Data Protection Best Practices for the Financial Services Industry

The financial services industry is undergoing a major transformation driven in large part by accelerating digitization and the adoption of emerging technologies like AI and the cloud. There are also a multitude of stakeholders and moving parts within financial services, and, with the emergence of blockchain technology and digital currencies, the ecosystem is growing. This means financial institutions are collecting more data than ever and that data is highly diversified.

Our best estimates suggest that at least 2.5 quintillion bytes of data is produced every day and, according to recent industry research, by 2025 we will create 463 exabytes of data each day, the equivalent of 212 million DVDs. The financial services industry accounts for a large percentage of this total. Banks alone have 1 exabyte of stored data, which is equal to 275 billion MP3s.

Because of the nature of the data, such as credit details and social security numbers, financial services and banking organizations are 300 times more likely to be the victim of a cyberattack than other organizations, underscoring the need for a strategic approach to data protection. Here are ten steps for financial services organizations to consider for strengthening their security posture and recovering data safely for business continuity and resilience:

1. Develop a Comprehensive Data Protection Strategy: Start by developing a holistic strategy that is inclusive of all the different types of data that your financial institution generates or gathers, the location of the data storage, who has access to it, and what level of protection each type of data requires. This strategy should be well-documented and communicated to employees with access to sensitive data and quite possibly a broader set of employees depending on their role.

2. Data Classification and Segregation: Not all data is created equal. Classifying data based on its importance and sensitivity can help determine the level of protection it requires. The most critical data should be segregated from the rest to reduce the risk of unauthorized access and exposure.

3. Regular Data Backup: Implement a routine and systematic data backup procedure. Both on-site and off-site backups should be made to guard against data loss due to different types of threats. Ensure that the backups are airgapped and encrypted to maintain data confidentiality. Backups are the last defense against ransomware. Therefore, ransomware is now directly targeting backup software and storage. Utilizing diverse backup storage methods reduces the risk of simultaneous attacks on both primary data and a backup of that data. It is critical that one of your backup copies is on immutable storage to ensure your data is recoverable from ransomware and cyber threats. Object storage and tape are the two most common immutable options. Tape provides the additional benefit of being a true airgap.

4. Implement Data Replication: For mission-critical business data, replication across multiple systems or locations can help ensure business continuity even in the worst of circumstances. Data replication enhances the availability of data by creating multiple copies in real-time, helping mitigate risks associated with system failures or what we in the industry coin—disasters—brought on by mother nature or just human error.

5. Automated Disaster Recovery Planning: Develop a comprehensive disaster recovery plan that includes procedures for restoring data from backups and replicated systems. This plan should be automated as much as possible to reduce downtime and should be tested regularly to ensure it works in the manner required for your business. Most financial institutions are looking at RPO and RTO.

6. Data Encryption and Security: Use strong encryption to protect your data both at rest and in transit. Implement robust security measures, including firewalls, backup gateways, cyber deception tools, intrusion detection systems, SIEM\SOAR integration, and regular security audits.

7. Strict Access Controls: Implement strict access controls and zero-trust authentication mechanisms to ensure that only authorized individuals have access to critical data. This can include measures like two-factor authentication, least privilege access, privilege access management, multi person approval for data deletion, and regular audits of access logs.

8. Regular Vulnerability Assessments and Penetration Testing: Regularly test your systems for vulnerabilities and patch them promptly. This can help you catch potential weaknesses before they can be exploited.

9. Continuous Monitoring and Updating: Continuously monitor your data and systems for any suspicious activity. The threat landscape is always evolving, so regular updates to your financial institutions data protection strategy, software, and systems are essential to stay ahead of potential threats. This includes keeping up to date with the latest data protection regulations and compliance requirements.

10. Educate Employees: Finally, educate and train your employees about the critical nature of data security, their role in maintaining it, and the best practices they should follow. This includes proper password management, recognizing phishing attempts, and safe internet practices.

Any organization that collects, processes, or stores data is at risk of a breach—especially those operating in financial services. As regulations continue to evolve and security threats increase in volume and complexity, financial organizations need to be proactive. By employing the ideas and best practices shared here, you can reduce the risks to your company, customers, and all other stakeholders in this critical ecosystem.

BIOGRAPHY

Giles Westie, Founder & President, DataPivot Technologies

Giles Westie is the Founder & President of DataPivot Technologies, an award-winning data center and cloud technologies solution provider with a focus on enterprise data protection and security.  Westie founded DataPivot in 2015 with a vision of building an innovative, customer-focused technology services business with a great culture and long-term sustainability.  Prior to starting DataPivot, Westie held sales leadership positions at Imceda Software and XOsoft, both of which had successful exits, as well as serving as a sales executive for several years with Commvault (NASDAQ: CVLT).  It is at Commvault where Westie developed his expertise and passion for Enterprise Data Protection.  Westie earned his bachelor's degree in business management from Babson College where he was also a four-year collegiate basketball player earning all-conference recognition for his performance. In his spare time, Westie enjoys basketball, boating, reading, and encouraging his four children in a variety of youth sports.