WinZip Enterprise Blog

Protecting the world's most sensitive data for over 30 years.

Blog Home > WinZip Blog

WinZip Blog

Do you have the right data backup solution in place?

Every organization relies on the data it collects and generates to track key metrics and make important decisions to propel business growth.

Client information, internal human-resources documents, and intellectual property are all housed on an organization’s hard drives and servers, in the cloud through a hosting provider, or through a combination of both.

If that data is lost or destroyed, companies can face a host of negative consequences.

While most organizations understand the importance of having a data backup and recovery plan, many continue to keep data backup servers on site, saved to a hard drive, or on other hardware storage devices.

Heavily regulated industries that handle sensitive data have typically relied on on-premises IT personnel to back up data and manage storage plans.

For example, some healthcare organizations spend as much as 64% of their IT budgets on local data backup hardware and the technician hours required to back up their data manually.

The world of finance and insurance is subject to national and industry regulations, and many institutions have clung to traditional backup architecture due to concerns about third-party data storage.

While cloud providers have responded to this concern by investing in controls to meet regulatory compliance and security requirements for highly sensitive data, many companies still use on-premises solutions.

Why data backup solutions are so vital

Backing up files creates a copy of data for easy retrieval in the event of data loss. This ensures that file corruption, user error, system failures, and other causes of data loss do not compromise an organization’s data security.

Many on-premises solutions may not provide automatic cloud backup options, which can increase the risk of losing sensitive business data for good.

Without the right data backup solution in place, your files and information could be rendered inaccessible. Storing data copies in more than one format and location ensures operational recovery in the event of primary data loss or corruption.

The following scenarios highlight the importance of using separate systems and locations in the event of data failure.

Natural disasters

With the increasing occurrence of natural disasters, provisions for data protection are more important than ever. For example, Hurricane Harvey forced staff to leave medical records behind when they evacuated medical patients.

Fires, earthquakes, and tornadoes can all leave an organization reeling. If the primary data’s storage location is damaged or destroyed by a natural disaster, the recovery process is next to impossible without remote backup solutions.

Data Breaches

Companies must be uncompromising when it comes to the security of their backup files. Data breaches surged by 38% in the second quarter of 2021, and that number is expected to increase. Without secure file backups, the cost of data loss may be more than some companies can handle.

Over half of companies that experience data loss go out of business within six months, and those that stay in business pay, on average, over $4 million to recover from a loss.

In addition, downtime caused by data loss impacts a company’s profitability, with just an hour of downtime costing larger enterprises around $700,000.

Organizations that implement off-site, automatic data backup solutions that encrypt data at the file level can minimize their risk of loss.

If a disgruntled employee leaves company property with a hard drive, a simple restoration from cloud storage can retrieve the data. If a hacker steals millions of encrypted files, an automatically backed up database will be able to restore the data.

It’s important to note that while automatic backup provides a copy of the data, any stolen data itself is still vulnerable. To keep data from being misused, organizations should also incorporate file point security solutions. This allows IT administrators to remotely wipe or destroy data on a device that has been lost, stolen, or otherwise compromised.

Physical access restrictions

If the COVID-19 pandemic taught businesses anything, it is that they cannot rely on employees having physical access to on-site data.

As social distancing and quarantine restrictions were put into place, companies had to scramble to find remote work solutions for their employees so they could still access their data from outside of the office.

According to a recent report, organizations that shifted to remote work without implementing enhanced data security measures took longer to identify and contain breaches.

With the increased application and popularity of remote work options, IT administrators must consider how to back up and protect data stored on personnel’s devices, including their home computers or mobile devices.

Questions to ask when evaluating data backup solutions

Having the right data backup solution is a key element of any business continuity strategy. While there are numerous methods available for avoiding data loss, no solution is one-size-fits-all. When reviewing backup types, keep the following considerations in mind.

1. What is the backup method?

There are three primary methods of data backup: full, incremental, and differential.

  • A full backup makes a copy of all existing data files. While this method is the most comprehensive and yields the fastest recovery time, it consumes the most storage space and has the slowest backup time of any method.
  • A differential backup backs up only files that have been added or edited since the original full backup. This method has moderate storage space requirements, a moderate backup speed, and a moderate restoration speed when compared with the other methods.
  • An incremental backup copies only the data added or edited since the last backup. This method yields the fastest backup speed, requires the least storage space, and has the slowest restoration time of any method.

