Managing Private Content Exposure Risk in 2024
Managing your data privacy and compliance risks becomes increasingly more difficult by the year. Cybercriminals continue to evolve their strategies and approaches, making it more difficult to identify, stop, and mitigate the damages of malicious attacks. Recognising they can breach hundreds, or even thousands, of companies and millions of records with one successful attack, many rogue nation-states and cybercriminals have turned to the supply chain, a trend we believe will increase in 2024. Third-party vendors, including technology providers, represented 15% of all successful data breaches last year. And as generative artificial intelligence (GenAI) large language models (LLMs) take the digital landscape by storm, tracking and controlling our sensitive content became even harder.
In response, regulatory bodies are evolving their existing data privacy regulations and adding new ones. They also ratcheted up fines and penalties targeting regulatory violations. This “reactionary movement” will not slow down but continue to pick up pace in the coming year. All of this means organisations must track and control content access and generate more audit log reports to demonstrate compliance with relevant compliance requirements.
Big isn’t always better
The number of employees and third parties using generative artificial intelligence (GenAI) large language models (LLMs) will increase in 2024 as the competitive advantages become too significant to ignore. This will expand the threat surface and the potential for sensitive content to be inadvertently or intentionally exposed.
Even with advances in security controls, high-profile data breaches stemming from GenAI LLM misuse are likely. This will force data security to be a central part of GenAI LLM strategies. Organisations slow to adapt will face brand reputation damage, lost revenue opportunities, potential regulatory fines and penalties, and ongoing litigation costs.
A need for MFT to grow up
Managed file transfer (MFT) tools are used for the digital transfer of data in an automated, reliable, and secure manner using governance tracking and controls for regulatory compliance. However, many are based on decades-old technology. Due to this we have witnessed a spiralling escalation of cyberattacks on them by rogue nation-states and cybercriminals.
Two major MFT tools experienced zero-day exploits in 2023. In both instances, multiple zero-day vulnerabilities were targeted. If the two MFT attacks in 2023 are any indication, cybercriminals will continue to exploit zero-day vulnerabilities in legacy MFT solutions in 2024.
Email continues to be targeted
In the past year, malware attacks instigated through email shot up 29%, phishing attacks grew 29% and business email compromise (BEC) increased by 66%. Because of this, more than eight in ten data breaches now target humans as their first line of access using social engineering strategies.
Unfortunately, legacy email systems lack the requisite security capabilities. Until organisations embrace an email protection gateway where email is sent, received, and stored using zero-trust policy management with single-tenant hosting, email security will remain a serious risk factor.
Shifting standards
Regulatory bodies will continue evolving data privacy regulations in 2024. They will also likely ratchet up fines too. Recent major fines, like those against Marriott and British Airways, were in large part due to lapses in data security. This precedent indicates regulators will come down hard any organisation that negligently expose personal data. This means businesses will, more than ever, need to track and control content access and generate audit log reports to demonstrate compliance.
Gartner predicts that personal data for three-quarters of the world’s population will be covered by data privacy regulations by the end of 2024, and the average annual budget for privacy in a company will exceed $2.5 million.
The need for more stringent data sovereignty
Data sovereignty will be an increasing challenge for organisations in 2024. New privacy laws often require organisations to control the country where data resides. This can be a significant challenge for multinational businesses. Yet at the same time, data democratisation – the practice of making data accessible and consumable for everyone in an enterprise regardless of technical skill – is a trend that will impact data sovereignty.
The good news is that data sovereignty inherently empowers organisations to maintain compliance with local and international data regulations. This minimises legal risks, establishes a reputation for responsible data handling, and helps companies avoid hefty fines. By prioritising data sovereignty, organisations will be able to build trust with customers and stakeholders alike.
Move towards DRM to protect sensitive content
As files grow every larger, having robust solutions for secure handling and storage of them become ever more important.
Digital rights management (DRM) adoption will clearly accelerate in 2024 as organisations aim to protect sensitive content and comply with expanding regulations. Data classification and DRM policy management will drive organisations to institute data protection using least-privilege access and watermarks for low-risk data, view-only DRM for moderate-risk data, to safe video-streamed editing that blocks downloads and copy and paste for high-risk data. Highly regulated industry sectors such as healthcare and finance will be the biggest adopters.
Businesses need to hit the reset button
In 2024, businesses will be under heightened strain to protect confidential data amidst escalating cyber threats and to ensure adherence to burgeoning international regulatory standards. It is time for organisations to look at alternatives.
The landscape of sensitive content communication has changed and will continue to do so over the next 12 months. Yet, by adopting zero-trust architectures, detailed security models based on content, strong access management, integrated DRM, DLP, and other leading-edge security measures, organisations large and small can mitigate risks and uphold compliance. It is time for organisations should hit reset on their sensitive content communication strategies and work to ensure they have the right technologies in place to protect all their file and email data communications.
