The relationship between confidentiality and data security in informatics

The digitisation of businesses and the adoption of digital technology has created an opportunity for companies to improve customer engagement and experience. Across industries, be it healthcare or consumer goods or any other sector, this data is extremely valuable both to run business operations and connect with new customers. Companies can use it to gain deep insights into customer behaviour and needs. With third-party cookies on the way to being phased out, first-party data becomes precious to businesses, and can be used for targeted and personalised advertising. At the same time, companies are responsible for keeping business and customer data safe and secure, and maintaining confidentiality of the information being shared by the customer.

Data security is the process of protecting data from corruption, unauthorised access, and theft, throughout the lifecycle of the data. This covers every aspect of the data including data storage, hardware used, software applications, user devices, access and authorisation, administrative controls, and organisation procedures and policies. Every region has its own data security rules, regulations, and policies, but the onus of ensuring data security lies largely on the enterprise. With customer data being a prime target for cybercriminals, companies need to ensure that they have all the controls in place to prevent data breaches. Just as security solutions abound in the market, so do the nature of threats.

Navigating data security challenges

The digital transformation of most businesses accelerated during the pandemic and has led to an explosion of data. With hybrid and cloud systems, complex computing and IoT, data resides everywhere, and this just adds to the complexity of data governance. Across the globe, there are several new regulations to protect consumers, such as the California Consumer Protection Act (CCPA), and General Data Protection Regulation (GDPR) in Europe, in addition to the older laws such as Health Insurance Portability and Accountability Act (HIPAA). Enterprises need to ensure compliance with regulations applicable to the region, as any slip ups could lead to enormous financial implications in terms of losses and fines, and also lead to a breach of customer trust.

Data security is a business imperative that no enterprise can afford to ignore. The loss of data and intellectual property can lead to decline in profitability and have a negative impact on future performance and company brand. At the same time, in the digital economy, data is one of the most valuable business assets. Enterprises require robust data strategy and security management systems in place, so that they can focus on their core business.

The CIA triad in information security

The "CIA triad" is a popular information security model that guides enterprise policies regarding security of data. “CIA” stands for Confidentiality, Integrity, and Availability, and these form the three pillars of information security in the organisation. Confidentiality is about protecting sensitive information from unauthorised access.  Data confidentiality measures prevent the unauthorised or unlawful access of data, data theft, and unintentional disclosures.  Integrity means that the data must be consistent, accurate, and trustworthy throughout the data life cycle. Data integrity measures include providing user access controls, permissions for only valid personnel to change the data, version control, backups and redundancies to restore data in case of any errors or crashes. Availability implies that data must be consistently and readily available to authorised users. Availability measures include provisioning for robust hardware and software infrastructure, failover plans, regular system upgrades, communication bandwidth, and disaster recovery plans, to name a few.

Data security involves protection of data and can be implemented using several technologies including physical and digital access controls, authentication and authorisation, data resilience, firewalls, data masking and encryption. The larger data management strategy needs to involve backup and failover plans as well. On the other hand, while certain data confidentiality measures such as managing data access using passwords or two-factor authentication involve technology, there are many other operational considerations such as how to handle sensitive data, who the information can be disclosed to, the value of the data, and the compliance rules and regulations that need to be adhered to.

The digital transformation of businesses requires that data and information security be given the highest priority. Becoming a data-driven business will let enterprises realise increased revenue, generate new business opportunities, and gain competitive advantage.

(This article is written by Rajeev Thykatt, AVP and Head – Risk, Infosys BPM)

Rajeev is a Risk Management professional with more than 23 years of industry experience encompassing standard implementation, legal and standard compliance, risk management, information/cyber security, business continuity, and supplier risk management. He currently is an AVP and heads the Risk Management function at Infosys BPM. He started his career as a practicing lawyer and gradually moved to corporate roles in risk management.

Rajeev is a Risk Management professional with more than 23 years of industry experience encompassing standard implementation, legal and standard compliance, risk management, information/cyber security, business continuity, and supplier risk management. He currently is an AVP and heads the Risk Management function at Infosys BPM. He started his career as a practicing lawyer and gradually moved to corporate roles in risk management.

(Articles under 'Fortune India Exchange' are either advertorials or advertisements. Fortune India's editorial team or journalists are not involved in writing or producing these pieces.)