THE VOLUME OF DATA handled in many organizations is tremendous. Organizations of any size can have millions of transactions occurring every day among customers, employees, and suppliers. Today, many systems are automated. They generate their own transactions in the form of online product queries, searches, inventory checks, authorization checks, and log entries. Tracking of product, pricing, invoicing, service calls, email, instant messages, support tickets, and order processing all require data. One touch of a keyboard generates potentially hundreds of transactions in today’s complex business environment. All of this information needs to be protected. Whether the data is stored at rest on a hard drive or in transit over the network, regardless of form or method of access, threats to the information must be considered.

Reports predict that over 40 zettabytes of data will be stored digitally worldwide by the end of the year 2020. A zettabyte is a unit of measure equivalent to 10²¹ bytes of data. In context, 42 zettabytes are equivalent to storing every word spoken by every human in history. In 2018, Forbes magazine reported that there are 2.5 quintillion bytes of data created each day.¹ A quintillion in U.S. units is 1,000,000,000,000,000,000. That is 2.5 exabytes per day. To give you some idea of scope, consider TABLE 4-1.

Table 4-1 should give you some concept of just how much data is being generated. All of that data requires some level of security. The precise level varies based on the nature of the data. The expanded use of social media, more widespread cloud and mobile computing, and the widespread adoption of smart devices and the Internet of Things (IoT) are a few of the factors contributing to this growth. Technologies just now being envisioned mean this growth trend will not stop in the foreseeable future.

The large accumulation of data is often referred to as Big Data. The global society is wired. Among the items going into the vast global store of data may be a tweet, a copy of an email, an Internet search, or a copy of a receipt from a retail store. This vast array of data is often unstructured, and for a market researcher or a government snoop, it may be a treasure trove of information that reveals a lot about an individual: his or her habits, interests, gender, associations, opinions, and much more.

What does this mean for business? It means new opportunities and new challenges. Businesses that understand how to mine this data will understand their customers’ needs. Companies that lose control over their data will put their customers and businesses at risk. This data is accumulated over years and is relatively static. Yet the law is not static. For example, as privacy laws change, what was once considered acceptable business use may now be illegal. Security policies must keep up with these ever-changing legal requirements or run the risk of exposing the business to legal penalties.

This chapter divides the IT environment into seven logical domains. Each domain represents a logical part of the technology infrastructure. You will follow the data through these seven domains to understand the business challenges of collecting, processing, and storing information. You will also consider the business, technical, and security policy challenges that affect organizations.