Prevent Data Breach 2026: 7 Controls That Work

Baseline Your System Before Implementing Controls

You can't tune what you don't measure. Before enabling any security control, capture baseline metrics for CPU usage, disk I/O latency, network throughput, and application response times under normal load. Run 'vmstat 1 10' to sample CPU and I/O, 'iostat -x 1 10' for detailed disk statistics, and 'iperf3' or curl timing tests for network and application performance.

Record peak traffic periods if your workload varies throughout the day. A marketing site might spike during business hours while a SaaS dashboard stays flat. Your baseline needs to reflect the busiest normal conditions, not idle overnight metrics.

Store these numbers somewhere accessible. A simple text file works. When you deploy a control and response times jump 40%, you'll need the before state to justify rolling back or tuning the implementation. In support tickets I handled, the usual problem was nobody remembered what normal looked like.

Encryption at Rest: Block File-Level Access

Encryption at rest protects data when an attacker gains file-system access through a compromised account, stolen backup, or physical drive theft. Without the encryption key, your database dumps and config files are unreadable.

On Linux, use LUKS with dm-crypt for full-disk encryption or encrypt specific partitions. During installation, most distributions offer an 'encrypt disk' option that sets up LUKS automatically. For existing systems, you'll need to migrate data to an encrypted volume, which requires downtime.

AES-256-XTS is the standard cipher. Check that your CPU supports AES-NI hardware acceleration with 'grep aes /proc/cpuinfo'. If the aes flag appears, encryption overhead drops from 30-40% to 5-15% because the CPU handles cipher operations in dedicated silicon instead of software loops.

The performance hit shows up in disk I/O latency. Reads slow by 10-20%, writes by 15-25%. For a database server doing 5,000 queries per second, that might push average query time from 15ms to 18ms. Acceptable for most workloads. If latency becomes a problem, upgrade to NVMe drives that include built-in encryption controllers, or offload encryption to a hardware security module.

• Use 'cryptsetup benchmark' to test cipher performance on your hardware before committing
• Set up automated key backup to a separate secure location; losing the key means permanent data loss
• Monitor CPU usage and disk latency for two weeks after enabling encryption to catch unexpected bottlenecks
• For cloud instances, check if your provider offers native encrypted volumes (EBS encryption on AWS, encrypted persistent disks on GCP) with lower overhead

Centralized Access Logging: Detect Lateral Movement

Access logs capture who did what and when. Authentication attempts, sudo commands, file modifications, and network connections all leave traces. When an attacker compromises one account and tries to escalate or move laterally, the logs show the pattern.

Configure auditd on Linux to monitor sensitive files and directories. A basic ruleset watches /etc/passwd, /etc/shadow, /etc/sudoers, and application directories like /var/www or /home. Add rules with 'auditctl -w /etc/passwd -p wa -k passwd_changes' or define them in /etc/audit/audit.rules for persistence across reboots.

Forward logs to a remote syslog server immediately. Use rsyslog or syslog-ng configured to send over TCP with TLS encryption so attackers can't tamper with evidence on the compromised host. The remote server needs enough storage for 30-90 days of retention depending on compliance requirements.

Log volume scales with activity. A production web server handling 50,000 requests daily might generate 5 GB of access logs per day. Add auditd file monitoring and that jumps to 8-10 GB. Configure log rotation and compression from day one or you'll fill the disk inside a week.

• Enable compression in rsyslog with '$ActionFileEnableSync off' and '$ActionFileDefaultTemplate RSYSLOG_FileFormat' to reduce bandwidth by 60-70%
• Set up log rotation with logrotate to compress and archive daily; keep 30 days local, 90 days remote
• Use 'ausearch' and 'aureport' to query auditd logs for specific events like failed logins or privilege escalations
• Monitor the logging pipeline itself with alerts for syslog connection failures or disk usage >70% on the log server

Egress Filtering: Stop Data Exfiltration

Egress filtering blocks unauthorized outbound connections. After an attacker compromises your server, they need to move stolen data somewhere. Filtering cuts that path.

Most servers only need to connect to a handful of external destinations: package repositories, mail relays, API endpoints, and maybe a CDN. Everything else should be denied by default. Use iptables or nftables to set a DROP policy on the OUTPUT chain, then whitelist required destinations with explicit ACCEPT rules.

