>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened.
The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy.
For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns.
Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA.
>What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection?
* Keep it offline/airgapped.
* Store the most dangerous data on paper with hashes replicated online to insure integrity.
* Delete information you don't need anymore.
* Do not have a centralized repository of data to reduce risk of catastrophic exposure.
There are always trade offs between usability, functionality and security.
[1]: https://twitter.com/ethan_heilman/status/510993743156375552
[2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses
The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy.
For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns.
Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA.
>What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection?
* Keep it offline/airgapped.
* Store the most dangerous data on paper with hashes replicated online to insure integrity.
* Delete information you don't need anymore.
* Do not have a centralized repository of data to reduce risk of catastrophic exposure.
There are always trade offs between usability, functionality and security.
[1]: https://twitter.com/ethan_heilman/status/510993743156375552
[2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses