Ruslan Rakhmetov, Security Vision
When discussing cybersecurity in today’s environment, it is easy to lose focus: the variety of attack techniques and tools, the spread of AI technologies actively used by threat actors, the discovery of dangerous new vulnerabilities, and the rise in supply chain attacks can sometimes obscure the strategic objective of information security. When we consider the most dangerous types of cyber incidents, such as information theft, ransomware attacks, or infrastructure destruction, the main consequences include lost profits, suspended business processes, and reputational damage — but, above all, compromised security of the data being processed. Ensuring the confidentiality, integrity, availability, non-repudiation, accountability, authenticity, and reliability of information remains a key responsibility of information security professionals. Data connects all the components of any business — processes, technology, and people — and represents the primary source of value for modern commercial and public-sector organizations, which rely heavily on intangible assets as a result of extensive digitalization. In this article, we discuss information protection in the context of a data-centric approach, examine various information protection measures, and explain practical steps for ensuring data security.
Let us begin with definitions: as we have previously written, information security (IS) is a state in which information is protected and its confidentiality, integrity, and availability are preserved — the so-called information security triad, or CIA triad (Confidentiality, Integrity, Availability). In addition, the non-repudiation, accountability, authenticity, and reliability of information must be maintained. Information protection is the activity of ensuring information security in order to preserve confidentiality, integrity, and availability, as well as non-repudiation, accountability, authenticity, and reliability. This activity involves protecting information in its various forms, including digital (electronic) data, printed materials (printouts and books), audio (discussions and reports), and visual information (presentations and demonstrations). A distinction should be made between cybersecurity and information security. Cybersecurity involves protecting digital data in cyberspace using software security tools, whereas information security (information protection) also encompasses the security of physical media, paper documents, rooms, and buildings. In addition to software solutions, this requires security hardware, technical security systems, and protective engineering solutions. Thus, information protection is a broader concept that includes protecting data in any form, regardless of how it is represented, and securing tangible and intangible assets using all available protective measures and tools — software, cryptographic, technical, physical, legal, and organizational.
Initially, information protection was based on establishing virtual and physical security perimeters: to access a protected information system, users had to pass through corporate network security controls and enter the internal network; to access a confidential document, they had to enter a designated room, present an access pass, and sign for temporary custody of the document. Over time, the perimeter concept lost its relevance: data began to be processed in cloud storage and services accessible from any device, while documents are created in collaboration services and shared through messaging apps. Some companies have no physical office at all: employees work on personal devices, all corporate data is stored in the cloud, and even the most confidential discussions take place via videoconferencing. In these circumstances, approaches to information protection are also evolving and can be broadly divided into several types:
-
Asset-centric — the traditional approach, which involves protecting information systems, business processes, applications, and services.
-
Incident-centric — an approach whose objective is to prevent critical cyber incidents.
-
Identity-centric — in this model, protection focuses on securing user accounts (human identities) and machine accounts used by applications, systems, devices, and AI agents (non-human identities, or NHIs).
-
People-centric / human-centric — this approach, promoted by NIST, is built around the needs, motivations, behavior, capabilities, and limitations of people: employees and system users.
-
Data-centric — an approach that focuses primarily on protecting data during processing.
The data-centric approach brings together the best aspects of other methods: it is geared toward effective information protection and makes it possible to secure data regardless of its form, storage location, or processing method. Data processing includes collection, recording, organization, accumulation, storage, updating, modification, retrieval, use, transfer (including dissemination, provision, and access), and deletion. The objective of a data-centric approach to information protection is to minimize the risks of unauthorized data processing through software, cryptographic, technical, physical, legal, and organizational measures and security tools. Unauthorized processing means actions involving data that violate established information security rules and policies, including data leakage, deletion, and deliberate distortion. Such actions may be carried out by external or internal threat actors using user accounts and machine accounts.
