1. WHITEPAPER Data security in the modern data-first landscape

2. WHITEPAPER | Data security in the modern data-first landscape Executive Summary In today's dynamic landscape, businesses are increasingly leveraging a multitude of technologies to produce, store, and leverage massive amounts of data to generate pivotal insights that steer decision-making. Yet, this surge in technological prowess has inadvertently ushered in a surge of data breaches and cybercrimes. Within this context, safeguarding data emerges as a key priority for CIOs, underscoring a myriad of compelling rationales: • Financial jeopardy looms large in the aftermath of a data breach, with the average cost surmounting $4 million Trust, the bedrock of customer relationships, erodes swiftly as a hacked company's reputation crumbles Regulatory fines loom ominously, given the stringent data security benchmarks spanning numerous sectors Operational havoc ensues when sensitive data vanishes, imposing arduous recovery processes both in terms of time and resources • • • By embracing an uncompromising stance on data security, CIOs not only shield their enterprises from these perils but also navigate the intricate labyrinth of data security regulations with finesse. This whitepaper aims to help the decision-makers embark on an illuminating journey where they will learn about: • • • • Modern data landscapes and the fundamentals of data security The need to secure data Types of data security Data security best practices and lots more

3. WHITEPAPER | Data security in the modern data-first landscape Table of Content Introduction to modern data landscape and data security 04 Why data needs to be secured 07 Types of data security 08 9 best practices to secure data 10 Make data security a key priority with Kellton 12

4. WHITEPAPER | Data security in the modern data-first landscape Introduction to modern data landscape and data security Data is the new superpower. IT and business leaders invest heavily in building and optimizing their data ecosystems. The driving force behind their dramatic fascination with everything about Data is the transformative impact it can have on their bottom lines. The increasing investments in data engineering, innovative products & services, the rapid rise in cloud computing, and sophisticated analytics systems have led to the emergence of modern data-first landscapes. What is a modern data-first landscape? A cutting-edge data-first landscape or environment is one in which data takes on the central stage. It comprises sophisticated tools, technologies, and systems that dramatically escalate and accelerate the capabilities of an organization to produce, store, process, and analyze massive amounts of Data-first organizations then generate critical insights from the data they gather to drive decision-making, optimize existing products and services, develop a new line of offerings, and improve their competitive position. Several factors are driving the adoption of the data-first landscape, including: • The increasing availability of data: The cost of data storage and processing has decreased significantly in recent years, making it easier for businesses to collect and store large amounts of data. The growing sophistication of data analytics tools: A wide range of tools are now available that can help businesses make sense of large amounts of data. The growing demand for data-driven decision-making: Businesses are increasingly recognizing the value of using data to make better decisions. • • The data-first landscape presents both opportunities and challenges for businesses. On the one hand, it allows businesses to gain a competitive advantage by using data to make better decisions. On the other hand, it also exposes businesses to new risks, such as data breaches and cyberattacks.

5. WHITEPAPER | Data security in the modern data-first landscape Organizations that want to succeed in the data-first landscape need to have a strong focus on data security. They need to implement appropriate security measures to protect their data from unauthorized access, use, disclosure, disruption, modification, or destruction. Here are some critical security challenges in a data-first landscape: • The increasing volume and velocity of data make it more challenging to track and protect. The growing interconnectedness of devices and systems makes it easier for attackers to gain access to data. The increasing sophistication of cyberattacks makes it more difficult to defend against them • • Organizations that want to succeed in the data-first landscape need to have a strong focus on data security. They need to implement appropriate security measures to protect their data from unauthorized access, use, disclosure, disruption, modification, or destruction. According to IBM's Cost of a Data Breach 2022 report, the global average cost of a data breach is USD 4.35 million; the average cost of a data breach in the United States is more than twice that amount, USD 9.44 million. Eighty-three (83) percent of organizations surveyed in the report experienced more than one data breach. What is data security? As a concept, data security touches base with every tool, technology, platform, and policy that interacts with data in any way. At the core of data security lies everything an organization needs to do in order to protect its data from unauthorized access - data sources that collect data, data repositories such as data lakes and warehouses, data pipelines, and data and business teams. Data security isn’t only limited to protecting digital information assets - instead, it is also about protecting the hardware and storage devices and even physical files that can contain sensitive or personal information. When implemented strategically, a data security strategy can help organizations harness the transformative potential of data while mitigating potential threats and successfully complying with data protection and security regulations.