2. Will administrators and employees use the solution?

Ease of use directly correlates to how quickly employees adopt a solution. The right backup solution will be easily accessible, whether personnel are in the office or working remotely.

If the steps to back up files are too complex or time-consuming, employees may not follow them on a regular basis. A solution that enables automatic backups can solve this problem, ensuring that data is backed up on a set schedule.

Look for file backup processes that are comprehensive and able to scale to meet changing data volume requirements. The solution should offer multiple types of backups, including local, on-premises storage, and cloud backup options.

This hybrid approach to storing backup files gives organizations the enhanced speed and control of local backups combined with the flexibility and scalability of cloud backups.

3. Does the backup environment allow for encryption?

Data encryption restricts access to an organization’s files, information, and other valuable data. This added layer of protection ensures that only authorized users can restore lost, damaged, or stolen data.

There are various options when it comes to creating encrypted backups, and finding the best method depends on factors such as the types of backup files, storage environments, and applicable industry or regulatory requirements.

The two primary forms of data encryption are full-disk and file-based encryption.

  • File-level encryption goes beyond the whole disk to encrypt individual files and directories. An encrypted file can only be accessed by authorized individuals, which makes file-based encryption an important component of secure file sharing.

WinZip Enterprise provides secure, customizable data backup

Regardless of company size or industry, every organization needs data backup to protect sensitive and valuable information. WinZip® Enterprise enhances system security with bank- and military-grade encryption and automatic file backup capabilities.

This solution also has the added benefit of data compression, ensuring that you can fit more files in your backup storage, which can help reduce data storage costs.

WinZip Enterprise offers a host of exclusive, enterprise-level features including cloud storage integration, SharePoint integration, support for virtual drive files, and more. Its best-in-class encryption capabilities protect sensitive data, making it the trusted choice for over 100,000 businesses worldwide.

Featuring native integration with leading cloud storage providers, WinZip Enterprise makes it easy to manage, encrypt, and share data across common cloud storage services and communication platforms, including Box, Dropbox, Google Drive, and Microsoft Teams.

It also enables IT administrators to control access to cloud services and social media, which helps prevent users from sharing files on or through unauthorized platforms.

WinZip Enterprise ensures compliance with your organization’s security standards, backed by IT access controls such as password policies and encryption requirements for all users.

It’s also a highly customizable solution, allowing IT administrators to enable only those features that support your business objectives and prevent access to restricted functionalities. This simplifies security management processes for IT teams, giving them full control over your organization’s data and file sharing environment.

Learn more about the benefits of WinZip Enterprise for your business.

The importance of file security in today’s mobile business world

Data security is a necessity within today’s digital, distributed workplaces, especially when sharing information between multiple employees across multiple locations.

Since the 2020 outbreak of COVID-19 prompted a global increase in remote work, 71% of IT security professionals have reported an increase in data security breaches.

A good data protection plan should help businesses ensure continuity, avoid data breaches, and prevent unauthorized access to your company’s information and systems. This is especially important given that an estimated 28% of employees are using personal devices and unsecured networks to access company data.

Although most companies have some sort of data protection plan in place, many are aimed only at overall database, network, or endpoint security.

These are key points in a comprehensive data protection plan, but once an individual gains access to the network or device, the person has access to all the information stored therein.

This increases the risk of data access by unauthorized parties, such as an employee accessing information not relevant to their job or a malicious party stealing company data.

That’s where file-level security comes into play. File security is a subset of data security that focuses on each file within a company data inventory. Rather than granting full access to an entire database at once, every individual file is protected, making it much more difficult for would-be malicious parties to gain access to the actual information.

Think of it as a treasure chest that, when unlocked, reveals thousands of tiny, locked chests inside. In order to access the real treasure, there’s a lot more work to be done!

Healthcare, banking, and government rely on file security

Healthcare, government, and financial institutions handle some of the most sensitive data in the world. Account records, health data, social security numbers and more can fall into the wrong hands via a cyberattack. If only database protection is present, all that information can be instantly accessible to anyone who gains access to your system.

In early 2020, Magellan Health Services was the victim of a data breach wherein an unauthorized party accessed 654,000 patient records via malware that stole employee credentials. Although the attack gained access only to a single server, the attackers stole hundreds of thousands of records and threatened victims with ransomware.

Passwords and logins are not enough to keep cyberattacks at bay. Companies must employ both network and file security methods to ensure that their data is as safe as it can be.

