Here's how you can safeguard confidential or sensitive information as an executive manager.

Technologies for safeguarding confidential data have been around for quite some time, and it is even currently possible to use generative AI itself to mask or protect data quite effectively. But like everything, the main difficulty of data governance involves the human factor. It is necessary to define data governance processes and technologies, but it is even more necessary to involve the different profiles of the company so that they assume roles and responsibilities over the company's information, either as owners, custodians or users of the data. Therein lies the real difficulty in obtaining a good result, because it is first necessary to achieve a good data business culture and this is something that does not happen overnight.

Agencies and organizations needs to have trainung policies in place on how confidential information should be communicated and discarded, mandatory training for their employees on cybersecurity every quarter will help employee know how to Navigate the online space with caution ,and what information to send out via secured / encrypted links , how to determine Phishing and malicious communications .

In this specific case we need to consider the information flow models and specifically the Bell- Lapadula model will be good to consider right at the design phase. This model presents three rules Simple security rule, which is the no read up. * Property rule, which is no write down Strong star, which requires that is a subject has both read and write capabilities, these two functions can only be performed at the same security level. adopting this security will go a long way in safeguarding sensitive information flow.

Em minha experiência vivi em muitas realidades em que o gestor fornecia a senha para seu time para que as informações fossem acessadas e/ou trabalhadas. Acredito que o controle de acesso +o treinamento do time sobre a criticidade das informações sejam mais assertivas e tenham um melhor resultado prático.

Advanced technologies such as Security Information and Event Management (SIEM) systems, automated response tools, and threat intelligence platforms can significantly enhance an organization’s ability to detect, analyze, and respond to incidents swiftly and accurately. These tools help in monitoring network activity, identifying anomalies, and automating initial response actions, which are crucial for mitigating the effects of a breach.

As head of data governance and security projects, I have been using different information protection and safeguarding technologies for many years. They are not (were) simple projects, since they imply starting from a very detailed knowledge of the companies' data, an issue that is not always clear, which is why it almost always involves an initial effort of identification, analysis and cataloging of the information, which even using data discovery tools is not possible to automate 100%. However, we are currently testing the use of Generative AI, and the results are very promising. Likewise, it does not solve the problem 100% but the ease of development and associated costs have been reduced x10.

Todays, well known companies are secure enough not to allow 3rd parties connect with them via VPN and may block! So, applying VPN shall not be a good option.

One of the best bangs for your buck is cyber security insurance from a reputable provider. Aligning your incident response plan with the requirements and advice of the insurer is very important. The good insurers actually work with and guide you to develop a robust, best-practice for incident response plan and business continuity plan. They’ll do periodic audits of your network and technology and make improvement recommendations.

A well-defined incident response plan is critical for mitigating the impact of data breaches. This plan should include procedures for detecting, reporting, and responding to security incidents. Regular drills and simulations help prepare the team for real-life scenarios. An effective incident response plan not only minimizes damage but also ensures compliance with legal and regulatory requirements. In my experience, having a dedicated incident response team and clear communication channels can significantly improve response times and effectiveness.

One thing I’ve found helpful is to incorporate confidentiality requirements into processes. This reduces ambiguity and provide clear guidelines to employees.

I have learned throughout my career that there is good training and there is bad training. I have also learned that people do not all learn the same way. With that, I encourage you to hire professional security trainers to build your training curriculum and content. Some people will respond well to entertaining self-paced on-line training. Others need that live presentation to absorb the content. Many will do better reading a set of procedures. And don’t miss an opportunity for a lunch and learn or a webinar to help promulgate the expectations and behaviors your organizations needs to become part of its security culture.

In my experience, failures around appropriate treatment of confidential information have almost always been at the human level. Training employees to understand the risks is critical. Culture plays an important role. Do all employees understand and value integrity? Do they understand that their own reputation and that of the firm are dependent on their ability to consistently and responsibly handle information? Systems are only as good as the people who use them and the way they are used, so training and regularly refreshing your team on appropriate treatment of confidential information will always be critically important.

Starting with policy creation could add more to the paper-universe, so let’s ensure it’s practical and impactful. From my experience working with companies ranging from 500 to 100,000 employees, here’s a refined approach: start by Executive Insights (30-min Meetings) • Identify Key Information: Determine the “golden nuggets” aka crown jewels that need protection, including categories of sensitive data. Most importantly: "why". • Business Reflection: Most executives will evaluate their own departments and identify specific vulnerabilities. You don't even need to ask. • Actionable Steps: this provides clear, actionable advice to initiate immediate improvements and foster a security-first mindset.

Managing third-party vendors who have access to sensitive information requires careful scrutiny. Ensure that vendors adhere to your security policies and have robust measures in place to protect data. Regular audits and assessments of their security practices are necessary. Establishing clear contractual obligations regarding data protection and incident response is also essential. From my experience, fostering strong partnerships and maintaining open communication with vendors can lead to better security alignment and quicker resolution of potential issues.

Let's be honest, what is confidential or sensitive information? Nothing else than a good old secret. Something we have known since childhood. Implement policies like you want but always remember Benjamin Franklin: "Three can keep a secret, it two of them are dead."

Apart from making policies and using technology for safeguarding the confidential and sensitive information, in my view we should focus more on the training of all the stakeholders and giving ownership but at the same time making an agreement of non disclosure so that everyone has a sense of feeling that all the sensitive information belongs to them and sharing any such information will lead to worst consequences. In one of my earlier assignment, I found that all employees have the access to everything but no one knows that sharing some sensitive information will lead to major losses to the business and so training & sense of ownership was lacking there

As an executive leader, protecting sensitive or confidential information is crucial for the security and integrity of your organization. Use encryption to protect data both in transit and at rest. Ensure that email communications containing sensitive information are encrypted. Regularly back up critical data and ensure that backups are protected and easily recoverable. Keep backups in secure locations separate from the originals. Implement monitoring systems to detect suspicious or unauthorized activity. Conduct regular security audits to identify and resolve potential vulnerabilities.