Here's how you can safeguard data security and privacy while utilizing new technology.

Encryption via modern and well known encryption standards using keys stored in hardware (eg HSMs). The keys should be backed up in redundant secure storage facilities in separate air gapped HSMs. Otherwise stored in strongly encrypted formats with the master key encryption keys (KEKs) in similar redundant secure configurations as above.

Data encryption ensures data confidentiality and integrity, whether data is in transit or at rest. During transmission, encryption scrambles data into an unreadable format, safeguarding it from interception. When data is at rest, encryption protects stored information from unauthorized access or tampering, adding an extra layer of security to sensitive data. So make sure encryption is done while data transmission as well as data at rest.

Encryption serves as your primary defense in safeguarding data. It obfuscates information, rendering it indecipherable to unauthorized individuals lacking the decryption key. When adopting new technology, prioritize solutions that adhere to robust encryption standards like AES (Advanced Encryption Standard) for both storing and transmitting data. Even in the event of a breach, encrypted data remains protected since without the appropriate key, the information remains an incomprehensible jumble of characters.

Encryption is a very powerful tool for protecting data but it isn't a switch you can just turn on. Proper key management is critical when adopting new technologies or your first line of defense is a false sense of security. One of the biggest mistakes made in terms of security is the implementation of IoT devices. Over the years these devices have become easy targets because they lack the power and resources to secure themselves. Even if the device was implemented with the means to encrypt/decrypt data locally it still lacks the means to properly manage private keys. Low-level MCUs that provide a means for encapsulating private keys for encryption and digital signatures must be a requirement when adopting new IoT technologies.

Encryption acts as an important mechanism to safeguard application. Primarily encrypting connection strings, encryption of account usernames and passwords ensure that the application is safe. Apart from encrypting username, passwords and traditionally using them from config/ properties files, secure vaults can used to store them. Also entropy of the encrypted strings should be checked to ensure a strong encryption mechanism has been followed.

Encouraging the principle of least privilege in access control fosters a security-conscious culture within organizations. By restricting user access to only the essential resources required for their roles or tasks, businesses can significantly reduce the risk of unauthorized access and data breaches. This approach not only enhances data security but also promotes accountability, streamlines operations, and ensures compliance with regulatory requirements.

Using repeated passwords for different sites is very risky given that if bad actors get access to passwords then they can attack multiple sites. In general it is best to vary every password to every site and use long and complex passwords that are not amenable to dictionary attacks. Using MFA including SMS and email is a better approach. Adding biometrics with automated fraud detection is even better but unfortunately adds time and money costs.

Identity and Access management is a must for ensuring data security. However one should be careful in guarding admin privileges as they cannot be compromised. MFA helps here, however one should be aware of multiple techniques like social engineering used to hack into systems by obtaining admin credentials.

Effective access control is a problem humans have been facing since dawn of time. There is no perfect access control. The more effective or complicated the control the more it works as a deterrent. MFA is one step to adding complexity to the authentication process making it more difficult to subvert but it is important to note that utilizing MFA does not remove all risk. For example, SMS is notoriously insecure and so codes sent over SMS can be stolen. Overly complex authentication can also chase away customers. Proper password management, by both user and the service, is more important. Most unauthorized accesses using valid credentials are done with reused passwords stolen from organizations. Longer passwords are better than obscure ones.

Effective access control ensures that only authorized users are able to view/read/write the data. Applications or components should follow well defined access control mechanisms to ensure the safety of the apps. One such option is to use the IAM role based access control. The applications can fetch the entitlements for the user and based on the roles assigned to the user the data/ app component or a functionality can be enabled / disabled for the users. AD groups can also be used for access control in case of enterprise apps.

Regularly updating / upgrading the application components ensure that the security vulnerabilities are addressed at the app levels. Most of the technologies provide security fixes in the patch releases, upgrading to latest stable versions incase of open source technologies help in addressing the security issues at framework levels. Also regular sonar, blackduck, trufflehog scans and other scans help in identifying security threats and vulnerability.At the server/OS level regular updates, maintenance and patching ensure that security threats are taken care of.

For a few reasons we might postpone updates such as rendering our devices unusable for the time it takes to update. Whenever possible set automatic updates even though based on my own experience it tends to fail sometimes so I would recommend to find a way to see notifications on updates to do it manually.

Regular updates are a must to overcome security breaches due to vulnerable softwares. One should build a strong process that keeps vigil on reported vulnerabilities and immediately apply if the system is using such software.

While this is a good practice to follow it can also be problematic if not handled properly. Critical security fixes are typically well tested and should have no or low impact to functionality. But any update blindly applied to your system, security related or not, can be disastrous. A good practice is to monitor regularly for updates, categorize them by criticality and potential impact to your system, test (and test and test), and then schedule them to be applied to your systems with your regular CI/CD flow.

Maintaining privacy log records is essential for demonstrating compliance with regulations like the GDPR, as they provide a historical record of privacy-related actions taken by the organization. These records can be valuable during audits, investigations, or in response to regulatory inquiries, helping organizations to prove accountability and transparency in their data processing activities.

