When organizations prepare to collect, analyze and secure data, they need to understand there two kinds of data: structured and unstructured data. Each presents different challenges — especially when it comes to data security. It is important to understand both concepts.
Differences Between Structured and Unstructured Data
It seems rather obvious that the difference between structured and unstructured data is structure — or organization. That’s not such a useful distinction though. There are a few important differences between the two types of data.
Data Access
Keep in mind that structured data is organized for machines to understand. Humans have a tough time reading and understanding structured data, but we use unstructured data to communicate. That human accessibility makes it difficult for machines and algorithms to access and analyze unstructured data.
Some technology has been developed that allows machines and algorithms to analyze unstructured data, although compared to the analysis of structured data, these solutions are relatively new. Analyzing unstructured data relies on aggregating all available data, identifying the data integral to the problem at hand, and conducting analysis to identify patterns and relationships.
Data Entry
Databases rely on a restrictive, structured data entry so the data matches the structure defined by the database schema. Machines can analyze structured data because only certain types of data are entered in defined fields.
Unstructured Data in an Internal Structure
Also, unstructured data may be stored within a file with an internal structure but it does not adhere to a pre-defined data schema or structure.
Vulnerabilities of Structured and Unstructured Data
Structured data stored in databases can be secured relatively easily. Access can be restricted according to strict guidelines. But unstructured data is spread throughout an organization – it exists anywhere users are accessing or creating content.
Because sensitive information can be comprised of unstructured data, it isn’t automatically identified and protected. This makes it harder to:
- Know this vulnerable data exists and where it is stored
- Identify who has access to unstructured data and is using it
- Track the flow of unstructured data through an audit trail
- Communicate how to manage and protect unstructured data
Content pattern matching technology can scan servers and workstations to classify unstructured data. But those solutions often result in false positives and negatives, which can have a negative impact on workflow.
Definition of Structured Data
Structured data usually is stored in relational databases and displayed in defined columns and rows. This allows data mining tools and algorithms to access and analyze it via search. Structured data can be used in:
- Airline reservation systems
- Inventory management systems
- Sales control and analysis
- ATM activity
- Customer relation management
Traditionally, business organizations relied on structured data to make decisions. There are many tools that support the collection and analysis of structured data to support business decisions.
Definition of Unstructured Data
Unstructured data is not organized but is stored in easily accessible and shared formats. Unstructured data can be found in:
- Emails
- Word processing documents.
- PDF files
- Image, audio and video files
- Social media posts
- Spreadsheets
- Mobile text messages
These formats make it easy to communicate information. Unfortunately, that ease also makes unstructured data vulnerable to unauthorized access.
Best Practices for Securing Structured Data
Securing structured data may seem simpler than securing unstructured data but that doesn’t mean it’s an insignificant effort. It is an important part of IT governance that starts with:
- Creating a secure, central storage for secure data
- Tracking data entry and usage
- Managing authentication and encrypted communication with Secure Socket Layer (SSL) protocol
- Protecting devices with secure passwords
- Using remote access to locate and wipe data from missing devices
- Training employees on policies and best practices
Best Practices for Securing Unstructured Data
Securing unstructured data presents different challenges than protecting structured data. It helps to start with the same best practices for securing structured data, but also includes:
Identify Unstructured Data at Point of Creation
Where is your unstructured data being generated and stored? Often, it’s coming from a structured data source. Data may be exported from a database into a shared document on the cloud or stored on a thumb drive. This strips away the protections from access controls and monitoring.
The security risk can be mitigated with secure data environments to store the unstructured data files.
Classify Unstructured Data
Not all unstructured data is sensitive or needs to be secured in a vault. Review what the unstructured data means to those who consume it and its sensitivity level. Sensitive unstructured data includes:
- Data that must be preserved for legal or regulatory reasons
- Proprietary data, i.e. intellectual property, banking details, or customer lists
- Personally identifiable information (PII) for customers and employees
Some unstructured data has high analytical value across the organization. If it is too hard to use, employees may use personal storage or cloud accounts to store data — making it less secure.
Assign an Owner to Sensitive, Unstructured Data
Find the people who are collecting and modifying unstructured data. Make them responsible for its security. If you don’t know who the owner is, many viewers of that data can identify its source — the owner.
The unstructured data owner is key to securing the data and maintaining it in a way that informs its consumers.
Identify Who Has Access to Structured and Unstructured Data
These people are key to securing control over who has access to control of data.
They also are capable to:
- Restrict who has access to sensitive sources of data.
- Manage how they access it from remote devices.
- Monitor user activity.
Structured and unstructured data are of equal importance to enterprises, yet many data protection efforts focus on securing structured data without taking adequate measures to protect the data that’s just as sensitive but often more challenging to secure: unstructured data. Today’s enterprises require robust data protection solutions that effectively secure all forms of data created, utilized, and maintained by the organization.
Guide: How to Protect Unstructured Sensitive Data
Discover how Digital Guardian manages unstructured data usage through enforcement controls such as blocking actions, silent alerting, automatic file/email encryption, user warnings, user prompting, and data masking.
