What are some tips for storage of sensitive data? | TechTarget (2024)

Where sensitive data can be stored

Storage of sensitive data can be on virtually any viable storage media, ranging from HDDs to SSDs, if organizations take proper protection measures, such as encryption. When considering the type of storage medium for sensitive data, several factors must be considered:

• The storage media type and unique risks. Examine the risks associated with the storage media in terms of the sensitive data applications. HDDs, SSDs, RAID and tape storage are all fundamentally secure media options, provided users take the necessary precautions to secure each device from theft, physical damage and unauthorized access. For example, take actions to prevent drive failures and ensure tape storage is in a secure facility.
• Accessibility of sensitive data. Based on how the sensitive data is used and how frequently it will be accessed, the application must be clearly defined and, if possible, documented as part of a data protection policy. For example, frequently used sensitive data is best stored on a high-speed medium, such as an HDD or SSD. If the storage media are in a data center, they are much easier to monitor for security and unauthorized access than if the storage media are in a cloud environment.
• Location of the data. User requirements and internal policies for sensitive data may determine where the storage media is physically located. Frequent access may suggest an on-site storage location versus a remote-based cloud. Infrequent access to sensitive data is better suited to tape storage, especially if the tapes are stored in a secure, environmentally friendly location.

If sensitive data is stored in a cloud storage service, it is the user's responsibility to ensure that the data is protected from unauthorized access and possible compromise, such as through hacking. The cloud vendor may offer its own data protection measures, but the user has the ultimate responsibility for protecting the data. Check with cloud storage vendors on how they securely store data in the cloud.

In some cases, it may be necessary to establish sensitive data storage parameters based on complying with GDPR or other data protection standards and metrics.

Techniques to protect and store sensitive data

There are a variety of different ways to hedge against the associated risks of storage of sensitive data:

• Document sanitization. Use document sanitization to delete metadata from sensitive data, and then encrypt and securely store sensitive data that is free of metadata. Metadata adds information to data that facilitates the processing, categorizing, sharing and reuse of data. Unauthorized access to metadata can pose a significant risk to businesses, as metadata may contain sensitive data about the author, characteristics or contents of sensitive information.
• MFA. Manage access to sensitive data through a variety of controls, including the use of multiple types of authentication, such as passwords, tokens and biometrics, including a thumbprint or retina scan.
• Data encryption. Sensitive data at rest or in transit can be encoded with special character sequences to make it difficult to access based on the encryption algorithm.
• User training on protecting sensitive data. While technology may be the primary method of protecting sensitive data, it is important to educate users on proper techniques for securing that data.
• Data masking. Data masking creates a similar but inaccurate version of sensitive data that can protect the actual data and maintain a functional substitute for protecting the real data. This can make it increasingly difficult for malicious actors to reverse-engineer and locate data.
• Data deletion policies. Sensitive data, at some point, may no longer be considered sensitive. When data is no longer sensitive, organizations must decide whether to retain or dispose of that data. From a legal or regulatory perspective, for example, it may be important to archive previously sensitive data for its historical value or content that could be useful in litigation or audits. If newer sensitive data supersedes the older data, the organization may delete or destroy the previous data.