3. Data security

Data security and data protection overlap a great deal. They both seek to secure the processing of data.

Data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. is more concerned with addressing threats, while data protectionIn the context of regulation, data protection is the process of safeguarding any data relating to an identified or identifiable natural person. is more about responsibly managing and using that data.

In digital marketing, both are equally important. While much of the discussion about user data revolves around regulatory compliance, anyone working with data in a data controllerA data controller determines the purposes and means of processing personal data. They decide the "how" and "why" of a data processing operation. organization needs to understand the concepts of threat prevention, data safeguarding, access control, and incident response.

Additionally, much of the discussion around data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. and protection has been muddled with confusing terminology.

In this Topic, you will learn the difference between encoding, encrypting, hashing, and other key terminology.

In the realm of technical marketing, data is not just a resource; it’s a responsibility.

Safeguarding this data is fundamental to maintaining trust, complying with legal standards, and ensuring the integrity of the data used, for example, with marketing campaigns.

Data security and digital marketing

Even though you might not be a security engineer, you do need to understand how deeply interconnected digital marketing and data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. are. Your world revolves around data, and data is one of the most precious utilities that companies need to secure.

Data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. is fundamental in trust and brand reputation. Consumers are smart. They are increasingly aware of data privacy and security as well as their rights to access their own data. Brands that demonstrate a commitment to protect and secure customer data have a competitive advantage.

Conversely, data breachesA security incident that results in unauthorized access to confidential information. and data leaks can significantly harm a brand’s reputation. Once you send that dreaded disclosure email to your customers, you will always be known as the company that compromised its customers’ data. Effective data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. practices in digital marketing help proactively address potential threats.

Overlap with data protectionIn the context of regulation, data protection is the process of safeguarding any data relating to an identified or identifiable natural person. measures emerges especially when your marketing efforts require forwarding user data to third parties.

Digital marketing as an industry is particularly sensitive to emerging technologies. Whether it’s the Internet of Things, Virtual Reality, Machine Learning, or Artificial Intelligence, digital marketers are quick to find new ways to incorporate these technologies into their marketing processes.

Any time a new technology is utilized, the risk of data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. incidents increases. New technology means new threat vectors, and these need to be proactively assessed before the technology can be put into use.

This type of assessment is critical in any organization that wants to take its data protectionIn the context of regulation, data protection is the process of safeguarding any data relating to an identified or identifiable natural person. and data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. practices seriously. In addition to periodic audits, the data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. practices need to be constantly reviewed to ensure that even small changes in the business environment do not elevate the risk of compromised data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access..

Ultimately, any organization’s data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. is only as strong as its weakest link. All members of a digital organization need to be trained in data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. practices, in proactively identifying and recognizing potential threats (especially those relevant to their jobs), and in correctly escalating incidents to those responsible for data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. practices within the organization.

Data security threats

There are thousands of different threat vectors out there, all of them hungrily looking for weaknesses in systems that they could exploit.

You don’t need to know about all of them, and you don’t need to prepare for all of them. However, you do need to know the most common attack types so that you can participate in discussions within your organization when assessing the level of risk that your precious consumer data can face.

Here is a list of important security-related terms that every technical marketer should be familiar with:

Cyberattacks and hacking

A common, generic attack type is just hacking. It involves the hacker gaining unauthorized access to your computer systems, often with the intent of stealing data, disrupting services, or causing damage.

Phishing

Phishing is a type of social engineering, where the attacker contacts the victim, often by email, and tries to trick them into revealing sensitive information like passwords or credit cards. Phishing emails often look like they originate from legitimate sources, and they can even use fake websites that look like the real thing.

Malware

The term is a portmanteau of “malicious” and “software”. Malware includes viruses, worms, trojans, and ransomware. It’s designed to facilitate hacking, or to otherwise disrupt or gain unauthorized access to computer systems or data.

Ransomware

A type of malware where the victim’s files are encryptedWhen information is encrypted, it is obfuscated in such a way that no one without the encryption key should be able to determine what the data actually comprises., with the attacker then demanding a ransom payment from the victim to restore access to the files.

Insider threats

Sometimes the organization employs people who are dissatisfied or who want to cause harm to the organization for other reasons. Or sometimes the organization hires contractors without properly vetting them first. These insiders might have access to sensitive systems, which they can misuse to steal or disrupt information within.

Data leaks

Data leaks involve unauthorized transmission of data from within an organization to an external destination or recipient. Data leaks can be intentional or accidental. They often occur due to insecure file transfer processes or accidentally sending attachments to the wrong email addresses.

Advanced persistent threats

APTs are prolonged and targeted cyberattacks where the intruder gains access to a network and remains undetected for a significant period of time. The intent is often to steal data rather than to cause direct damage to the systems.

Distributed Denial of Service (DDoS) attacks

These attacks flood the targeted server with requests, forcing it to use all its resources to respond to them, thus being unable to service regular requests. A DDoS attack can take down a website, an app, or even a banking system.

