@denbestenI would dispute this approach, as it may work for traditional organisations, but lots of organisations have spread themselves into the digital transformation movement i.e. moved to cloud. Unfortunately a level of naive mindsets has spawned into lots of organisations - they simply do not know the value of their information/data assets, nor do they actually know who, what, has access whether authorised or not authorised access to them. They simply do not know.
Then they find out that the Cloud providers shared responsibility model actually does matter, and the associated controls, which they failed to comprehend. So their data may appear to be safe in the cloud providers hands, but in fact they just make the whole thing far worst for themselves. Many organisations just do not realise this, and in fact have cascaded an existing issue into an even greater nightmare for themselves.
As we have simply stated many times, if you visibly see your data and its whereabouts and the associated controls, you potentially have the means to protect it. If you do not, you just made the issue far greater and so much easier for the attacker, who is sitting either internally masquerading as an individual or sitting externally waiting for the opportunity to make many organisations experience a living hell.
One approach is simply, ensure you encrypt your data, wherever it exists, in transit, or at rest, and perhaps apply some Full Homomorphic encryption to raise their maturity level at the same time. This would certainly off set the nightmare that awaits the unwary. Or those who are prepared to take a risk, and "it won't happen here" brigade.
In fact came across one organisation the other day, who simply did not have "governance", an accident simply waiting to happen.
However, on average it may take them 293 days to discover they have been compromised, and suddenly they have friends and helpers they never knew before.
regards
Caute_cautim