6. WHITEPAPER | Data security in the modern data-first landscape Cost of a data breach by country or region (Measured in US$ millions) United States $8.9 $5.97 Middle East Germany $4.78 $4.44 Canada $4.33 France United Kingdom $3.88 Japan $3.75 Italy $3.52 $3.30 South Korea $3.06 South Africa $2.62 ASEAN $2.30 Scandinavia $2.13 Australia Turkey $1.86 India $1.83 $1.35 Brazil $0.00 $2.25 $4.50 $6.75 $9.00

7. WHITEPAPER | Data security in the modern data-first landscape Why data security is required Data security is crucial for the success of modern businesses as it safeguards valuable information, maintains customer trust, complies with regulations, enhances competitiveness, and prevents financial losses. Let's explore these key points in more detail: Protecting sensitive data assets:In today's digital age, businesses accumulate vast amounts of sensitive data, including customer information, financial records, and intellectual property. Securing this valuable information is vital to prevent unauthorized access, data breaches, and potential exploitation by malicious actors. Winning and maintaining customer trust:Data breaches can have severe repercussions on a company's reputation and customer trust. When customers entrust their data to a business, they expect it to be handled with the utmost care and confidentiality. Implementing robust data security measures protects customer data and strengthens their confidence in the company. Compliance with regulations: Governments and regulatory bodies worldwide are imposing stringent data protection laws and regulations. Non-compliance can lead to severe penalties and legal consequences. Businesses can ensure they meet these regulatory requirements and avoid costly legal issues by prioritizing data security. Staying ahead of the competition: Data security has become a significant differentiator among businesses. Customers are increasingly choosing companies that prioritize and demonstrate strong data security practices. By investing in data protection, businesses can gain a competitive advantage in the market and attract more customers. Mitigating financial risks: Data breaches can result in significant financial losses due to direct costs associated with incident response, legal actions, and potential compensations. There are indirect costs, such as the loss of business opportunities and damage to the company's image. Robust data security measures act as a preventive barrier against these financial pitfalls.

8. WHITEPAPER | Data security in the modern data-first landscape Types of data security Data security encompasses a diverse range of measures and methods aimed at safeguarding sensitive information from unauthorized access, disclosure, or corruption. These security measures are designed to protect data at rest, in transit, and during processing. Some common data security types include multi-factor authentication, which requires users to provide multiple forms of verification before gaining access to data or systems. Data masking involves disguising original data to preserve its integrity while protecting sensitive details. Intrusion detection systems and firewalls are vital in monitoring and preventing unauthorized access to networks and systems. Regular security audits and employee training further enhance data security readiness. Embracing a multi-layered approach to data security is essential for mitigating risks and ensuring valuable information's confidentiality, integrity, and availability. Data encryption at rest and in transit:It’s an essential defense against data misuse or mishandling. It is given in today’s data security programs to ensure that unauthorized parties do not use intercepted data. Data-first organizations must encrypt their data both at rest and in transit. Teams can encode their data assets using symmetric or asymmetric encryption methods. Symmetric encryption involves using only one key to both encode and decode information. It’s more apt when small data sets are involved. Asymmetric encryption methods are more complex and involve using two keys, one for encrypting the information (public key) and one for decrypting the data (private key). Data masking:It is another effective data security technique that organizations use to mask their data that is sensitive in nature. Data masking does not affect the value or significance of the data as the structure and format remain unaltered. Only personally identifiable information (PII) is masked to mitigate data breaches or theft risks. Data masking solutions allow organizations to share the data they collect and store with their development and testing teams to build applications or when a project is outsourced to an external partner so that they can exploit the data to generate insights without compromising the integrity of the customer or corporate data.

9. WHITEPAPER | Data security in the modern data-first landscape Data loss prevention (DLP): To prevent data loss, organizations can use a number of safeguards, including backing up data to another location. Physical redundancy can help protect data from natural disasters, outages, or attacks on local servers. Redundancy can be performed within a local data center or by replicating data to a remote site or cloud environment. Beyond basic measures like backup, DLP software solutions can help protect organizational data. DLP software automatically analyzes content to identify sensitive data, enabling central control and enforcement of data protection policies and alerting in real-time when it detects anomalous use of sensitive data, for example, large quantities of data copied outside the corporate network. Data backup and recovery:Data backup and recovery are critical to data management and cybersecurity. It involves creating duplicate copies of critical data to protect against data loss due to hardware failures, human errors, cyberattacks, or other unforeseen events. The original data is copied and stored in a separate location during data backup, often on external drives, cloud storage, or dedicated backup servers. In the event of data loss or corruption, data recovery is restoring the backed-up data to its original state. This ensures business continuity and minimizes the impact of data loss on operations. Data recovery can involve retrieving specific files or entire system backups, depending on the extent of the data loss. Regularly scheduled backups and a well-defined recovery strategy are crucial for businesses to safeguard critical information and quickly resume normal operations in case of data emergencies. Physical security: Physical security measures in the context of data security refer to the protection of physical assets, facilities, and equipment that store or process sensitive data. These measures are designed to prevent unauthorized access, theft, damage, or tampering with physical devices that hold data, such as servers, data centers, and storage devices. Examples of physical security measures include access control systems (like key cards or biometric scanners) to restrict entry to data storage areas, security cameras to monitor and record activities, and secure locking mechanisms on cabinets or server racks. Implementing robust physical security measures is essential to complement digital safeguards and ensure comprehensive protection of sensitive data from internal and external threats.

