10 things organizations should do to protect against hacking.

• Author: Isaza, John J.
• Position: RIM FUNDAMENTALS - Column

A recent New York Times report about a Russian gang that collected the Internet security data of 1.2 billion people has stirred a maelstrom of pundits wondering if the situation is as dire as it sounds or just sensationalistic reporting. Regardless, one thing is clear: the mere specter of being hacked reinforces the importance of information governance (IG) and data protection processes, procedures, and technology.

But, some organizations are looking for a "silver bullet" to come along to make it easier for them to stay ahead of the criminals. Indeed, companies like Milwaukee-based Hold Security are now offering monthly fee-based services to help organizations detect if their sites have been affected by this breach. Frankly, though, organizations that need to rely on this type of service to protect themselves will remain a prime target; this incident should serve as a huge wake-up call for them to take more proactive steps to safeguard their information.

Accountability, Preparation Needed

Most importantly, someone with a high level of authority has to be in charge of information security to ensure that people, processes, and technology are in place and working effectively. This might be a chief data officer (CDO) or some similar officer who is tasked solely with responsibility for ensuring data is protected. The first of the Generally Accepted Recordkeeping Principles[R] (Principles), the Principle of Accountability, speaks directly to this point. (Read more at www.arma.org/principles.)

Stay on top of your information governance ecosystem.

After accountability is assigned, preparation is key. Following is a list of 10 things organizations should do to protect their data and stay ahead of the curve.

1. Hire or appoint a CDO or a similar executive to be responsible for information security. (See previous comments.)

2. Learn from the past. It has been said that those who do not know history are doomed to repeat it. Start by assessing your organization's previous hacking incidents and learning as much as possible from those experiences. If you have not had any breaches, consider yourself lucky and learn as much as you can from other organizations' breaches.

3. Hire hacking professionals. If data is stored locally, retain a consultant or task an employee with figuring out how to hack into the organization's systems. Depending on the size of the organization, this could be a full time job for one or more people.

4. Vet vendor security. If data is...