Data Sharing and Storage Best Practices
-
Data Classification: Not all data is equal. Employees must classify data before sharing:
-
Public: Marketing brochures, press releases. (Low Risk)
-
Internal: Employee directories, policy manuals. (Medium Risk)
-
Confidential: Client lists, pricing strategies, unpublished code. (High Risk)
-
Restricted: SSNs, Patient Health Info (PHI), Credit Card numbers. (Critical Risk – Requires Encryption).
-
-
Secure File Transfer vs. Email:
-
Email: Standard email is not encrypted by default. Never send “Confidential” or “Restricted” data as a plain email attachment.
-
Secure Solution: Use approved Secure File Transfer Protocols (SFTP) or encrypted email gateways (e.g., Mimecast/Zix) that require the recipient to log in to view the message.
-
-
Cloud vs. Local Storage:
-
Local Storage: Saving files to your laptop desktop is risky. If the laptop is lost or broken, the data is gone.
-
Cloud Storage: Use corporate-sanctioned cloud storage (e.g., OneDrive for Business, Box). This ensures data is backed up, encrypted, and accessible to the team if you are unavailable.
-
Shadow IT Warning: Do not use personal Google Drive or Dropbox accounts for work files. This bypasses corporate security controls and is a common cause of data leaks.
-
-
USB & Removable Media:
-
Avoid using USB drives unless absolutely necessary and approved.
-
USB Drop Attacks: Criminals leave infected USB drives in parking lots labeled “Payroll” or “Bonuses.” Plugging one in can instantly compromise the network.
-