poses significant risks to handling confidential information. Therefore, implementing specific encryption policies and masking policies can protect sensitive data in a downstream environment. Third-party risk management (TPRM) policies can help partners access data approved by their clients while preventing access to unauthorized data.

## Conclusion

Data protection and privacy have become critical issues in today’s world. Companies handling confidential information have an obligation to protect privacy and secure their data. All devices should have clear hardware and software asset inventories, and access policies should be updated regularly. The guidelines can be established using documents such as NIST’s Special Publication 800-80 Guidelines for Media Sanitation and the Enterprise Data Management (EDM) Council’s security frameworks. Companies implementing these standards and guidelines can ensure that their confidential data is suitably protected.

Data Protection.-dataprivacy,deletionpractices,companies,concerns