In addition, the more control a business has over the way their data is shared, the easier it is to track the source if an attack does occur. Security event logs record each instance of things like logging in and out, opening or sharing files, etc., allowing you to review exactly who accessed compromised data when the incident occurred.

The impact of remote work on file security

With the rise of remote and hybrid work environments, the need for data protection is at an all-time high. Not only is it necessary to secure in-house servers that store sensitive information, but companies must also protect that information as it moves from place to place—often in uncontrolled and unsecured environments.

As the lines between work and home continue to blur, bring your own device (BYOD) culture is growing. An increasing number of employees are accessing company email accounts, attending meetings, and downloading work files on personal computers, tablets, and mobile phones.

While this practice is extremely convenient for end users, it’s a growing security concern for IT teams. One report suggests that up to 50% of companies that have allowed BYOD in their workplace have experienced some sort of data breach.

Not only do personal devices tend to have fewer security measures in place, but lost devices are a goldmine for hackers and other malicious parties, as the personal data on them can be sold on the dark web for a hefty profit.

Three methods to increase file security

Now that you know why implementing file security measures is so important, let’s explore three methods you can use to better protect sensitive files.

1. Require strong passwords and passphrases

Most businesses use passwords to protect different applications, files, and locations within their systems. To ensure data security, these passwords must often meet complexity requirements, such as being a certain length or using a variety of characters.

For example, if a user’s password is “P@s$W0rD”, they are using common substitutions to increase the complexity (i.e., a mix of lowercase and capital letters, special characters, and numbers).

This seems like a great idea at face value, but what happens when users can’t recall which letters they substituted? Strong, frequently changed passwords are easily forgotten, which leads to the reuse of easy-to-recall passwords across multiple locations and platforms.

Passwords are also one of the easiest forms of security to hack, allowing malicious parties to quickly breach your system.

Some companies have moved toward passphrases in lieu of the traditional password. A passphrase is a sentence or series of words rather than an assortment of random characters. Many users find passphrases easier to remember than passwords, and malicious parties find them more difficult to hack.

In addition, passphrases can require the same complexity requirements as passwords, such as using numbers or special characters.

2. Purge old and redundant files

Getting rid of old data is just as important as protecting new data. Not only does this process optimize your storage capabilities, but deleting old data prevents confusion and redundancy when dealing with multiple versions of one file.

If there are several similar editions of the same document floating around, users are more likely to send or grant access to an incorrect or outdated version.

In addition to compromising file security, this can disrupt workflows and productivity as file versions are sorted out and merged into the most current version.

3. Implement file-level encryption

One of the most intricate and effective methods of file protection is encryption. With this method, each individual file is uniquely encrypted, granting access only to individuals with the correct decryption key. This allows a company to control access to files based on the needs and role of each particular user.

Allowing a user access to only the necessary information is called the Principle of Least Privilege, or POLP, which suggests that any user, program, or process should have only the bare minimum privileges necessary to operate.

Not only does this principle allow you to trim down access to your most sensitive data, but it also allows businesses to detect exactly where and when data was compromised if a breach occurs.

Maintaining such a granular level of control is especially important considering that 60% of data breaches are set in motion by company insiders.

Unlike database or network security, file-level encryption is not a one-time setup. This level of protection requires constant monitoring and updates to ensure that the correct users have access to the correct files as the day-to-day operations change.

WinZip Enterprise enables file protection

While file encryption is the most effective protection against data breaches, it can be costly and complicated. As a result, many companies avoid implementing these more thorough security measures because they feel the hassle is not worth the payoff.

WinZip® Enterprise is a modern, streamlined solution that allows your business to go beyond standard data protection to safely guard your files, ensuring each and every piece of data is protected. This solution features extensive file- security capabilities to protect your data throughout transit, use, and idle storage.

WinZip Enterprise features a simple encryption process, allowing you to keep security protocols up to date as your business grows and evolves and employees move into and out of roles.

Rather than allowing free movement throughout the entire network, IT administrators can easily maintain POLP and track exactly where and when data is accessed.

This solution also saves time and bandwidth by allowing users to compress their files while encrypting them, which provides the added benefit of saving money on storage space.

And for an extra layer of security, you can even add password protection to your encrypted ZIP files. By combining these data security tactics, you can be assured that your files are fully secure with WinZip Enterprise.