10. WHITEPAPER | Data security in the modern data-first landscape 9 Data security best practices Protecting data integrity and confidentiality is vital for any organization. However, some industries, such as healthcare, banking & financial services, insurance, and e-commerce, are highly regulated and vulnerable and can not just take data security lightly. Here are nine data security best practices that businesses, regardless of their industries, can integrate into their processes and practices to build robust data security ecosystems. Train and empower employees: An organization’s workforce is often the first line of defense against cyber attacks. Therefore, data-first organizations must conduct regular training programs and workshops on identifying phishing emails, social engineering tactics, and best practices while sharing confidential data with internal or external stakeholders. Practical employee training and awareness can significantly reduce the risk of security breaches and help organizations leverage the full potential of data while seamlessly complying with data security and privacy regulations. Data encryption:Hackers or cyber criminals can wreak havoc on the reputation and profitability of the business they target or steal data from. If unauthorized users access the sensitive data, it can be manipulated or sold further, which leads to more damage to the organization. Risks to sensitive data can be managed well by employing end-to-end encryption. It's a powerful way to encode data in storage and transmission, making it useless if it’s intercepted. Strong password policies: Enforcing solid passwords is essential to prevent unauthorized access to sensitive data. Encourage users to create complex passwords containing a mix of uppercase and lowercase letters, numbers, and special characters. Regularly prompt users to update their passwords and avoid using easily guessable information like birthdays or common words. Access control and privilege management: Implement strict access control measures to limit data access to only authorized personnel. Assign roles and permissions based on the principle of least privilege, ensuring that individuals can access only the information required to perform their job duties. Regular data backups: Perform regular backups of critical data to ensure its availability and integrity in case of data loss due to hardware failure, cyberattacks, or other incidents. Employ onsite and offsite backups and test the restoration process to verify data recoverability.

11. WHITEPAPER | Data security in the modern data-first landscape Network security: Secure your network infrastructure with firewalls, intrusion detection systems, and up-to-date security protocols. Regularly monitor network activity to identify suspicious behavior and take immediate action against potential threats. Patch management: applications updated with the latest security patches. Cybercriminals often exploit known vulnerabilities, and timely updates help mitigate these risks. Keep software, operating systems, and Physical security measures: Don't overlook the importance of physical security. Restrict access to data centers, server rooms, and other sensitive areas. Use surveillance and access control systems to monitor and limit physical access to critical infrastructure. Incident response plan: Develop a comprehensive incident response plan to address potential security breaches swiftly and effectively. This plan should include predefined steps for identifying, containing, eradicating, and recovering from security incidents. Regularly test and update the plan to reflect the evolving threat landscape. By implementing these data security best practices, organizations can significantly enhance their security posture and safeguard sensitive information from potential threats. Remember, data security is an ongoing process that requires vigilance and continuous improvement to stay ahead of ever-evolving cyber threats. Train and empower employees Incident response plan 9 data security best practices Physical security measures Data encryption Patch management Strong password policies Access control and privilege management Network security Regular data backups

12. WHITEPAPER | Data security in the modern data-first landscape Make data security a key priority with Kellton The data security landscape will continue to evolve in the coming years, primarily driven by two critical factors: organizations will produce and store more data than ever (thanks to technologies like AI and IoT), and data breaches will become more sophisticated and expensive. Data-first organizations will increasingly realize the value generated by robust data security policies and processes and employ full-fledged data security platforms to secure and share their data. Engaging a reliable data security partner can help accelerate an organization’s journey toward becoming a data-driven organization and keep its data ecosystem safe, secure, and scalable. Here are a few questions to consider as starting points when you talk to your current partner or start talking to new suppliers: • Do they have a range of solutions with the operational characteristics you need to support the range of data sources, locations, and platforms you run today? Will they keep up to date with industry developments to ensure your solution can meet the demands you have tomorrow as well as those of today? How comprehensive are the data protection capabilities they provide? Do they have rapid 24x7, local-language support wherever you have systemsthat require protection? Does their data protection management integrate with the tools that currently run and monitor your infrastructure? Do they understand your specific needs, not just those of a general customer? Do they have a partner community that includes suppliers you already work with? Can they provide flexible ways to finance your data protection needs? • • • • • • • At Kellton, we are committed to helping our clients in their quest to build robust and sustainable data ecosystems. Our 1800+ global workforce, combined with our state-of-the-art Centers of Excellence (CoE) and deep domain and cross-industry experience, help our clients bolster new growth opportunities and mitigate data security risks. To take the first step, please speak with our data experts.