Man-in-the-Middle (MitM) attacks

MitM attacks involve the attacker secretly and surreptitiously intercepting and possibly altering the communication between two parties who believe they are directly communicating with each other.

Security measures in the data lifecycle

To mitigate risks of data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access. incidents, implementing robust security measures is an absolute must.

Common sense prevails. If you are tempted to download your company customer list to a USB drive, make sure the drive is secured with a secret key. If that drive falls into the wrong hands, you’ve just created a data breachA security incident that results in unauthorized access to confidential information..

In general, any storage solution that you use when working with consumer data should be adequately encryptedWhen information is encrypted, it is obfuscated in such a way that no one without the encryption key should be able to determine what the data actually comprises.. This includes the hard drive of your computer. In the digital age, physical records are often overlooked, but you need to make sure that any physical copies of sensitive data are secured (or destroyed) appropriately.

Another important proactive measure is access control. Giving access needs to be secured just like removing access. It’s all too common in the world of digital marketing to still have agencies and contractors with full access to your data even though you haven’t worked together for a long time anymore. Auditing access to your systems should be done periodically, and access should be set to expire after a given amount of time.

Your company IT probably has a strategy for deploying firewalls, antivirus systems, and intrusion detection heuristics. While you don’t need to know how these operate, they might sometimes cause disruptions or latencyAnother word for delay. The higher the latency, the longer the delay between the action and the consequence. in your work, as they add overhead to network requests.

Finally, your job as a technical marketer is to be the steward of user data, especially when it relates to marketing. In addition to securing the data, you also need to be mindful of:

• Data collection: Secure methods should be used during data collection, so that personal data is collected legally and ethically. Don’t collect sensitive information unless you have a legal basis to do so and an actual need for it.
• Data processing and analysis: Make sure that data integrity and confidentiality are respected when you process data. For example, if joining data from different sources, make sure that it is still distinguishable which parts are personal data and subject to data protectionIn the context of regulation, data protection is the process of safeguarding any data relating to an identified or identifiable natural person. regulation.
• Data retention and disposal: Data isn’t meant to be stored forever. Set proactive retention limits to data, so that it’s purged after the expiration date is met. Make sure that disposal is done so that it is truly irreversible.

All the Topics in this Chapter have revolved around the concepts and technical jargon of privacy, data protectionIn the context of regulation, data protection is the process of safeguarding any data relating to an identified or identifiable natural person., and data securityThe process of protecting digital data throughout its entire life cycle from corruption, theft, or unauthorized access.. Ultimately, it’s all about responsibility and accountability.

It’s been said many times here: you are responsible for the data that you handle. While there may not always be a legal obligation to protect and secure it, there is a broader ethical obligation to make sure that the data is handled responsibly.

This was the last Chapter of the Technical Marketing Handbook, but in many ways it’s the most important one. The Topics covered here deal with some of the most fundamental questions a digital organization faces.

We trust that you have the motivation to improve yourself on a daily basis when working as a technical marketer.

Quiz: Data Security

Ready to test what you've learned? Dive into the quiz below!

1. What do you need to consider when controlling access to a secure system?

That access is set to expire after a certain period of time

That access is given to the right people, in the right systems, for the right reasons

That access is periodically audited to remove outdated or unwarranted entries

All of these things are important when considering access control. Unwarranted access to a system is a threat vector that cannot be underestimated.

All of these things are important when considering access control. Unwarranted access to a system is a threat vector that cannot be underestimated.

2. Why is phishing a particularly nasty threat vector?

Because phishing attacks are technically not illegal or malicious

Because modern email systems have little to no protections against phishing attacks

Phishing can be made to look and feel exactly like the service it is masquerading as, making it difficult to recognize it as an attack

Professionally-made phishing attacks can be made to look exactly like the service they are trying to parrot. It is very impossible even for seasoned veterans to identify the attack. A rule of thumb is that no legitimate service will ever ask for your sensitive information over email.

Professionally-made phishing attacks can be made to look exactly like the service they are trying to parrot. It is very impossible even for seasoned veterans to identify the attack. A rule of thumb is that no legitimate service will ever ask for your sensitive information over email.

3. How would you reverse a hash?

You can get the decryption key with social engineering or phishing methods and use that to unhash the data

You can't – hashes are one-way and as such irreversible

With a powerful enough computer, you can try all the different possible decryption keys on the hash and thus break it

Hashing is a one-way transformation algorithm. It cannot be reversed. If you know enough about the input value, you can try different possible values to get the same hash (at which point you'll know what the original data was), but this can be secured against with multiple layers of hashing and with salts.

Hashing is a one-way transformation algorithm. It cannot be reversed. If you know enough about the input value, you can try different possible values to get the same hash (at which point you'll know what the original data was), but this can be secured against with multiple layers of hashing and with salts.

Your score is

0%

Restart quiz