Learn more about the benefits of WinZip Enterprise for file security.

Top five data protection measures to keep sensitive data safe

What do you do if sensitive data is lost or corrupted? How do you keep important information safe? Malicious parties can profit greatly from ill-gotten data, and they can cost companies a fortune.

On average, data breaches cost companies over $4 million per incident, and 2021 has seen the highest average cost of data breaches in the past 17 years.

Data protection secures digital information through processes such as backups, replication, archiving, and data retention strategies. By storing backup data copies in a safe location, companies can be assured that their sensitive data is protected and available under all circumstances.

Without data protection, organizations cannot recover clean data copies in the aftermath of an unauthorized access event that compromises, corrupts, or deletes data.

Why data protection is more important than ever

Today’s workforce has seen a sharp increase in remote and hybrid work environments, with 55% of businesses worldwide offering some capacity for remote work. While remote/hybrid work offers numerous benefits for employers and employees, it also increases cybersecurity risks.

Individuals working off-site may be using multiple devices and operating systems, connecting to public Wi-Fi, and accessing sensitive data remotely on unsecured networks.

This new normal of remote and hybrid work makes data protection crucial for data integrity and regulatory compliance. The very act of transmitting information invites all manner of cyberattacks, so any organization that handles, collects, or stores sensitive data needs a comprehensive data protection strategy.

Businesses must ensure data can be restored quickly after a disruption or loss, especially when it comes to extremely sensitive data such as health records, financial data, and government information. When it comes to protecting critical information, here are some of the top data- protection measures to keep sensitive data safe.

1. Know the risks

Which businesses are most at risk for a data breach? Government, healthcare, and finance organizations are entrusted with the most sensitive data, so they are often the target of cyberattacks. In a recent survey, 47% of US federal government respondents reported that they had been the victim of a data breach within the last 12 months.

Healthcare companies are also targeted due to the personal records kept on every single patient. Billing and medical history, health surveys, and more are prime sources for would-be malicious parties. In the past year, more than 40 million healthcare records have been exposed via data breaches.

Finance is another sector that experiences a high potential for cyberattacks and data breaches. Of course, malicious parties want access to monetary assets, so financial corporations should always be on high alert.

In 2020, 70% of financial organizations reported some type of cyberattack. In fact, 27% of all attacks that year were carried out on healthcare and financial organizations.

2. Go beyond basic backups

Hackers and other malicious parties are constantly improving their tactics, so the old habit of a single weekly backup won’t be enough to ensure your data is safe. Fortunately, data protection strategies have kept pace, which means there are more ways than ever to protect your information.

  • Cloning: Cloning makes an exact replica of a device’s operating system, including drives, software, and patches. This allows a company to set up multiple devices with the exact same interface, which saves time and reduces the chance of error when setting up multiple user systems. With a clone, IT administrators can load each device with the cloned system, granting access instantaneously to the approved applications and programs.
  • Data mirroring: Data mirroring replicates the exact same changes or updates across multiple databases in separate locations. If the primary database is compromised, a mirrored database becomes the primary, ensuring operations continue uninterrupted.
  • Replication: Replication operates on files and data instead of entire databases. Accessing a replica of a specific file allows multiple users to view and edit data on a host server without granting access to the entire database. This is especially useful for sensitive, high-level information with access limitations.
  • Snapshots: Snapshots are like mini backups and are stored only on the device they are meant to protect. If the system is compromised, a snapshot serves as a starting point for system recovery. When a new snapshot is captured, it overwrites previous data images to minimize the bandwidth needed for access and storage.

3. Retain multiple copies in multiple locations

When backing up your data, it may seem like a good idea to store everything on an on-site server. Theoretically, this minimizes the time it takes to access the data during a failure and allows easy physical access for authorized users when maintenance is necessary.

However, to best protect your company’s sensitive data, you should follow the 3-2-1 rule, which recommends you have three copies of all data on at least two forms of media, with at least one backup at an off-site storage location.

Maintaining three copies of your data is easy considering today’s plethora of data storage options. It might be advantageous to house a second, physical server in an off-site location containing exact copies of the primary data via the mirroring process.

For ease of access, sharing, and remote work, your business may benefit from storing another copy in the cloud. This particular strategy also covers the part of the 3-2-1 rule that suggests two separate forms of media.

