Taking Control of Data: What Data Breaches Teach Us About True Cybersecurity, with Remko Hoekstra

The organizations that suffered major hacks were all ISO-certified. They had privacy statements, they underwent audits, they checked all the boxes. And yet, millions of documents were stolen. How is that possible?

Because an audit verifies whether a policy exists, not whether it works. If an auditor is granted access to dozens of separate systems, it is impossible for them to verify whether documents have actually been deleted after the agreed-upon retention period. That is not a failure on the auditor’s part; it is a structural problem. Information scattered across CRM systems, SharePoint, email, customer portals, and OneDrive cannot be managed centrally. And what you cannot manage centrally, you cannot demonstrably secure.

Social engineering was used in the recent major data breaches. An employee received a phone call from someone posing as IT support, was asked to provide a login code, and did so. Once inside, the attackers were able to download large amounts of information without setting off any alarms.

That’s when information management makes all the difference. Because the real problem wasn’t that someone got in, but that once inside, that person had unrestricted access to everything. No limits, no monitoring, no alarm. In a well-designed system, that wouldn’t have been possible.

Remko explains how Woodwing solved this from a technical standpoint. If you try to download more than 1,000 documents at once, the system automatically stops and triggers an alert. To access the documents at all, you need at least three different sets of login credentials. If you attempt to log in from an unusual location—for example, from abroad—the system blocks access before you can even do anything.

This isn't a luxury feature for large corporations. It's the minimum standard for any organization that manages sensitive information. And there are more of them than most executives realize.

A topic that rarely gets attention but is extremely relevant: retention periods. Some organizations are required to retain documents for 7 years. Others for 20 years. Sometimes even longer—and they must be demonstrably stored on Dutch soil.

Woodwing has been in operation since 1995 and can still display documents from more than 30 years ago in a readable format, with full traceability of what has been done with them. That may sound obvious, but try doing that with your current applications. Most systems simply aren’t built for that. A well-designed document management system ensures that, even 20 years from now, you’ll still be able to show what you did with a document today, who viewed it, and when it was deleted.

The discussion about digital sovereignty is no longer a theoretical debate. Organizations in the financial sector, the government, and housing associations are consciously choosing a private cloud solution hosted in the Netherlands—not because the public cloud is insecure, but because laws and regulations require them to consider where their information is stored and who, in theory, has access to it.

That’s a valid consideration. And more and more organizations are making that conscious choice before they’re forced to do so.

Remko concludes with practical advice that can be applied right away. Take a look at your application landscape: where do your employees store documents, and do you have a policy in place for that? Can the right people find those documents—and only the right people? And is the way you currently store and share information the safest way, or is it just the way it’s always been done?

Don’t start by choosing an application. Begin with your vision and your policies, and only then choose the technology that fits those. Because, as CEO, you are ultimately responsible for your organization’s information management. Not your IT vendor, not your software package. You.

Listen to the full podcast and learn more about how Remko and OneXillium take a practical approach to information security.