Over 6 years after the introduction of the first data loss prevention
products, DLP technology has not mainstreamed into general acceptance
like firewalls.
The cultural phenomenon of companies getting hit
by data breaches but not adopting technology countermeasures to
mitigate the threat requires deeper investigation but today, I’d like
to examine the psychology of data security and data loss prevention.
Data loss has a strange nature that stems from unexpected actions by trusted insiders in an environment assumed to be secure.
Many
IT managers are not comfortable with deploying DLP, because it
requires admitting to an internal weakness and confessing to not doing
your job. Many CEO’s are not comfortable with DLP as it implies employee
monitoring (not to mention countries like Germany that forbid employee
monitoring).
As a result, most companies adopt business
controls in lieu of technology controls. This is not necessarily a
mistake, but it’s crucial to implement the business controls properly.
This
article will review four business control activities: human resources,
internal audit, physical security and information security. I will
highlight disconnects in each activity and recommend corrective action
at the end of the article.
The HR (human resources) department
Ensuring
employee loyalty and reliability is a central value for HR, which has
responsibility for hiring and guiding the management of employees.
High-security organizations, such as defense contractors or securities
traders, add additional screening such as polygraphs and security
checks to the hiring process.
Over time, organizations may sense
personality changes, domestic problems or financial distress that
indicate increased extrusion risks for employees in sensitive jobs.
Disconnect No. 1:
HR isn’t accountable for the corporate brand and therefore doesn’t pay
the price when trusted employees and contractors steal data.
What can you do? Make HR part of an inter-departmental team to deal with emerging threats from social media and smart phones.
Internal audit
Data
loss prevention is ostensibly part of an overall internal audit
process that helps an organization achieve its objectives in the areas
of:
- Operational effectiveness
- Reliability of financial reporting
- Compliance with applicable laws and regulations
Internal
auditors in the insurance industry say regulation has been their key
driver for risk assessment and implementation of preventive procedures
and security tools such as intrusion detection.
Born in the
1960s and living on in today’s Windows and Linux event logs, log
analysis is still the mainstay of the IT audit. The IT industry has now
evolved to cloud computing, virtualization,Web services and converged
IP networks.
Welcome to stateless HTTP transactions, dynamic IP
addressing and Microsoft Sharepoint where the marketing group can setup
their own site and start sharing data with no controls at all.
Off-line
analysis of logs has fallen behind and yields too little, too late for
the IT auditor! According to the PCI Data Security council in Europe –
over 30% of companies with a credit card breach discovered the breach
after 30 days and 40% after more than 60 days.
Disconnect No. 2:
IT auditors have the job, but they have outdated tools and are way
behind the threat curve. What can you do? Give your internal
auditors, real-time network-based data loss monitoring and let them do
their job.
Physical security
Physical
security starts at the parking lot and continues to the office, with
tags and access control. Office buildings can do a simple programming
of the gates to ensure that every tag leaving the building also entered
the building.
Many companies run employee awareness programs to
remind the staff to guard classified information and to look for
suspicious behavior.
Disconnect No. 3: Perfect physical security will be broken by an iPhone. What can you do? Not much.
Information security
Information
security builds layers of firewalls and content security at the
network perimeter, and permissions and identity management that control
access by trusted insiders to digital assets, such as business
transactions, data warehouse and files.
Consider the psychology behind wall and moat security.
Living inside a walled city lulls the business managers into a false sense of security.
Do not forget that firewalls let traffic in and out, and permissions systems grant access to trusted insiders by definition. For
example, an administrator in the billing group will have permission to
log on to the accounting database and extract customer records using
SQL commands.
He can then zip the data with a password and send the file using a private Web mail or ssh account.
Content-security
tools based on HTTP/SMTP proxies are effective against viruses,
malware and spam (assuming they’re maintained properly). These tools
weren’t designed for data loss prevention.
They don’t inspect
internal traffic; they scan only authorized e-mail channels. They rely
on file-specific content recognition and have scalability and
maintenance issues. When content security tools don’t fit, we’ve seen
customers roll out home-brewed solutions with open-source software such
as Snort and Ethereal.
A client of ours once used Snort to
nail an employee who was extracting billing records with command-line
SQL and stealing the results by Web mail. The catch is that they knew
someone was stealing data – and deployed Snort as a way of collecting
incriminating evidence, not as a proactive real-time network monitoring
tool.
Disconnect No. 4: Relying on permissions
and identity management is like running a retail store that screens you
coming in but doesn’t put magnetic tags on the clothes to prevent you
from wearing that expensive hat going out.
What can do you?
Implement real-time data loss audit using passive network monitoring at
the perimeter. You’ll get an excellent picture of anomalous data
flowing out of your network without the cost of installing software
agents on desktops and servers.
The trick is catching and then
remediating the vulnerability as fast as you can. If it’s an engineer
sending out design files or a contractor surfing the net from your
firewall – fix it now, not 3 months from now.
Conclusion
To
correct the disconnects and make data security part of your business,
you need to start with CEO-level commitment to data security. Your
company’s management controls should explicitly include data security:
- Soft controls: Values and behavior sensing
- Direct controls: Good hiring and physical security
- Indirect controls: Internal audit
Cross-posted from Israeli Software
Only registered users can write comments.
Please login or register.