The following types of protective measures and tools can be used to protect information and implement a data-centric approach:
1) Software protection measures: using various types of information security tools, including EDR, SIEM, UEBA, DLP, IAM, DCAP, SOAR, VM, NGFW, and other classes of solutions, as well as various cybersecurity products and services (i.e., those protecting digital data). This category also includes software that implements the selected data access control model: Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role-Based Access Control (RBAC), or Attribute-Based Access Control (ABAC).
2) Cryptographic protection measures: using encryption tools to protect data at rest, in transit, and in use. Data encryption substantially reduces the risk of unauthorized access: individual files, emails, encrypted datasets, and storage media remain confidential provided that encryption/decryption keys are securely protected. In addition to ensuring confidentiality, cryptographic solutions are used to ensure the authenticity, non-repudiation, and integrity of information through electronic signatures and hash-based message authentication codes (HMACs).
3) Technical protection tools: using various hardware and engineering solutions, including integrated hardware/software security solutions (hardware security modules, hardware firewalls, data diodes, and appliances for secure videoconferencing), biometric systems (fingerprint or retinal scanners), and tools that protect information against interception of optical, acoustic, and electromagnetic signals, including compromising electromagnetic emanations and induced signals.
4) Physical protection tools: systems that control access to tangible assets and physical media containing protected information (documents, archives, disks, drives, and rooms containing paper materials, including presentation printouts and notes on whiteboards and flip charts in meeting rooms). Examples include video surveillance systems with automatic recording, long-term archive storage, and recognition of faces, movements, and dangerous actions, as well as physical access control systems with clearly differentiated access levels for rooms and zones. Fire suppression, air conditioning, and ventilation systems are also used, alongside traditional physical safeguards: secure doors, vandal-resistant windows, lockable cabinets and fire-resistant safes, vehicle barriers and turnstiles, motion sensors, and lighting. It is important to ensure that security personnel (guards and duty officers) perform their duties properly and to control the movement of media containing protected information. This applies not only to transporting documents or servers — for example, between sites or data centers — but also to data backups, including LTO tapes, which must be encrypted, numbered, and recorded in an inventory. In every case, the handling of media and their transfer to long-term storage locations must follow chain-of-custody rules: a designated individual must be responsible for each storage medium at all times, with a continuous documentary record of its transfer, receipt, and storage. Secure destruction of information media must not be overlooked either, using shredders, degaussing systems, and assured deletion of decryption keys.
5) Legal protection measures: the handling of restricted-access information is governed by various laws and regulations; in other words, the state establishes mandatory standards and rules for its processing. In particular, there are legal requirements for protecting personal data (Federal Law No. 152-FZ), trade secrets (Federal Law No. 98-FZ), financial information, and payment card data (in accordance with GOST R 57580.1-2017 and PCI DSS, and Bank of Russia Regulations No. 802-P and No. 821-P).
6) Organizational measures: an organization must develop a set of internal documents governing the protection of confidential corporate information. These may include an information security strategy and policy designed to formalize general approaches to cybersecurity, as well as more detailed documents — standards, regulations, procedures, and instructions—that set out the company’s specific organizational and technical information security requirements.
The following outline can serve as a guide when implementing practical steps to ensure data security:
- Identifying applicable legal requirements and restrictions:
Determine whether the company processes personal data (including data on employees, customers, users, etc.), which categories it falls into (publicly available, biometric, special categories, or other data), whether the organization is an entity operating critical information infrastructure (CII), whether a trade secret protection regime has been established, and whether it processes legally protected financial information or other information protected by law. As we know, Russian legislation currently recognizes more than 150 types of restricted-access information, including medical confidentiality, notarial confidentiality, attorney–client confidentiality, audit confidentiality, insurance confidentiality, and the secrecy of communications, among others.
