Personally identifiable information (PII) is any information that can be used to identify, contact, or locate an individual, such as name, address, phone number, email, social security number, etc1. PII is subject to various laws and regulations that aim to protect the privacy and security of individuals’data1. Organizations that collect, store, process, or transmit PII have a responsibility to safeguard it from unauthorized access, use, disclosure, modification, or destruction1.
One of the best practices for protecting PII is to implement access controls, which are mechanisms that restrict access to PII based on the principle of least privilege2. Access controls ensure that only authorized personnel who have a legitimate need to access PII can do so, and that they can only perform the actions that are necessary for their roles and responsibilities2. Access controls can be implemented at different levels, such as network, system, application, or data level, and can use various methods, such as passwords, tokens, biometrics, encryption, etc2.
If an organization’s shared drive contains PII that can be accessed by all personnel, this poses a high risk of data breach, theft, loss, or misuse, which could result in legal, financial, reputational, or operational consequences for the organization and the individuals whose data is compromised3. Therefore, the most effective risk response is to protect the sensitive information with access controls, such as:
Classify the PII according to its sensitivity and impact level, and assign appropriate labels and permissions to the data files and folders2.
Restrict access to the shared drive to only those personnel who have a valid business reason to access the PII, and grant them the minimum level of access required to perform their tasks2.
Implement strong authentication and authorization mechanisms, such as multifactor authentication, role-based access control, or attribute-based access control, to verify the identity and privileges of the users who access the shared drive2.
Encrypt the PII stored on the shared drive, and use secure protocols and channels to transmit the data over the network2.
Monitor and audit the access and activities on the shared drive, and generate logs and reports to detect and respond to any unauthorized or anomalous events2.
The other options are not as effective as access controls, because they do not directly address the root cause of the risk, which is the lack of access restrictions on the shared drive. Implementing a data loss prevention (DLP) solution, which is a tool that monitors and prevents the leakage of sensitive data, may help to detect and block some unauthorized data transfers, but it does not prevent unauthorized access or viewing of the PII on the shared drive4. Re-communicating the data protection policy, which is a document that defines the rules and responsibilities for handling PII, may help to raise awareness and compliance among the personnel, but it does not enforce or verify the actual implementation of the policy. Implementing a data encryption solution, which is a technique that transforms the PII into an unreadable format, may helpto protect the confidentiality of the data, but it does not prevent unauthorized access or modification of the data, and it may introduce additional complexity and overhead to the data management process.
References = Guide to Protecting the Confidentiality of Personally Identifiable Information (PII), Best Practices for Protecting PII, How to Secure Personally Identifiable Information against Loss or Compromise, Data Loss Prevention (DLP) | Microsoft 365 security, [Protecting Personal Information: A Guide for Business], [Encryption - Wikipedia]