Always prioritise privacy, that is a differentiator and more and more users are looking for it when searching for services that can replace the ‘free to use with data collection’ services that are prevalent nowadays. If data needs to be collected for the service to be usable, keep the data local. If the data processing requires resources that cannot be provided locally, encrypt transmission end-to-end and discard the data as soon as it’s no longer needed or by user request.

Adherence to policies and abiding to rule of the land is a must while security measures are employed. One such example is GDPR. Also, in certain countries the data need to be stored in the same region. So while employing cloud solutions one should be aware of where the cloud provider’s data lake is situated. Another example is audit logs. One should ensure audit logs does not include explicit user name or email. If it does, same should be erased when user unsubscribes or ends the contract.

Secure Tech Selection: Zero Trust Approach Fortify security by prioritizing Zero Trust Architecture (ZTA) when selecting new technologies. ZTA emphasizes least privilege access, continuous verification, and microsegmentation. Evaluate ZTA compatibility, vendor security posture (SOC 2, ISO 27001), and data visibility for proactive monitoring. This ensures robust security is built-in, not bolted on.

As we have learned that Test Driven Development (TDD) forces us to write testable code, I believe a Security Driven Mindset (SDM) forces us to write secure code by default. While secure coding practices are at the heart of this (and tie directly to TDD) implementing security layers first prevents developers from creating code with security holes when adding the security layers at the end. It should be noted that adding strict security components early in the development of a product can be a big hinderance to developers and so a good development environment allows the security layers to be toggled while a good production environment does not have an option for toggling.

Embed ZTA principles in tech development: least privilege, continuous verification, microsegmentation, data encryption. ZTA integration & ZTA-friendly features Strong vendor security posture (SOC 2, ISO 27001) Transparency for proactive security monitoring This approach fosters secure tech development and selection, fortifying your overall security.

Building secure software starts with secure design! By integrating security throughout the development lifecycle, we can proactively safeguard data. This means considering security from the get-go, reducing vulnerabilities, and implementing strong data protection measures.

Besides functionality and performance a good design should also consider security as requirement. Example, include parameters check to avoid sql injection in all exposed APIs, verify the format of data and check for boundary conditions

Security needs to be added in layers like an onion. The point is that every aspect of a system can have security implementations or improvements through APIs, libraries, techniques and methods. Some examples at the OS level are seccomp, SELinux, grsecurity, apparmor etc. Every system area has equivalent choices that need consideration. The development process also needs to include reviews etc to prevent errors and moles. In addition the design organization needs to have education and implementation of policies to help prevent smishing, phishing, spear phishing, vishing, tailing attacks etc. Open source software also needs consideration specially given the potential for VULs that are maliciously introduced given overloaded maintainers.

Regular monitoring and detecting unusual activities are essential for enforcing data security and privacy. While encryption and access control are vital, they aren't enough. A rogue employee with access could download or delete sensitive information. Real-time monitoring and alerts can stop suspicious activities immediately, rather than discovering breaches weeks later. Tools like intrusion detection systems (IDS) and security information and event management (SIEM) are crucial. Additionally, fostering a security culture is key. Regular training and encouraging vigilance can reduce internal threats. Vigilance and a strong security culture are crucial in today’s tech landscape.

The only safe application is the one you have the full source code and compile into a binary yourself before using. With that in mind, an initial test-bed environment totally disconnected from the internet and a network monitoring device running on every single packet trying to come out from your application is needed. The goal in here is to make sure the application in test is not trying to send information out of your system.

I think one area that isn't talked about here is data isolation. Separating pieces of sensitive data into data chunks that are not sensitive and storing them on physically separate devices can help mitigate the impact of a breach by requiring an attacker to infiltrate multiple systems, and break multiple keys, in order to steal anything truly useful.

Educating users on social engineering practises and how to better identify and guard against them. This is an area that is often overlooked when it comes to both awareness and risk involved.

Never forget that people use your software and they remain the most vulnerable target vector for hackers. Ask yourself how someone can use (or abuse) your software in ways that could create failures or vulnerabilities that are not obvious. When you think you have a good list - dig deeper and you may find more ways that someone could penetrate your defenses. Yes - modern software testing and security scanning tools can help identify many vulnerabilities but don't abdicate all your responsibilities to the tools (no one ever gets extra unemployment because it was "the tool's fault"). When you start to think like a hacker you can begin to make your software less vulnerable to bad actors.

Start designing with the mindset that "breaking security is easy". Dont think your system is protected just by following industry guidelines because that is not enough. All of that is mandatory for network systems. Another thing to keep in mind is that if the system has physical access then data protection is extremely vulnerable.

Though agree with the overall steps, however need reorientation independent of technology. Security fundamental starts with Policy (WHAT and HOW to secure). Data to be secured while i) In Rest Encryption implementation happens:- 1. Disk level encryption provides physical security. 2. The sensitive part of data must be stored in an encrypted format within the logical tables. This encryption and decryption to be handled in the applications accessing the data. ii) In Motion The communication from the database till the app servers is secured being inside a MZ (network firewall). Application - APIs must exchange data in encrypted format to all subscribers. Secured data transfer protocol (TLS) must be implemented for outside access.