Customer data protection is important to every business that wants to protect its financial security and its reputation — but it’s even more important for managed service providers (MSPs).
When talking to your clients, you’ll probably tell them that a huge reason why protecting customer data is mission critical is because their entire business depends on it. If they’re vulnerable to hacking or data loss, they’re setting themselves up for fines, hits to their reputation, lawsuits, and a strong chance of losing their business altogether.
You might even tell them about a case study like Equifax, whose infamous data breach cost them $4 billion in market value. They were also fined $700 million by the FTC and are still dealing with remediation and negative press from the event.
MSPs tell stories like these all the time, but many forget how important customer data protection is to their own business and allow it to become an afterthought. In this article, we’ll discuss the nature of customer data protection, why it matters to everyone, and we’ll share some expert guidance on how to protect MSP customer data.
What this article will cover:
- What is customer data protection?
- Why should customer data be protected?
- The four types of customer data
- Customer protection responsibilities
- How to protect customer data
What is customer data protection?
Customer Data Protection is a concept that revolves around the security and privacy tools and methods used to safeguard information collected from clients. This includes any collected marketing data, financial data, and information about their behaviors — all which can be very valuable to hackers.
In the case of the MSP, customer data can also include login credentials and IT management information. Protecting this is essential, as the client data an MSP possesses can serve as “the keys to the castle” for hackers who want to infiltrate their clients’ networks.
Why is customer data protection important?
When talking about customer data protection, we’re usually referring to something important to data privacy called Personally Identifiable Information (PII). This refers to any information that can directly identify an individual, such as names and addresses, email addresses, financial data, copies of state-issued IDs, credit card numbers, or IP addresses.
Because PII is so sensitive and protecting it is important to every individual, a comprehensive data protection strategy becomes essential. Here are key reasons why every organization needs to develop a comprehensive client data protection plan, regardless of their size:
Compliance with laws and regulations
Data protection regulations differ considerably from country to country, but it’s important to remember that they apply to the location of the citizen, not the entity collecting or processing the data. It’s likely that any business with an online presence will have to adhere to legislation such as GDPR (in the case of EU citizens) or CCPA (for Californian citizens). Many of these regulations are quite strict and failure to comply with them will result in large fines.
Customer trust and brand reputation
Consumers view a data breach as a breach of trust. Like it or not, people who hand over their personal information to a business expect that it will be protected — and collectively they are not quick to forgive mistakes. Some major brands who have had lapses in customer data protection have suffered immensely from the PR fallout, with some even facing class action lawsuits from their customers.
Time and productivity loss
Ignoring the need for customer data protection can have a major impact on business processes later on. Aside from the financial, legal, and reputational consequences of a potential mistake, many hours and resources can end up being spent investigating incidents and then fixing them. If this causes assets to be shifted away from other operations, it can mean serious downtime throughout the organization.
Four types of client data
1) Master data
Master data involves key information that is shared across the enterprise to facilitate high level business processes. Master Data Management is the practice of responsibly managing and processing master data according to the organization’s needs.
Consider master data the functional data for businesses. It includes things like master lists of customers, products, and vendors — MSPs should think of the client data in their CRM and RMM. This type of data is often considered mission critical for the business, and often needs to be shared and accessible across the company, while also remaining secure.
Master data is specifically created, managed, and stored in such a way that it can be accessed for necessary business processes or functions. An example would be a CRM database that is integrated with other applications so that client and prospect lists can be viewed and used by the marketing department, sales team, and — through an RMM integration — the techs on the team.
2) Transactional data
Transactional Data is typically created, stored, and utilized in operational and/or transactional contexts including banking or invoicing transactions. Safe processing and storage requirements for transactional data varies amongst industries. For an e-commerce company that sells a product online, this usually includes data regarding customer shopping and purchasing behaviors, as well as actual payments and fulfillment data. Customers’ PCI (Personal Credit Information) data remains private and compliant. Vendor banking/payment information should be protected as well.
Transactional data tends to run on a much larger scale than other types of data due to volume balanced against its potential value to a hacker. Ensuring the privacy and security of this data and the associated Personal Credit Information is of key importance when managing the policies and processes surrounding it.
3) Reference data
Reference Data is stable information that categorizes data, correlates it with consistent values, and follows relatively fixed internal and/or external standards.
By nature, reference data tends to stay the same or change very slowly over time. Examples include parts and products lists, breakdowns of customer segments, vendor contact lists, and internal process documentation.
4) Freeform data
Freeform Data, also known as unstructured data, is not organized or formatted in a predefined manner. Any data that is not stored into a spreadsheet, table, or database that is easily referenced by a computer is considered freeform.
