• Authentication versus authorization. It’s crucial to understand that simply because
someone becomes authenticated does not mean that she is authorized to view certain
data. There needs to be a means by which a person, after gaining access through
authentication, is limited in the actions she is authorized to perform on certain data
(such as read-only permissions).
• Protecting data with cryptography is important for the security of both the
organization and its customers. Usually, the most important item that an organization
needs to protect, aside from trade secrets, is its customers’ personal data. If there
is a security breach and the data that is stolen or compromised was previously
encrypted, the organization can feel more secure in that the collateral damage to
its reputation and customer base will be minimized.
• Data leakage prevention and content management is an up-and-coming area of data
security that has proven extremely useful in preventing sensitive information from
leaving an organization. With this relatively new technology, a security administrator
can define the types of documents, and further define the content within those
documents, that cannot leave the organization and quarantine them for inspection
before they hit the public Internet.
• Securing email systems is one of the most important and overlooked areas of data
security. With access to the mail server, an attacker can snoop through anyone’s
email, even the company CEO’s! Password files, company confidential documents,