- Developing a data classification methodology:
If an organization establishes a trade secret protection regime under Federal Law No. 98-FZ, it must compile a list of information constituting trade secrets. This enables the company to maintain the confidentiality of internal information and protect its interests through legal remedies under the relevant provisions of the Russian Labor Code (Articles 21, 22, and 56), Civil Code (Articles 1465–1472), and Criminal Code (Article 183). To protect internal corporate information, it is advisable to define confidentiality levels according to the importance of the data — for example, CL-0 for public information, CL-1 for information of the lowest importance, CL-2 for information of moderate importance, and CL-3 for critical information. Data labeling rules must be established: for example, all documents should include a confidentiality label in their headers or footers (CL-0/1/2/3 in our example); certain file types should include this label in their properties (metadata); and printing on corporate printers should require confidentiality labels on all types of printouts.
- Establishing an internal policy framework for information protection:
After developing a trade secret policy and/or defining confidentiality levels for internal information, it is important to create a comprehensive set of corporate information protection documents and obtain signed acknowledgment from company personnel that they have read them. Some requirements may be included in employment contracts or signed as addenda; others may be documented in instructions and policies whose mandatory nature must be communicated to employees.
- Taking a data inventory and classifying data:
Information repositories should be scanned continuously to discover new confidential information, documents, and files. The inventory scope should include file servers, internal repositories, databases, email and messaging systems, collaboration systems, CRM, ERP, business applications, and user endpoints. Confidential information can be identified within the overall data estate using various solutions (DLP, DCAP, DAG, DSP, etc.) that implement content and contextual analysis, keyword and data-type detection, and AI and machine learning mechanisms. As a result, existing data should be classified, and newly created documents should be labeled automatically according to the confidentiality level of their contents.
- Creating data flow diagrams, updating the threat model, and developing a data access control model:
Data flow diagrams (DFDs) should be created to show how specific data types relate to particular information systems, the sources of data and the sequence in which it is processed, the relationships between systems, and data transmission channels. The threat model should describe the types and capabilities of threat actors, how cyber threats may be carried out, and their potential consequences in relation to the protected information and its confidentiality levels. This provides a basis for selecting a data access control model or adjusting an existing one. In today’s environment, Attribute-Based Access Control (ABAC) is generally the most capable and suitable model.
- Implementing the selected data access control model:
When assigning access rights, follow fundamental information security principles, including least privilege, separation of duties, and granting privileged access only for specific work-related actions and only for a defined period (Just-In-Time Access, or JIT, and Just-Enough Access, or JEA). Access to data should be granted only when there is a justified need to use the data (need to use), to view the information (need to know), and to connect to the information system (need to connect), and when the immediate manager has approved the actions concerned. Access to data must require the data owner’s approval, while access to the most critical information should require approval from several senior managers. It is also important to revoke granted access rights promptly — for example, when project work is completed, an employee transfers to another department, leaves the company, or goes on maternity leave. Where AI agents are used, their authority must be limited to the access rights of the user who launched them, and the privileges of machine accounts must also be governed by defined rules.
- Implementing Zero Trust principles:
The Zero Trust approach includes identity controls (granular access rights, multifactor authentication, and risk-based access), device management (checking device security and ensuring the absence of vulnerabilities and malware), and network microsegmentation (including application control and enforcement of network access rules when specified conditions are met — conditional access).
- Raising employee awareness and providing training:
It is important that company employees understand the principles of information protection and recognize the importance of their own contribution to corporate information security. Building a mature cybersecurity culture begins with following cyber hygiene rules, providing regular education and training, and testing employees’ ability to recognize signs of unauthorized data access, data leaks, or attempted cyberattacks.
- Monitoring and response:
It is important to monitor data routes, changes, and transfers between systems and users. Every document, file, and dataset should have a tag that, like a GPS tracker, makes it possible to determine its location, identify its current lifecycle status (storage, modification, or transfer), and assess whether the operations being performed on it are appropriate in context. Violations must be handled in accordance with response playbooks. To reduce the damage caused by unauthorized access to protected information, automation tools should be used, such as the following Security Vision products:
Security Vision SOAR and NG SOAR
Security Vision SIEM
Security Vision TIP
Security Vision UEBA
Security Vision EDR