Think about a simple contact form on a website. Fields like “Name” and “Email” can be understood by computer automation and instantly used by other applications, whereas entries into “Comments” will be considered freeform.
Freeform data can also include documents, blog posts, journal articles, emails, surveys, reviews and feedback, social media posts, and phone scripts. Because freeform data is as open-ended as human creativity, it is the most difficult to process and analyze.
Who is responsible for protecting client data?
While we know MSPs have a responsibility to protect their customer data – what about the customers themselves? What is their level of responsibility in protecting their own data?
A litany of past surveys show that consumers believe their responsibility to secure their data is minimal. Instead, they believe that the responsibility for keeping their PII safe falls almost entirely on the companies they share data with.
Consumers are more concerned with convenience, so they tend to leave concerns about security up to the businesses offering the services. And as we discussed before, they can be pretty adamant about their stance. The majority of consumers say they would stop using a retailer (60%), bank (58%) or social media site (56%) if it suffered a breach. 66% of consumers say they would be unlikely to do business with an organization that experienced a breach where their financial and sensitive information was stolen. (Source: Gemalto)
In effect, these responses mean that consumers are willing to take risks when it comes to their security and privacy, but are quick to blame the business if something goes amiss.
The greater problem here is that pointing fingers does nothing to confront the real challenges of privacy and security. While government regulations and data breach disclosure laws hold companies responsible for protecting data, consumers need to take advantage of current ways to protect themselves.
Even small steps can help the consumer take control of their own security. Enabling two-factor authentication, avoiding temptation when sharing life details on social media, and using strong passwords are all simple steps — but consumers must be willing to take the hit to convenience to leverage them.
How to protect customer data
-
Stay up-to-date on encryption
Encryption technologies are constantly evolving to meet changes in the threat landscape. Organizations that aren’t reviewing and updating their encryption practices are often left vulnerable to cyberattacks. Work with your IT security team to establish a regular audit schedule to see if your encryption technology and practices are as current as possible.
-
Limit access to customer information
Least privilege access is not just a concept for admin and user roles. Not everyone in your MSP or a client’s organization needs access to customers’ personal information. By limiting access to those with a genuine need, you reduce opportunities for hackers to find and exploit a weakness. This also reduces the threat of human error or deliberate theft of customer information by insiders.
-
Use password management tools
Passwords are still a key component of security, even though they often seem trivial compared to the tools available. One of those tools that brings strong passwords back into the forefront is a password management application. They create and store complex passwords for all of the accounts your clients access, encrypting and storing each password so that end users need only remember one master password. Because credentials have become such a weak point for cyberattacks, password management should be a mandatory addition to every MSP’s security stack.
-
Collect only necessary data
It can be tempting to collect as much data as possible “just in case”, but doing so can quickly lead to problems. Collecting unnecessary customer data means not only wasted energy and resources, but also makes your data more rich and enticing for hackers. Collect only what you need for defined business purposes. To put consumers and end users at ease, you can also offer them the option of opting out of sharing personal information.
-
Consider destroying data after you’ve used it
Stored data is a potential risk. While some customer data needs to be stored in perpetuity, that’s not the case for all data. Consider destroying customer data after you’ve made best of use it rather than holding it and bearing the additional security burden.
-
Make customer privacy everyone’s business
A comprehensive security program and privacy policy should be created and adopted by everyone in your organization. Every stakeholder needs to understand the importance of customer data protection and, more importantly, adhere to your policies. The same tack should be taken towards your end users and their involvement in the overall security process.
-
Let customers know their information is safe
Privacy is a true concern for the public, so letting customers know exactly what you’re doing to keep their PII safe is beneficial to everyone. Be straight and to the point with your disclosure of security practices. Hiding the details of your customer data protection methods in a privacy statement that no one actually reads won’t cut it. Openly sharing your commitment to privacy is a far better option and can ultimately help your company’s reputation and build trust.
Conclusion
Data is the new currency of cybercrime, and ignoring customer data security is no longer an option for organizations of any size. Hackers have become lethally efficient in deceiving companies through social engineering and other attacks, and no business wants to go through the stress of reaching out to customers to disclose a data breach. Breaches that involve customer data can destroy trust and lead to years of costly legal, regulatory, and reputational consequences.
The best approach to protecting customer data is an active approach to cybersecurity. That said, there are no one-size-fits-all solutions so the exact tools and methods will vary for each organization. The tips and information above should get you started and help you on your own journey to protect your customers’ data.