But how do you determine the location for your off-site backup? Experts recommend enacting an air gap, meaning that the data is stored in a separate physical location, disconnected from the internet. This method renders it inaccessible unless a user physically enters the storage location, which is much more difficult for malicious parties to do.

However, with the increase in remote and hybrid work, along with the speed of data generation, many companies choose to have their off-site server connected to the internet for easy recovery. If you go this route, it is important to ensure that the backup is on a different power grid and on an entirely different network than your primary data.

4. Implement continuous data protection strategies

The frequency of your data backups will depend largely on your company’s operations. Most government, financial, and healthcare companies back up their data every few hours because of the massive amounts of data being generated and manipulated every second.

In an effort to keep up with the ever-growing population and their information, many companies are implementing CDP, or continuous data protection.

In data protection terms, the time between backups is knowns as the Recover Point Objective, or RPO. Recovery Time Objective, or RTO, is the amount of time it takes to restore data after an attack or disaster.

A longer RPO leads to a longer RTO because there is more data that has not been backed up. In other words, the more often you back up your data, the closer your restored setup will be to the point in time of data loss. And the less work your employees must redo manually, the quicker the business will be up and running again.

To reduce both RPO and RTO as well as user frustration in the event of a breach, more businesses have made a move toward CDP, which ensures that data is backed up every time a change is made, resulting in minimal loss and a very short RTO. CDP can be implemented for all types of data, from a single file to an entire database.

Although CDP contains a snapshot of the entire information set at any given point, it does not replicate every piece for every backup. When a CDP system is installed, it takes a snapshot of the system as it is, providing a starting point, or ground zero, for each subsequent backup. With specialized code, the system can detect the location of a change and collect only the new data, using the most recent snapshot for all but the updated information.

In this fashion, backups take much less time and bandwidth, allowing nearly real-time updates to your stored files. Users are happy with CDP because they can typically pick up where they left off after a system interruption, and IT professionals embrace this method because of the ease and speed of a recovery effort.

5. Focus on straightforward solutions

The two sides of the data protection coin are management and availability. Up until now, this article has focused on data management methods, including backups, snapshots, and preventing data breaches. However, availability is just as important, because if no one can access the data, what is the point of storing it?

It is important to note that availability also refers to ease of access. In other words, data should be secure without forcing employees to jump through hoops (e.g., multiple logins, complex interfaces) to access it, which can slow productivity.

Easy operation allows for fewer user errors that could lead to accidental data loss or compromise. In addition, a complex user experience could lead to employees bypassing or disregarding data protection policies to reduce frustration.

When IT teams can customize access requirements, it creates a sort of “perimeter” within which employees can access and share data safely. Customizable access provisions enhance data security, eliminating the risk of exposing valuable information to a breach.

How WinZip Enterprise helps protect your data

WinZip® Enterprise features customizable access for employees at every level in your company. It’s easy to tailor data availability to each position or department, and you can update access at any time—ensuring that employees who change roles or leave the company have their data access privileges updated immediately.

WinZip Enterprise offers bank- and military-grade encryption, protecting data in transit and at rest. This enhanced level of security is compliant with all major standards, including Federal Information Processing Standard (FIPS) 140-2 and FIPS 197. It also prevents data loss and extends corporate file protection with Windows Information Protection (WIP) support.

WinZip Enterprise also allows you to schedule data backups from the in-program Explorer menu and is compatible with some of the most-used cloud applications on the market, including Amazon S3, Alibaba Cloud, Microsoft Azure, and more.

Ready to simplify your data protection processes with a powerful, customizable solution?

Learn more about WinZip Enterprise’s complete feature set to secure and manage your files and data.

What is FIPS 140-2 encryption, and why is it important?

Encryption is a vital element for protecting sensitive business data, but encryption that meets Federal Information Processing Standards (FIPS) brings your security to a whole new level.

FIPS identifies security requirements for cryptographic modules, which are the hardware, software, and/or firmware programs that execute security functions.

When it comes to encrypting information, there is no single standard way of transforming clear text into ciphertext. Methods and algorithms vary, and not all encryption processes are equally effective.

While many private sector businesses can use whatever encryption scheme works best for them, certain organizations, such as the US Federal Government, require the non-military agencies it works with to meet FIPS 140-2.

What is FIPS 140-2?

Developed by the National Institute of Standards and Technology (NIST), F

IPS 140-2 identifies security requirements for cryptographic modules and ensures that the government’s sensitive information is protected.

