In 2020, organizations faced some of the most drastic challenges to a business environment in the digital age. Companies were forced to quickly adapt, cultivate resiliency and creativity, beside focusing on meeting their customers’ expectations.

According to a study conducted by Gartner, just 12% of more than 1,500 respondents believe their businesses were prepared to face the disruption last year, but with tech adoption accelerating as a result, more businesses will turn to digital operations, products, and ecosystems to stay profitable and relevant.

Data privacy has become the #1 expectation for every consumer across the globe, growing into something more than a set of rules and regulations driven by compliance standards, but rather one of the main pillars of brand recognition and customer loyalty.

With digital adoption, more and more sensitive customer and business data are being generated, as a result, so the ramifications for data privacy can only rise.

The Context

The COVID-19 pandemic has had a major impact on data privacy and cybersecurity mainly because of the social distancing that has changed both our personal and professional lives.

One of the consequences of this pandemic was that more and more consumers opted out of in-person shopping, relying heavily on the digital marketplace. So, organizations will have everything to gain by ensuring proper data protection to maintain customer loyalty.

Nowadays, more healthcare data is being collected than before, in many cases by organizations who never have previously collected this type of information. Organizations are collecting health data to support public health outcomes, causing growing concerns in how this data is being used and hold.

More Privacy Laws

Most websites these days, and this is one of the first things you are likely to see when loading a website, will notify you about data cookies, aspects like how the website is collecting your data, what it intends to do with it, for how long your data is hold, etc. Also, you are given the option to accept or reject these data usage terms.

Those terms are a direct consequence of the EU’s General Data Protection Regulation (GDPR), which although drafted in the European Union, it imposes obligations to every organization in case it targets or collects data from people residing in EU countries.

So, expect far-reaching data privacy legislation like the GDPR and the California Consumer Privacy Act (CCPA) to come into force in more regions this year, responding to an ever-greater need of privacy protection.

Gartner data suggests that by 2023, 65% of the world’s population will have their personal data covered under some form of modern privacy regulation, up from 10% in 2020.

Data Privacy Automation

With new privacy laws coming into force, different legislation, and compliance procedures in different territories, will make it difficult for companies to keep track of which laws they must adhere to.

This has led developers to create software to automate data privacy. These can range from management platforms to handle privacy requests to filters and preference settings tools.

In 2021, we can only expect the trend of data privacy automation to become more widespread, with more software solutions being developed and more organizations purchasing automated data privacy and management solutions.

Better User Awareness

Cyber hygiene advocates have repeatedly highlighted how end users are often the weakest link in the chain allowing, either by accident or with intent, data security breaches at their organizations. This has further aggravated in 2020 as employees became familiar with the work-from-home processes.

Notorious cyberattacks such as the ones against SolarWinds and FireEye, also the Cambridge Analytica – Facebook scandal have brought the issue of data privacy to the public’s attention on a scale that has not been seen before.

Users are now actively concerned about how their data is being captured, how it is used and have even shown that they are willing to leave extremely popular platforms like WhatsApp if they feel their data is not safe.

Such data awareness is good for the user, but it could be bad for some organizations that are not transparent about which third parties are able to access sensitive data or refuse to give clients full control over what cookies they can enable.

Users are constantly discovering how much information is collected about them (spending habits, IPs, usernames, emails, etc.) how that data is used, and how cyberattacks put that information at risk.

More Data Security & Privacy Jobs

With the long-term changes brought on by the Covid-19 pandemic, along with new data privacy regulations, organizations will probably face several security challenges, driving the demand for cybersecurity talent even more.

The pandemic has changed the workplace, forcing companies to quickly adapt. The rush to support a remote workforce has led many organizations to take a leap of faith into the cloud and are now facing new security challenges having to support hybrid work environments.

Conclusion

While not all organizations are required to comply to certain data protection standards such as HIPAA, or data privacy laws like the CCPA, they should still follow data protection competencies as it is essential for them to build and maintain an environment of trust.

Location flexibility is one of the benefits of telecommuting, but as remote working becomes standard practice, information security becomes more of a concern.

From employees using unsecured Wi-Fi networks to workers bringing their own unsecured devices, remote work has added additional levels of security related concerns for organizations and their data.

71% of business decision makers believe that the shift to remote working during the Covid-19 pandemic has raised the likelihood of a cyber-attack.

– According to new data released by independent polling company Censuswide.

Organization leaders and their employees need to accept mutual accountability in doing what they can to protect sensitive data.

To start, business leaders should allocate funds to educate employees in regard to data security and how everyone is responsible for protecting it. They also need to initiate certain practices and procedures that will strengthen data security within their organizations.

Remote workers must also prioritize data security education and best practices, then commit to those measures.

So, what can companies and their remote workers do to protect their data? Here are few aspects to consider.

