{"id":4316,"date":"2021-06-18T18:05:44","date_gmt":"2021-06-18T15:05:44","guid":{"rendered":"https:\/\/www.endpointprotector.com\/blog\/?p=4316"},"modified":"2021-06-23T12:59:18","modified_gmt":"2021-06-23T09:59:18","slug":"how-to-protect-your-data-at-rest","status":"publish","type":"post","link":"https:\/\/www.endpointprotector.com\/blog\/how-to-protect-your-data-at-rest\/","title":{"rendered":"How to Protect Your Data at Rest"},"content":{"rendered":"<p>In recent years, the protection of\u00a0sensitive information\u00a0has become mandatory for most companies, regardless\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/data-protection-legislation-around-the-world\/\" target=\"_blank\" rel=\"noopener\">of where they are located<\/a>\u00a0in the world. A new wave of\u00a0data protection\u00a0legislation, spearheaded by the EU\u2019s\u00a0<a href=\"https:\/\/www.endpointprotector.com\/epp\/gdpr-the-most-in-depth-guide-to-stay-compliant\" target=\"_blank\" rel=\"noopener\">General\u00a0Data Protection\u00a0Regulation<\/a>\u00a0(GDPR), has made companies liable for the protection of\u00a0sensitive data\u00a0such as\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/the-importance-of-pii-scanning\/\" target=\"_blank\" rel=\"noopener\">personally identifiable information<\/a>\u00a0(PII) in front of the law.<\/p>\n<p>At the same time, specialized laws have appeared such as\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/all-you-need-to-know-about-hipaa-compliance\/\" target=\"_blank\" rel=\"noopener\">HIPAA<\/a>\u00a0that governs\u00a0healthcare\u00a0information in the US, and standards such as\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/all-you-need-to-know-about-pci-dss-compliance\/\" target=\"_blank\" rel=\"noopener\">PCI DSS<\/a>\u00a0that protect\u00a0credit card numbers\u00a0globally. Failure to comply with these laws and standards can lead to regulatory fines and <a href=\"https:\/\/www.endpointprotector.com\/blog\/the-cost-of-a-data-breach-in-2020\/\" target=\"_blank\" rel=\"noopener\">lost business<\/a>. Companies can also be barred from participating in lucrative bids due to noncompliance.<\/p>\n<p>As a consequence,\u00a0data protection\u00a0has become a top priority for many companies. When developing their\u00a0cybersecurity\u00a0strategies, organizations don\u2019t just have to define what\u00a0sensitive data\u00a0means to them in the context of their sector and national legal framework, but must also consider the three different states data can find itself in:<\/p>\n<ul>\n<li>Data at rest: static data stored on\u00a0hard drives\u00a0that is archived or not often accessed or modified.<\/li>\n<li>Data in use: data that is frequently updated by multiple users within a network and is very much active.<\/li>\n<li><a href=\"https:\/\/www.endpointprotector.com\/blog\/how-to-protect-data-in-motion\/\" target=\"_blank\" rel=\"noopener\">Data in transit<\/a>: data that is being transferred outside the network and subject to third-party services whose security cannot be guaranteed.<\/li>\n<\/ul>\n<h2>Why\u00a0Data at Rest\u00a0Needs to be Protected<\/h2>\n<p>Data in transit\u00a0or\u00a0data in motion\u00a0is considered the most vulnerable type of data as it\u2019s transferred over the internet, outside the security of corporate networks through potentially insecure channels such as\u00a0cloud storage\u00a0or third-party\u00a0service providers\u00a0to destinations with laxer information security policies in place. Data in motion can also become the victim of Man-in-the-Middle (MITM) cyberattacks that target data as it travels.<\/p>\n<p>However, while\u00a0data at rest\u00a0is protected by a company\u2019s\u00a0cybersecurity\u00a0strategy and is usually stored locally within the company network, it is still at risk from both malicious outsiders and\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/what-are-insider-threats-and-how-can-you-tackle-them\/\" target=\"_blank\" rel=\"noopener\">insider threats<\/a>.\u00a0Data at rest\u00a0is often a more attractive prize for cybercriminals because the volume of information that can be stolen is higher than in data packets in transit. Many of the most spectacular\u00a0data breaches\u00a0in the last ten years have involved the theft of\u00a0data at rest. Malicious insiders also\u00a0target\u00a0data at rest\u00a0when stealing data for the same reason outsiders do: it represents a bigger payday.<\/p>\n<p>Data at rest\u00a0is also particularly vulnerable to employee carelessness. If someone gains\u00a0unauthorized access\u00a0to a work computer or if a company device is stolen or lost, the\u00a0data at rest\u00a0on it can be easily accessed and stolen by booting a device using a USB\u00a0flash drive\u00a0and bypassing login credentials. This became a particularly relevant issue during the COVID-19 pandemic when most companies were forced to allow their employees to\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/endpoints-the-new-data-security-frontier-in-the-age-of-wfh\/\" target=\"_blank\" rel=\"noopener\">work remotely<\/a> and take their company-issued devices home with them.