Dataturvallisuus

Dataturvallisuus, or data security, is the practice of protecting data from unauthorized access, disclosure, alteration, or destruction throughout its lifecycle. It aims to preserve confidentiality, integrity, and availability of information, often referred to as the CIA triad.

Data can be at rest, in transit, or in use; protection spans technical controls (encryption, access control, secure coding), organizational measures (policies, governance, training), and physical security. Proper data classification and handling rules guide risk-based protections.

Core controls include authentication and authorization, least-privilege access, and strong identity management; encryption for data at rest and in transit; secure configuration and patch management; backups and disaster recovery; data integrity checks; logging, monitoring, and incident response planning.

Governance and compliance: Organizations implement data protection policies, risk management processes, and user awareness programs. Legal frameworks such as the European Union's GDPR influence data processing, breach notification, data subject rights, and cross-border transfers.

Lifecycle management: Data creation, storage, usage, sharing, archiving, and disposal require safeguards to minimize exposure and ensure proper destruction when appropriate.

Standards and risk management: International standards such as ISO/IEC 27001 and the NIST Cybersecurity Framework provide structured approaches to risk assessment and control selection. Regular audits, vendor risk management, and security testing are common.

Challenges: Cloud adoption, remote work, and supply chain dependencies increase complexity. Balancing security with usability, privacy considerations, data minimization, and ongoing adaptation are ongoing aspects of dataturvallisuus.