FIPS 140-2 has four levels of security, with the higher levels providing more robust protection features than lower ones:

  • Level 1 has the simplest requirements, such as using a tested encryption algorithm and using production-grade equipment.
  • Level 2 factors in physical security protections, requiring role-based authentication and tamper-evident technology, such as seals and pick-resistant locks. Cryptographic modules must be run in an evaluated operating system environment.
  • Level 3 is the most common level of organizational compliance because it balances security with ease of use. It takes the requirements of levels one and two and adds additional physical securities, such as tamper-resistant devices, strong module enclosures, and the separation of ports or interfaces to protect components from unauthorized actions.
  • Level 4 provides the highest level of security, requiring a trusted operating system environment and enhanced physical security mechanisms.

What is FIPS 140-2 encryption used for?

FIPS 140-2 security requirements apply to sensitive but unclassified (SBU) information. Federal law defines SBU material as information that is not classified for reasons of national security but that merits protection from unauthorized or public disclosure for other reasons.

Examples of sensitive but unclassified information include:

  • Personal information about employees (e.g., payroll information, medical records).
  • Confidential business information (e.g., trade secrets, contractor proposals).
  • Protected health information (PHI).
  • Personally identifiable information (PII).
  • Law enforcement information.
  • Privileged attorney-client communications.
  • Material identified as For Official Use Only (FOUO).

What organizations require FIPS 140-2 compliance?

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop and implement information security and protection programs based on key security standards and guidelines.

FISMA requirements, including FIPS 140-2 validation, also apply to any private organizations or individuals involved in a contractual relationship with the US government.

In addition to federal agencies, many state and local governmental bodies use FIPS 140-2 to protect sensitive data. For example, state agencies that administer federal programs (e.g., Medicare, Medicaid, or unemployment insurance) must comply with FISMA’s mandates.

In general, any company that handles private customer data benefits from FIPS 140-2 compliancy.

Organizations in the private sector can also use FIPS 140-2 to strengthen their data protection programs. This is especially important for industries that are subject to federal regulations governing data security. These non-governmental organizations include, but are not limited to, healthcare, finance, merchants and service providers, and manufacturers.

Healthcare

The healthcare industry is tasked with safeguarding protected health information, or PHI. Modern technologies have changed the methods and platforms that providers and patients use to interact, but they must meet certain specifications for HIPAA compliance.

To protect sensitive healthcare data, the US Department of Health and Human Services (HHS) recommends using encryption processes that are FIPS 140-2 validated.

Banking and Finance

Banks and financial organizations collect and generate large volumes of personally identifiable information and nonpublic personal information (NPI). The Gramm-Leach-Bliley Act (GLBA) requires companies that provide financial or services to protect their customers’ sensitive data.

With institutional penalties for GLBA infractions running as high as $100,000 per violation, FIPS 140-2 encryption ensures that customer records and information are protected against potential threats.

Merchants and Service Providers

Any entity that handles payment card data must comply with the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS stipulates that companies that process, store, or transmit payment card data must encrypt the data both at rest and in transit. Failure to do so can result in fines and penalties.

Manufacturing and Product Testing

Devices that process and receive electronic data use encryption to keep the information secure. Manufacturers and testers of electronic devices must remain in compliance with industry standards to address and prevent security vulnerabilities.

To streamline this process, NIST requires any product that adheres to the international standard use FIPS-compliant encryption.

Why is FIPS 140-2 important?

Data encryption is a key element of an organization’s data security strategy. In addition to adhering to applicable laws and regulations, FIPS 140-2 encryption ensures that consumer data won’t be compromised in the event of a breach.

FIPS 140-2 compliance ensures a high degree of system security, which is critical in the protection of sensitive but unclassified information. Obtaining FIPS 140-2 validation demonstrates that the technology has passed rigorous testing with an accredited lab, ensuring that the product can be used to protect sensitive information.

The FISMA mandates that vendors must satisfy FIPS 140-2 requirements in order to sell their solutions to the government. Non-compliance with FISMA security standards puts agencies and organizations at an increased risk of system vulnerabilities that could compromise their sensitive but unclassified data.

Government agencies—or the associated private companies or contractors they work with—may face a range of penalties for failing to comply with the FISMA, such as reputation damage, congressional censure, or a reduction in funding.

