Lessons from the Cathay Breach: Time to Talk Data Classification

“It’s not if, but when”, a phrase almost guaranteed to creep into any event with information security on the menu. Yet beyond the roundtables and fora increasingly devoted to cybersecurity and data privacy, this phrase took on a very real meaning as households in the SAR awoke on October 25th to the possibility that their personal information had been leaked along with some 9 million other Cathay Pacific accounts breached earlier this year.

Lessons from the Cathay Breach: Time to Talk Data Classification

“It’s not if, but when”, a phrase almost guaranteed to creep into any event with information security on the menu. Yet beyond the roundtables and fora increasingly devoted to cybersecurity and data privacy, this phrase took on a very real meaning as households in the SAR awoke on October 25th to the possibility that their personal information had been leaked along with some 9 million other Cathay Pacific accounts breached earlier this year.

The airline will no doubt be under fire for some time following these revelations – not least as they have erupted just one week ahead of the region’s largest aviation conference, likely prompting executives to scramble to assess their own vulnerabilities and ramp up data security in response.

However, every data breach serves as an important reminder that the conversation about information security needs to be taken seriously beyond financial services and insurance providers, which have traditionally been targeted. Airline passengers will understandably be concerned that their personal data has been captured by criminals, given the breadth of personal information an airline maintains, including passport or national ID numbers.

There are several key points that should be focused upon clearly. First, the problem is a cyber-risk problem, not a cybersecurity problem per se – and the goal is to use cybersecurity tools to strive for resilience. It is important, too, to be clear about resilience as there is in fact no such thing as complete security – although there is an acceptable level of risk.

In terms of translating the above to business leaders, whether for a supermarket chain, food-delivery app, or a bank, the focus now needs to be on determining how much a company’s cyber-risk is actually worth, in terms of impact on customers, share price, or reputation. From an information security perspective, the emphasis – across all industries – must focus on aligning security measures with risk.

With every business considering ways to benefit from digital transformation, companies need to look at ways to manage risk – starting with data classification.

Classifying data into distinct categories based on the sensitivity of the data and risk of harm if the data is breached allows a business to effectively and efficiently align appropriate security controls, such as encryption or other access control measures, according to relative risk.

The term ‘cybersecurity’ has entered popular lexicon, but the real objective is ‘cyber risk management,’ and that starts with data classification.

View the original article here

Photo by Amarnath Tade

Related Articles

Access Alert | Canada’s Public Consultation on a Modern Regulatory Framework for Space

Access Alert | Canada’s Public Consultation on a Modern Regulatory Framework for Space

The Canadian Space Agency (CSA) has launched a public consultation on various aspects of the Canadian national space regulatory framework....

1 Feb 2023 Opinion
Brazil and the Future of Democracy in the Age of Disinformation

Brazil and the Future of Democracy in the Age of Disinformation

Fake news is far from new. That said, digital tools such as social media and online bots have changed the...

25 Jan 2023 Opinion
GDPR: Is it still fit for purpose? 

GDPR: Is it still fit for purpose? 

The EU’s landmark General Data Protection Regulation (GDPR) has fundamentally changed how personal privacy is respected and protected. However, cracks...

25 Jan 2023 Opinion
Access Alert | Environmental Footprint and Data Collection by ARCEP

Access Alert | Environmental Footprint and Data Collection by ARCEP

The impact of the deployment of electronic communications networks, mass production of terminals, operation of data centres, and ever-expanding data...

23 Jan 2023 Opinion