RemoveMyPhone

Data protection lessons have been learned many times over the Internet era. Billions of pieces of personally identifiable information have been lost in many infamous data leaks where giant corporations lose control of their databases. When these security breaches happen, businesses face more than just a significant blow to their brand's reputation. Businesses can be hit with gigantic government fines or other penalties depending on local laws.

Because the security of PII continues to grow in complexity, various governments are continuously extending the rights of people to better control and protect the use of their personal data. In the European Union, enforcement of the General Data Protection Regulation (GPDR), began in May 2018 to regulate data protection and privacy. In the United States, the Data Breach Prevention and Compensation Act has been winding its way through congress and several states already have their own security data breach laws similar to GDPR. This leads to a complicated legal environment when it comes to privacy and personal protection.For example, New York implemented the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) to broaden data security and breach notification requirements and increased the types of private information to be protected such as email addresses, email passwords and biometric information (digital copies of fingerprints, voice prints, retina scans or any other digital representation of biometric data).

Because this is so important, The National Institute for Standards and Technology (NIST) suggests that PII should be protected through a combination of measures including operational safeguards, privacy-specific safeguards and security controls aligned to a risk-based approach.

Privileged access management has a key role to play in protecting PII. Here's how:

Access Enforcement and Separation of Duties

Organizations should control access to PII through thoughtful policies and access enforcement mechanisms. One of the ways this can be done is by managing privileged credential policies across the entire IT environment, isolating sessions through a highly secured proxy and implementing role-based access control to help ensure that each person can only access the servers and information needed for their specific job. Privileged access management solutions continuously scan the environment to detect privileged access, validate privilege by adding discovered accounts to a pending queue and automatically onboard and rotate accounts and credentials based on enterprise policy in a highly encrypted vault. The use of a secure and fully-isolated proxy helps prevent the exposure of privileged credentials directly to the end users, their target applications or devices. This secure control point manages access to these privileged credentials and implements dual-control for a more robust workflow, providing users with customized approval workflows that ensure that they are in compliance and allowed to access the systems hosting PII – no matter the environment (cloud or hybrid).

User-Based Collaboration and Information Sharing

Another NIST guideline focuses on the need for automated mechanisms to assist users in determining whether access authorizations match access restrictions. This is especially important for PII. Privileged access management solutions can integrate with IT service management solutions to enforce security policies in an operationally efficient manner. They do this by triggering the approval processes that authorize access to systems and applications containing PII and elevate privileges to execute tasks within a system or application.

Remote Access

In order to perform their defined tasks, organizations often give third party companies access to important internal systems and sensitive information, including PII. Providing remote access through VPNs is a common and wise solution for a secure connection from outside the network. However, when it comes to providing access to important business systems and applications, such as ones that manage and store PII, VPNs aren't designed to provide granular, role-based access. Various remote access solutions aim to solve this problem by leveraging Zero Trust access, biometric multi-factor authentication and just-in-time provisioning so that third parties only have access to the systems they need, and for only as long as they need it.

Least Privilege

It's a common best practice to only allow access to applications and machines by those who are performing a specified task. Privileged access management solutions help enforce defined access permissions. These solutions are also integral to enforcing the principle of least privilege – that people only have access to what they need to do their jobs and only for a certain amount of time.

Privileged access management solutions remove and manage local admin rights on workstations and servers, approve applications to run and block malware, including ransomware. Unknown applications are able to run in a restricted mode, which prevents them from accessing corporate resources, sensitive data such as PII or the Internet. All of this takes time and effort to setup, but can keep your enterprise safer from cybercriminals.

Auditable Events, Reviews, Analysis and Reporting

In order for businesses to comply with multiple regulations, they need to demonstrate that they are correctly managing of PII for audits. Privileged access management solutions enable companies to automatically record and store privileged sessions within a centralized encrypted repository. Prioritize auditing recorded and active sessions with video playback that streamlines reviewing the most suspicious activity. Good logging systems are critical for this operational task.

Identification and Authentication

A crucial step in a strong security program is the ability to authenticate users before accessing critical systems and sensitive PII. Privileged access management solutions help authenticate users and transparently log onto applications using credentials stored and managed in highly encrypted vaults. These solutions can also integrate with support user accounts and groups of users whose details are stored externally in LDAP-compliant directories and use Active Directory Federation Services (ADFS) to access environments with a single sign-on service. Equally, leveraging multifactor authentication (MFA) as part of an overall privileged access management program allows businesses to add an extra layer of protection to better secure systems containing sensitive information. As organizations continue to wrangle with new and emerging regulations, a detailed privileged access management program can play a key role in helping to not only protect sensitive PII and comply with these directives, but also to continue to build consumer trust and help increase business profits.

Attackers and cybercriminals have been very successful (and profitable) over the last 10 years – putting many companies and their security programs to the test. In addition to these and other common best practices, people have been leveraging various privacy services such as RemoveMyPhone in order to keep their personally identifying information as safe as possible. As digital payment solutions such as Bitcoin continue to gain in popularity, the necessity to keep peoples' information as safe as possible has become very clear!

We hope you enjoyed reading this guide and learned something new! Check out our Learning Center to learn more about online privacy and security or consider subscribing to our Online Privacy Service to remove your phone number, name, and address from Google, Bing, Yahoo, and DuckDuckGo search results and hundreds of data broker sites.