In terms of securing data it’s always a good idea to err on the side of caution, however there is a simple rule which can help you focus on what’s important.
The Pareto principle (commonly known as the 80–20 rule) states that, for most events, roughly 80% of the effects come from 20% of the cause.
Example…
80% of your customer produces 20% of your revenue
20% of your employees cause 80% of the issues
Cyber Security is a great place to apply the principle to when we think about risk…
Talking to CISO’s and other cyber security professionals, one area of concern that always comes up is “losing sensitive data” not just from cyber-attacks but from within their own business! Human’s make IT security guys nervous, take USB storage devices as an example, it is nearly impossible to police data that is copied and stored on individual’s mobile storage devices, you can’t manage what you can’t see after all.
Let’s look at the 80-20 rule and we can start to simplify our approach...
Notwithstanding good policy and communication within the business to ensure everyone knows their role and individual responsibility in terms of data security, there are times when people need a helping hand.
If you looked at a business with 1000 employees, you could quickly separate "lower risk staff” (i.e. limited or no access to sensitive data) and "higher risk staff" (i.e. senior or strategic staff with regular access to sensitive data).
For the 800 staff - policies, procedures and training should be sufficient, for the 200 staff the provision of secure mobile storage devices would be an effective solution that ensures their productivity or ability to work flexibly was not impacted while ensuring any data stored is safe and secure.
It’s a balance between cost and return, the 80–20 rule can ensure you maximise positive impact in the most cost effective and way.
