If you were given a paintball gun and asked whether you'd rather tag someone standing still or someone running around the room, you'd probably choose the stationary target. This hints at the danger of large pools of stationary data (data at rest).
In personal knowledge management (PKM), there's a concept called the collector's fallacy: the idea that collecting and storing huge amounts of information is somehow useful, in the hope that it might come in handy at some point in the indefinite future.
But it never works. Instead, your whole knowledge system gradually becomes less useful. Effective PKM means being selective about the types of information you'll actually use.
No one can steal what you don't have
“The best way to avoid getting hit is not to be in the room when the hit is made.”
This lesson also applies to data and security.
Instead of focusing all your attention on tighter configuration and product-level security, how about looking at the data that passes through your system (data in motion) and the data that is retained (data at rest)? No hacker can steal data you never collected. The best way to protect your users' data is not to collect it at all.
Now, obviously, you need to collect some data to serve your customers and provide personalized service. You do need to collect something, but you don't need to collect everything—in the hope that it might somehow come in handy at some point in the indefinite future (the collector's fallacy).
The most effective action a company can take is to step back and examine the types of data that pass through its system and are retained. Is all of it still necessary? Was it ever necessary?
And what about the data that are necessary?
Well, from a technological perspective, you layer all the best practices for encryption and redundancy, access controls, and audit logs on top of the security layers provided by your cloud provider. But, again, the most important step isn't about technology.
In today's market, communication is key. Companies that clearly state what types of data they collect and for what purpose earn their customers' trust.
Apple gives companies the option to state why they need to collect your data in a small pop-up window when you install an app, but many companies simply leave the default text. What a shame. If they could just write a few sentences explaining how they will use your information to provide better services, most users would readily agree.
And, since no company is immune to problems, if one does arise, inform users promptly and explain what happened, how it affected them, and what you're doing to make sure it doesn't happen again.
That kind of goodwill goes a long way toward building trust and laying the foundation for a lasting relationship between you and your customers.
A recent Axway survey found that 86% of people are at least somewhat concerned about who has access to their data in the cloud. Nevertheless, many companies resort to 20th-century secrecy, mistakenly believing that admitting they are not perfect and have run into a problem diminishes their brand in their customers’ eyes.
Of course, the opposite is also true. Fast and open communication increases customer trust.
What to Do to Ensure Data Privacy and Security
It may come as a surprise that the two most important actions you can take when it comes to data privacy and security are not technological:
- Review the types of data you collect and aim to store the minimum amount necessary. You won't have extra data if there's a breach.
- Communicate with users as early and as often as possible. Let them know you value their information and respect them as people. Tell them how you'll use that information in ways that benefit them. And report incidents or problems quickly when they occur.
- No company is perfect, and any company that claims it has never had a problem is lying.
Instead of trying to be perfect or impenetrable, how about being smarter and more open? Those are achievable goals.
