Based on a recent threat intelligence analysis published by Mandiant, a cybersecurity arm of Google, 70% of exploited vulnerabilities disclosed in 2023 were zero-days. That means the threat actors exploited such vulnerabilities before the software vendors and their customers knew the existence of such security flaws and had the opportunity to patch those flaws. When a threat actor exploits the zero-day vulnerabilities that we know nothing about, what is the protection for our sensitive data?
To effectively protect our sensitive data, we have to switch to a zero-trust mindset and assume that the threat actors will someday somehow hack into our network environments, our systems, and even the cloud services that we are using on a daily basis. Based on that assumption, we can further explore what we should do in terms of people, process, and technology to mitigate risks and enhance security. That may involve, but is not limited to:
- Updating our processes, such as cataloging and classifying our sensitive data, so we know what’s important to protect and where it is.
- Implementing additional layers of defense for sensitive data, such as protecting our sensitive data with data-centric security solutions.
- Training our people on data security hygiene, such as not copying sensitive data to less secure locations, and not sharing sensitive data in the clear via emails or slack channels.
By switching to a zero-trust mindset, we do not assume anything that is always secure. That mindset allows us to better understand the underlying risks and come up with a defense in depth plan to protect one of our most valued assets – data.