It's all about the data. Everything we strive to do in computer security is to protect the data. It's the data that has value. So it only makes sense that our computer security defense plan is data-centric.

Locate your data. Start by locating your data. It's much harder than it looks. Begin the process by searching for data on your database and file servers. Think of every location where your data can be deposited. Then think of all the ways it can be accessed, downloaded, copied, viewed, and printed. Data can be copied to removable media, including floppies (anyone have those anymore?), CD-ROMs, DVDs, USB drives, and tape. Has data been copied to local hard drives or downloaded to virtual images, laptops, and home computers? The last two locations have ended up in the media way too much lately.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

Is information leaving your company via e-mail and other networking methods? If you're not sure, consider using one of the many data leak protection tools available to sniff your traffic looking for confidential data. Every client I've talked to that has used one of these tools said they have been surprised by the amount of unauthorized confidential data leaving their networks. Last year, a CSO friend of mine said it best: "If you think you know where all your data is, you either don't understand the scope of the problem or you're clueless."

Classify data and access. Once you find the data, classify it according to sensitivity, much like the government does with Unclassified, Classified, Secret, and Top Secret classifications. I prefer general labels, such as simple numbers, 1 to 5, with 5 being the highest sensitivity. Define the various sensitivity labels so that everyone classifying data can follow some basic rules when marking the data. When you've finished classifying your data, what mechanisms do you have in place to ensure all future created data is appropriately classified? Now that the data is classified, move to issues of how users get to the information. How is the data accessed? Who is accessing the information and for what purpose? 

Threat model. Model all the possible threats to the data, from internal, unauthorized accesses to external intruders. Threats can be from human beings or malicious mobile code. Don't forget to include natural disasters and other disaster recovery events.

Identify the current state of your data. Document the current state of security controls surrounding the data. Include authentication schemes, access controls, permissions, intrusion prevention, and auditing in your documentation.

Protect the data. All the previous steps should lead to some natural conclusions about protecting the data. The more valuable and sensitive the data, the stronger and more redundant the controls should be. Access controls should be least privileged and role-based. Data protection also includes data backups, protection of those backups (such as encryption, secure storage, and so on), and enough test restorations to ensure confidence in the process. Backups should become a part of business continuity/disaster recovery plans.

Develop a data retention policy. After you're through protecting the data, delete it. Well, get rid of it when it's no longer needed. It saves space and resources, as well as decreases liabilities. Don't keep data any longer than is necessary.

Monitoring, alerting, and reporting. Develop systems to monitor data accesses, whether authorized or otherwise. Generate alerts to send an incident response team when a high-criticality threshold event has been met. Determine ahead of time how to respond to an unauthorized intrusion. Who gets contacted and when, if things go wrong?

Ongoing maintenance. After all the hard work, make sure the plan and controls doesn't become obsolete the day after they're put into practice. Everything I've mentioned above is hard work. It would take the average organization many months to accomplish. Locating and classifying the data could take months by itself, but this is the right way to focus computer security. Focusing on computers and particular types of anti-malware is a misdirected focus. It's the data, period.

Many other experts have been preaching a data-centric approach toward computer security over the last year or so. The government has recognized this approach for the last century or so. The rest of us are late. But the reason I'm mentioning it in this column is because I believe in its approach, and I'm seeing more and more C-level decision-makers at large companies embrace it. Like the invasion of virtual-everything I saw happening a few years ago, a data-centric security approach will soon be in your organization. Understanding the basic tenets and understanding all the tasks involved will help you be a better computer security professional over the coming years.