Start by auditing current traffic. Run 'netstat -plant | grep ESTABLISHED' or 'ss -plant' during peak hours to see what your applications actually connect to. Export the list and review it. Anything unexpected needs investigation before you lock down egress.

Whitelist by IP range and port when possible. If your app talks to an API at api.example.com, resolve the IP ranges that domain uses and allow only HTTPS (port 443) to those addresses. Avoid allowing all traffic to 0.0.0.0/0 on any port, even port 80.

• Use 'iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT' to allow response traffic for inbound connections
• Log dropped packets with 'iptables -A OUTPUT -j LOG --log-prefix "EGRESS_DENY: "' before the final DROP rule
• Review firewall logs weekly for 4-6 weeks after deployment; add legitimate destinations you missed to the whitelist
• Test in staging first and keep rollback commands ready: 'iptables -F OUTPUT; iptables -P OUTPUT ACCEPT' clears rules instantly

So What If You've Blocked Network and File Access?

Attackers adapt. They'll try to hide in memory, abuse trusted processes, or exploit race conditions in your monitoring. Additional layers catch what the first three miss.

File integrity monitoring tracks changes to critical binaries and config files. Tools like AIDE or Tripwire hash files on disk and alert when checksums change. An attacker who modifies /bin/bash or /etc/ssh/sshd_config to add a backdoor triggers an immediate alert even if they bypassed logging.

Run a baseline scan with 'aide --init' after a fresh installation or known-good state. Store the database on read-only media or a remote server so attackers can't modify it to hide their changes. Schedule daily comparison scans with 'aide --check' and send results to your centralized logging server.

Integrity monitoring is lightweight. CPU overhead stays under 2% and scans complete in seconds for most file sets. The real cost is alert fatigue if you monitor too many files. Limit monitoring to /bin, /sbin, /usr/bin, /usr/sbin, /etc, and application directories. Skip /var and /tmp where legitimate changes happen constantly.

Backup Verification and Rollback Procedures

Backups only matter if you can restore them. Attackers sometimes corrupt backups during a breach to prevent recovery. Test your restore process monthly in a staging environment to confirm both the procedure and the backup integrity.

Automate backup verification with scripts that pull the latest backup, restore it to a temporary location, and run basic health checks. For databases, restore and run 'SELECT COUNT(*)' against major tables. For file systems, verify key files exist and aren't zero-byte.

Store backups offsite or in immutable storage. S3 with object lock or a tape library in another facility both work. The key is physical or logical separation so an attacker on your production network can't reach the backups.

Document rollback procedures for each control. If egress filtering breaks a critical integration at 3 AM, the on-call engineer needs a one-line command to disable it. Write those commands down and keep them in your runbook, not buried in Slack history.

• Use 'rsync --archive --checksum --dry-run' to compare restored data against the source before committing
• Set calendar reminders for monthly restore tests; schedule them during low-traffic maintenance windows
• Keep emergency rollback commands in /root/rollback.sh with clear comments and test them in staging
• For cloud backups, enable versioning and set a 90-day retention policy so you can recover from incremental corruption

Monitoring and Tuning Performance Impact

Every control you add consumes resources. CPU cycles for encryption, disk space for logs, memory for connection tracking. The question isn't whether there's an impact—there always is—but whether it stays within acceptable bounds.

Set up alerts for resource thresholds: CPU >80% sustained, disk I/O latency >50ms, log storage >70% capacity. Use Prometheus, Grafana, Zabbix, or even simple cron jobs with Nagios-style check scripts. The tool matters less than having the alert.

Review metrics weekly for the first month after deploying a control, then monthly after that. Look for trends, not one-time spikes. If encryption pushed CPU usage from 40% to 55% but it's stable there, you're fine. If it keeps climbing 2% per week, you've got a scaling problem.

Some controls interact. Centralized logging over TLS adds CPU load for encryption on top of the encryption-at-rest overhead. Egress filtering might block legitimate monitoring traffic if you didn't whitelist your metrics collector. Test controls in isolation first, then layer them together and watch for unexpected interactions.

• Use 'top', 'htop', or 'atop' to identify which processes consume resources after enabling a control
• Enable kernel-level connection tracking stats with 'conntrack -S' if egress filtering causes dropped packets
• For encryption overhead, check 'cryptsetup status <device>' to verify hardware acceleration is active
• Tune log verbosity by adjusting auditd rules; removing noisy rules (like monitoring /tmp) can cut log volume by 30-40%