WinZip Enterprise offers FIPS 140-2 compliant security

WinZip® Enterprise shares and stores files securely using an Advanced Encryption Standard (AES) format. This symmetric key is a FIPS 140-2 complaint algorithm. As part of the compliance process, WinZip Enterprise uses FIPS-enabled computers to ensure files are protected in transit and at rest.

Thanks to the strongest layer of FIPS 140-2 encryption, WinZip Enterprise helps safeguard data and ensures that companies meet federal requirements for data protection and encryption.

Fully compatible with leading services like Dropbox, SharePoint, and Google Drive, WinZip Enterprise also makes it easy for end users to share files securely across storage providers, and it is backed by military-grade encryption.

Learn more about how WinZip Enterprise protects your data with FIPS 140-2 encryption.

Three common data security mistakes companies make, and how to avoid them

Nearly every company in the world has a need for data security and privacy, whether they store customer payment information in a profile for future use or develop groundbreaking ideas that could change the future of commerce. But due to the sensitive nature of this data, organizations must be sure that it is well-protected.

Security is an increasingly difficult challenge as more and more of the workforce transitions into digital and remote roles.

What was once a physical packet of paper carried from one cubicle to another is now digitally stored and transferred across states or even continents from one employee to another, presenting countless opportunities for hackers and other cyber criminals to infiltrate.

The higher volume of consumer, client, and employee data that organizations store and handle today places them at an increased risk for data breaches and other security concerns.

Companies are rapidly adopting complex computing environments to meet operational needs, which can include cloud infrastructure, data centers, and numerous devices and operating systems.

This complexity can hinder security, which means organizations must develop strong data governance strategies to better manage how data is stored, shared, and processed.

Many companies use the terms “data protection” and “data security” interchangeably, but they’re distinct components, and each plays a unique role in ensuring an organization’s data integrity.

Neither data security nor data protection is enough on its own; each company must have a comprehensive plan in place for both to ensure that data is neither lost nor accessed by the wrong people.

So, what exactly is the difference between data security and protection, and how can they work together to safeguard company data? Let’s take a closer look.

What is data protection?

Data protection is a method of keeping records safe from loss, corruption, or compromise using backup copies. Each company sets a recovery point objective (RPO), to determine how often backups are created. This can vary from a few hours to several days, depending on the amount of information a company needs to protect.

If information is compromised, the data can be retrieved from the most recent backup with minimal data loss and redundant work.

The timeframe within which a company must restore the most recent backup after compromise is the recovery time objective (RTO). This is a metric that identifies how long a computer system, application, or network can be down before it disrupts business operations.

For example, if a particular application has a one-hour RTO, the interruption will disrupt normal operations and contribute to revenue loss after an hour of downtime.

Mission-critical applications, such as transactional or financial services, will have the lowest RTO because they correlate directly to lost revenue.

Systems that are used infrequently or whose downtime will not disrupt day-to-day operations will have a longer RTO. For example, while an offline printer is inconvenient, it won’t incur the same level of financial loss as a financial service outage or disrupted email access.

What is data security?

Data security, on the other hand, focuses on confidentiality, availability, and integrity. The goal is to ensure that no unauthorized users gain access to or distribute confidential information. There are several data security methods a company can use to ensure that its information is safe.

One of the most common data security measures is encryption. Encryption essentially puts a company’s data into a coded format, allowing only authorized users to view the decoded information. A security algorithm, or key, is used to encrypt data, creating ciphertext.

In symmetrical encryption, the same key is then used by an approved party to decrypt the data into plaintext. In asymmetrical encryption, a different key is used to decrypt, creating an additional layer of security against would-be hackers.

Another example of data security is multi-factor authentication (MFA). Typically, this method requires a standard username and password setup, but with an additional layer of identity verification.

This might be in the form of sending a randomly generated code to a user’s personal cell phone or email address, which in theory should not be accessible to anyone but the intended user.

What are three common data security mistakes organizations make?

Poor access control, negligence, and other human error factors all contribute to data security risks. As varied as individual companies may be, they often make similar errors when it comes to data protection and security.

These errors can lead to hundreds of millions of dollars lost for a business along with heavy personal and financial consequences for the individuals affected. Let’s take a closer look at three of the most common data- security mistakes.

1. Not backing up data properly—or at all

Believe it or not, there are companies out there that do not duplicate their data for backup and have no data security policy at all. In 2018, a study found that 77% of business leaders surveyed did not have a consistent plan for cybersecurity.