Have a BYOD Policy in place

To avoid any unnecessary disputes and the costs associated with them, it is recommended to have a carefully drafted BYOD policy in place with employees. Not having a structured policy may create disputes over what data is what and it may also compromise intellectual property protection.

Endpoint Security

Installing an endpoint agent with the ability to perform data and malware protection will provide greater assurance into securing the endpoint especially if corporate data resides on the employee’s device.

Keep Passwords Strong | Use a Password Manager

Password protection is another fairly easy way to protect your organization’s data. Some people tend to underestimate the importance of password access, using the same password from device to device- account to account. Educating remote workers about password protection is crucial to securing sensitive data. Start with the basics of how to keep passwords strong and why it is so important to not use the same one over and over.

Another way for organizations and employees to alleviate this risk is by using a password manager that will allow users to randomly generate passwords and store them safely. This way, employees can focus on their daily tasks without needing to remember all their passwords for different accounts. Also, data will remain secure and uncompromised.

Plan for authentication and authorization

Act as if a breach is inevitable to further improve the security of your company. Multi-factor authentication (MFA), monitoring access controls, and creating strong passwords are important hacks that every smart company should know by now.

Many organizations are moving to two-factor authentication (2FA) for their data security management. This method confirms a user’s identity by first requiring a username and password, as well as another piece of information, whether it be an answer to a “secret question” or maybe a PIN sent to the user’s cell phone.

Having the right authorization levels is crucial. Especially for remote workers, having access only to the necessary applications and features is the best way to go. Companies must develop the habit of granting ‘least privilege’ access rights. This means giving only the minimum permissions required by an end user.

Watch out for phishing threats

Phishing threats that target remote workers are on the rise. Usual phishing strategies include getting employees to engage with suspicious content through what seems to be essential notifications. Phishing threats often include obvious errors such as bad grammar and spelling. Well-trained and aware remote workers will be able to spot these signals.

Consider running simulated phishing campaigns to test your employee’s awareness to potentially harmful emails, from who opened or clicked shady links to who entered credentials or submitted suspicious forms.

Therefore, it is important to develop a remote working culture that takes IT security best practices as a top priority. When it comes to cyber security, organizations should plan for every possibility and leave nothing to chance. Remote workers must be trained to avoid and report any suspicious activity.

All the buzz words are out there; virtual CIO (vCIO), IT Advisory Services, Technology Advisor, etc.  Yes, all the reasons why you should engage in such a service is important, but it should be more than just good advice.

Let’s explain the key aspects of an IT Advisory practice, and what it can do for you.  Then we should talk about the key differentiator between “talking about IT strategy” vs. “doing IT strategy”.

Key aspects of an IT Advisory practice:

Assists in aligning IT to your business objectives

• Involves in strategy meetings with leadership/management
• Comprehends short-term vs. long-term initiatives

Identifies and documents your infrastructure

• Aligns technology with your business objectives
• Hardware and service standardization, from workstations, networks, servers, backup solutions, and cloud services

Recommends process improvements, investments and savings based on your infrastructure and business objectives

• Assists in developing your IT budget based on useful life of your current environment
• IT governance policy and process, along with new technology recommendations

Recognizes vulnerabilities to achieve your business objectives

• From compliance shortfalls to security vulnerabilities
• Starting with identifying, then communicating, and finally prioritizing solutions

“Talking about IT strategy” vs. “Doing IT strategy”:

When a managed IT service provider tells you, they provide vCIO or IT Advisory services, ask them what their methodology is and do they have a platform to orchestrate the process. As was mentioned in a previous blog “MSP-Are You Getting More Than A HelpDesk”, also ask if the service is being delivered by a dedicated resource or an engineer who also resolves tickets, etc.

Too often IT providers market that they provide Virtual CIO (vCIO) services, but those services are being provided by an engineer who is also responsible for resolving tickets or installing hardware. When you ask about advisory services, ask if this service is delivered by dedicated individuals, or is it part of the responsibility of the engineering team.

Any IT provider selling IT Advisory services should have three key aspects to ensure it’s the right service for you.

1. A dedicated team solely focused on the customer success and tasked with supporting and driving positive change in your business.
2. A methodology geared around a strategic, business driven, technology consulting process to engage with customers. A methodology that is a value-add service to assist customers through an ever-changing technology landscape, from cloud migrations, to implementing proper security protocols.
3. A platform to orchestrate the methodology, where the customer and advisor can share, document, communicate, and track decisions and agenda items in one portal.

It’s easy for someone to talk to you about IT strategy, and they will call it vCIO services, but you deserve more than just a conversation.  Engage with an IT provider that has a dedicated team that provides a proven methodology through a transparent process on driving success with their customers.

Contact StratusPointIT and ask about our STAR methodology, and see how we are “doing IT strategy”.