Attacks on sensitive company data are growing in number and sophistication daily.

Attackers are moving beyond the older techniques of finding holes in security perimeters or stealing passwords. Now, they are moving toward complex malware – also referred to as advanced persistent threats – that can lie undetected on servers for extended periods before activating and then moving around your network looking for sensitive data.

Changes in how – and where – data are stored, accessed and used are making security needs a moving target. Increasing use of cloud services are creating additional risks. Knowing where your data is stored is now more difficult.  A well-intentioned employee who copies company data to a cloud storage service puts your data at risk. A security flaw in that cloud storage vendor's offering could affect more than just your vacation photos – now it could be your company's intellectual property that is taken. 

Meanwhile, requirements for more mobile and real-time access to data and the advent of bring-your-own-device computing creates many more access points for mischief or error.

These new realities are placing sensitive company data at increasing risk. And that risk extends to the entire company, which faces:

• Loss of business.
  
• Direct loss of money.
  
• Damage to the company's brand and reputation.
  
• Legal liability, both civil and criminal.
  
• Loss of intellectual property and market position.
  

Reducing that risk requires a solid security plan for both preventing and dealing with a potential breach. Developing that plan, in turn, requires an understanding of what needs to be protected; regulations and industry standards for data and privacy protection; how users access and share data, and current and possible security solutions.

It also requires constant attention and activity to:

• Stay abreast of industry and security news and change.
  
• Monitor security solutions 24/7.
  
• Audit user accounts.
  
• Adjust IT solutions to accommodate mobile business, increased reliance on the cloud and bring-your-own-device computing.
  
• Gain control of "shadow IT" services, like unvalidated file-sharing services.
  

Every company needs a security protection plan, but also a security breach plan – similar to a disaster recovery plan – that can be implemented immediately in the event of a breach. A designated security leader who can work collaboratively across the company while integrating in-house and third-party security solutions, as well as response plans, should lead the ongoing project.