The summary.
START BY KNOWING WHAT YOU HOLD
You cannot protect data you have not identified. Most businesses have never done this exercise.
You will find data collected for a purpose that ended, and copies in places nobody remembered.
THE STRONGEST SINGLE STEP
Delete what you no longer need.
Data you do not hold cannot be stolen, lost, or become an obligation.
ENCRYPT DEVICES AND BACKUPS
If a device is lost, encryption is what makes it an inconvenience rather than a breach.
Store the recovery key somewhere separate. Without it, nobody can recover the data, including you.
THE BACKUP RULE THAT DEFEATS RANSOMWARE
At least one copy the compromised machine cannot reach.
A backup connected to the affected system is encrypted along with everything else.
TREAT EMAIL AS NOT PRIVATE
Do not email anything you would be alarmed to see disclosed. Use controlled sharing instead.
Sending a password in the same message as the file achieves nothing.
BEFORE SHARING A DOCUMENT
Check hidden rows, tracked changes, comments and metadata. Documents contain more than what is visible.
ON CLOUD SERVICES
The provider secures their infrastructure. Your account, your access and your own copy remain yours.