<\/p>\n<h2>Securing\u00a0Data at Rest<\/h2>\n<p>Conventional antivirus software and\u00a0firewalls\u00a0are the most common\u00a0security measures\u00a0used to protect\u00a0data at rest. However, these do not guarantee safety from phishing or social engineering attacks that target individuals, tricking them into revealing credentials and\u00a0sensitive information\u00a0that can compromise a company\u2019s\u00a0data security. They also do not protect sensitive data from insider threats. Access control\u00a0can be an effective measure to reduce\u00a0data at rest\u00a0vulnerability, allowing only employees that require access to\u00a0sensitive data to perform their duties\u00a0to store it locally.<\/p>\n<p>One of the best and easiest ways companies can start protecting their\u00a0data at rest\u00a0from employee carelessness is by implementing\u00a0<a href=\"https:\/\/www.endpointprotector.com\/blog\/protecting-your-business-data-with-encryption\/\" target=\"_blank\" rel=\"noopener\">encryption solutions<\/a>. Operating systems\u2019 native data encryption tools such as Windows\u2019 BitLocker and macOS\u2019 FileVault allow organizations to\u00a0encrypt\u00a0employee\u00a0hard drives, ensuring that, should someone steal or find a company device, they would be unable to access it without an\u00a0encryption key, even when booting a computer using a USB.<\/p>\n<h2>Using\u00a0Data Loss\u00a0Prevention Tools to Protect\u00a0Data at Rest<\/h2>\n<p>Companies can go one step further: to secure data at rest, they can use Data Loss Prevention (DLP) solutions that can block or limit the connection of USBs, mobile devices, or removable storage drives all together. In this way, malicious USBs cannot be connected to a device to infect it, nor can they be used to boot a computer. They also prevent <a href=\"https:\/\/www.endpointprotector.com\/blog\/what-is-insider-data-exfiltration\/\" target=\"_blank\" rel=\"noopener\">data exfiltration<\/a> via\u00a0storage devices. Some solutions like\u00a0<a href=\"https:\/\/www.endpointprotector.com\/\" target=\"_blank\" rel=\"noopener\">Endpoint\u00a0Protector<\/a>\u00a0even offer <a href=\"https:\/\/www.endpointprotector.com\/blog\/5-best-enforced-encryption-features\/\" target=\"_blank\" rel=\"noopener\">enforced encryption<\/a> features that allow employees to use company-approved USB devices but ensure that all files copied on them are encrypted.<\/p>\n<p>Using content inspection and contextual scanning, DLP tools can also <a href=\"https:\/\/www.endpointprotector.com\/blog\/5-outstanding-ediscovery-features\/\" target=\"_blank\" rel=\"noopener\">search for\u00a0sensitive data\u00a0<\/a>based on predefined or custom content, file name, or particular compliance profiles in hundreds of file types stored locally on employees\u2019 computers. Based on the results, remediation actions can be taken. The\u00a0sensitive data\u00a0found can be encrypted or deleted to ensure that it is not stolen or misused. DLP solutions offer a way of controlling\u00a0sensitive information\u00a0on employees\u2019 computers remotely, removing it when access to it is no longer desirable, and acting as an additional layer of security in data management.<\/p>\n<p>It is clear that protecting only one type of data, whether in motion or in use or both and ignoring data at rest can lead to disastrous consequences. It is therefore essential that companies look for all-inclusive solutions that deal with all sensitive data, no matter what state it finds itself in.<\/p>\n<p>Looking to protect\u00a0data at rest? Check out our\u00a0<a href=\"https:\/\/www.endpointprotector.com\/solutions\/ediscovery\/data-at-rest-encryption\" target=\"_blank\" rel=\"noopener\">Data at Rest\u00a0Encryption\u00a0solution<\/a>.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In recent years, the protection of\u00a0sensitive information\u00a0has become mandatory for most companies, regardless\u00a0of where they are located\u00a0in the world. A new wave of\u00a0data protection\u00a0legislation, spearheaded by the EU\u2019s\u00a0General\u00a0Data Protection\u00a0Regulation\u00a0(GDPR), has made companies liable for the protection of\u00a0sensitive data\u00a0such as\u00a0personally identifiable information\u00a0(PII) in front of the law. At the same time, specialized laws have appeared such &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.endpointprotector.com\/blog\/how-to-protect-your-data-at-rest\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;How to Protect Your Data at Rest&#8221;<\/span><\/a><\/p>\n","protected":false},"author":9,"featured_media":4343,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4316","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-loss-prevention","entry"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/4316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/comments?post=4316"}],"version-history":[{"count":6,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/4316\/revisions"}],"predecessor-version":[{"id":4345,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/4316\/revisions\/4345"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media\/4343"}],"wp:attachment":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media?parent=4316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/categories?post=4316"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/tags?post=4316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}