As data needs to be protected anywhere and everywhere, regardless of where it resides, whether on-premises, in the cloud, or in transit while ensuring that data remains protected independent of the device or network used to access it, security efforts to protect data should be focused on protecting data itself, instead of the systems or networks where data is kept. A conventional perimeter-based approach that focuses on securing access to a network is no longer sufficient to secure data because with global workforce, remote work, and move to cloud and hybrid environments, it is becoming too complex and costly to clearly defined perimeter between secure and insecure zones.

Since potential threats can originate either inside or outside of secure networks, every access and use of data must be verified and granted at the time of request. This is done on a need-to-know basis following least privilege principle,  while monitoring access continuously with detailed logs to support audits and forensic investigations.

Protecting data comprehensively, whether it is at rest, in transit, or in use, across all the systems where data is stored, and used requires a multi-layered and policy-driven approach that incorporates a variety of data centric security enforcements and best practices which include identity management, access control, data masking and data segregation, encryption and digital rights management (DRM), and data loss prevention. . Data protection also needs to be applied dynamically in real-time based on policy, because as factors change that impact who and what is authorized to access a particular set of data, data security policies must evolve with the changes as well without manual intervention. Data security policies should be created based on data sensitivity and security requirements specifying how, when, where, and by whom data should be accessed, shared with, and protected from, and then applied to the appropriate set of data, regardless of whether it is in use, at rest, or in motion.