All about the data

Develop a data retention policy. After you're through protecting the data, delete it. Well, get rid of it when it's no longer needed. It saves space and resources, as well as decreases liabilities. Don't keep data any longer than is necessary.

Monitoring, alerting, and reporting. Develop systems to monitor data accesses, whether authorized or otherwise. Generate alerts to send an incident response team when a high-criticality threshold event has been met. Determine ahead of time how to respond to an unauthorized intrusion. Who gets contacted and when, if things go wrong?

Ongoing maintenance. After all the hard work, make sure the plan and controls doesn't become obsolete the day after they're put into practice. Everything I've mentioned above is hard work. It would take the average organization many months to accomplish. Locating and classifying the data could take months by itself, but this is the right way to focus computer security. Focusing on computers and particular types of anti-malware is a misdirected focus. It's the data, period.

Many other experts have been preaching a data-centric approach toward computer security over the last year or so. The government has recognized this approach for the last century or so. The rest of us are late. But the reason I'm mentioning it in this column is because I believe in its approach, and I'm seeing more and more C-level decision-makers at large companies embrace it. Like the invasion of virtual-everything I saw happening a few years ago, a data-centric security approach will soon be in your organization. Understanding the basic tenets and understanding all the tasks involved will help you be a better computer security professional over the coming years.