Those companies that do have plans often find that they aren’t thorough or efficient enough, which allows threats to slip through the cracks. It is important to back up data often and completely to ensure easy recovery and minimal downtime for the business.

Some companies don’t consider all the factors when backing up their data. For example, simply having a server where data is stored is not enough. If that server is on the same property as the business, anyone with access to the grounds has some level of access to the data reserves, and if a fire or other site-wide disaster occurs, all the data can be lost.

Backing up data offsite or in the cloud is ideal, but that can require a large amount of bandwidth, especially for companies that deal with significant amounts of data. It is also important to vet the company entrusted with keeping your data safe.

In 2017, for example, voter information was compromised when a third-party security company accidentally stored names, addresses, political opinions, and more on a public server for nearly two weeks.

2. Not updating permissions as the company grows and changes

Data security management is key when keeping up with a fast-paced business. In the beginning, a smaller business might purchase or even build custom solutions for its data security needs.

The idea is to save money by building security features that are useful to the company in its current state, but this approach does not allow these measures to grow with the company.

Additionally, if a team member changes roles or leaves the company, it is important to restrict access to unnecessary server information immediately.

This cuts down on the potential for unauthorized access, either by that person or someone outside the corporation. The fewer people with access, the easier it is to track violations and risks.

According to ID Watchdog, 60% of data breaches are caused by insiders—people who either work directly for a company or are involved via contracting, partnerships, or client relationships.

Although not all these attacks were malicious at their onset (some were caused by well-meaning employees who were tricked), companies should try to monitor who has access to what information, and keep it updated based on the minimum level of access necessary for team members to perform their duties.

3. Using data security services that do not meet industry standards

While it may seem like a great, low-cost idea to have in-house developers design and implement a cyber security plan, such an important security feature should be thoroughly examined to ensure compliance with today’s data- security standards.

In 2002, the Federal Information Security Management Act was enacted, making it mandatory for federal agencies and their affiliates to have a data security plan that supports confidentiality, integrity, and availability of information.

In 2014, the act was updated and renamed the Federal Information Security Modernization Act (FISMA), streamlining the required security efforts.

In relation to FISMA, Federal Information Processing Standards (FIPS) were created. FIPS outline exactly what federal agencies must do to protect their data effectively. These regulations address cryptographic modules, hash algorithms, digital signatures, employee identification, and more.

There are specific regulations concerning access to healthcare information, outlined in Title II of the Health Insurance Portability and Accountability Act (HIPAA). These rules involve privacy, transactions and code sets, security, unique identifiers, and enforcement.

The US Department of Defense (DoD) also has its own set of regulations called the Defense Federal Acquisition Regulation Supplement (DFARS), and the National Institute of Standards and Technology (NIST) Cybersecurity Framework was created for critical infrastructure organizations, although it is adopted widely by noncritical entities.

While these rules and regulations were created for specific, high-level organizations, private businesses can benefit from following the same outline.

For example, one FIPS requirement states that companies must “identify, report, and correct … flaws within a timely manner.”

When Equifax failed to respond to a data concern in March of 2017, personal details of over 140 million people were leaked in an ongoing, months-long breach.

How WinZip Enterprise helps companies avoid common data security mistakes

WinZip has been a long-trusted name in personal data compression and transfer, but WinZip® Enterprise offers additional features, such as file-level encryption and protection of data at rest and in transit.

Encrypting at the file level provides an added layer of security, and the tried-and-true process WinZip Enterprise uses for zipping, sending, and unzipping data makes large transfers and frequent backups a breeze.

WinZip Enterprise also complies with all high-level security and encryption regulations, providing bank- and military-grade protection such as FIPS 140-2 validated encryption compliance (trusted for the DFARS) and FIPS 197.

The solution is fully customizable for IT administrators, so each business can select which features are applicable to its unique needs (e.g., which applications employees can use to send and share files), with custom billing plans to match.

Finally, WinZip Enterprise integrates with commonly used business applications, such as Google Drive, Microsoft 365, Microsoft Teams, and Dropbox, to make it easy for end users to collaborate safely and securely.

In today’s world of remote and mobile, distributed teams, it’s more important than ever to have a comprehensive security solution that secures your data regardless of where it’s stored or shared.

Learn how WinZip Enterprise can safeguard your company’s data today.

Learn more about WinZip Enterprise today!

Get a Quote

Connect With Us