Stopping data leakage: Making the most of your security budget

After years of battling intrusions, viruses, and spam,User resistance. There is a wariness about deploying
organizations now find themselves wrestlingwith ayet another agent on eachdesktop and laptop that
relatively new but hugely significant security issue: datamight interfere with legitimate business by hogging
leakage. By March 2008, the inadvertent exposure ofprocessor cycles, requiring frequent updates and
company confidential information was already beingslowing down the performance of other user
cited by analyst IDC as the number one threat,applications.
aboveviruses, Trojans, and worms1. At the end of theComplexity of scope. Devising and implementing a
year, 80 percent of respondents in anothersurveycomprehensive, viable policyto be supported by the
agreed that data security was one of the biggestDLP solutions can get in the way of regular business
challenges facing them, with 50 percentof respondentspractices, requiring the involvement of not just IT but
admitting they’d experienced a data leakagealso human resources, finance and legal teams, and
incident in 2008.2 IDC’s survey identified intellectualbusiness unit managers.
property as the most common type of informationThe wrong focus. Many of these solutions focus to a
leaked and 81 percent of respondents saw informationlarge extent on intentional data leakage, when in reality
protection and control (IPC) – defined as monitoring,data leakage is hard to stop. For example, people can
encrypting, filtering, and blocking sensitive informationdeliberately alter files to avoid detection or there is
contained in data at rest, data in motion, and data inthemore mundane problem of people simply sharing
use – as an important part of their overall datainformation inappropriately in conversation.
protection strategy. The highest priority IPC solutionOrganizations’ real requirements
was data leakage prevention (DLP) deployed attheThe truth is that, with the exception of the largest
organization’s perimeter and on endpointenterprises with the most stringent security
computers.1requirements, most organizations simply don’t have
Importance of monitoring employee use1the funds, staff resources, and need to implement
% choosing 4 or 5 on a 5-point scalelarge-scale DLP efforts. Their mostpressing and
Corporate email 56%immediate needs fall into three categories.
Lost/stolen laptop 51%Stopping the stupid
Web email or web posting 37%98 percent of data leakage incidents are actually due
Instant messaging 33%to accident or stupidity.9 Lost laptops and USB keys,
Lost/stolen mobile device 33%inadvertent misuse of email, the unthinking sharing of
Media devices 19%information on IM, webmail, social networking sites, and
Other 12%peer-to-peer file sharing sites are a much more
The intentional or accidental exposure of information,significant threat to organizations than hackers.
ranging from legally protected personal information toMeeting regulatory requirements
intellectual property and trade secrets, is somethingThe most pressing need for most organizations is to
that affects the IT environment in its widest sense,implement an effective solution that will satisfy auditors
involving lostor stolen laptops, USB keys and otherthat they are providing the protection and control
devices, email, and Web 2.0 applications, such as IM.required to meet current regulations without the need
Respondents to IDC’s survey demonstrate justfor a huge amountsof funds, staff, and resources in
how many points of exit there are (see figure 1).implementation and management.
The challenge now is not simply to protect data fromStopping data leakage: Making the most of your
the threat of theft or corruption frommalware, but tosecurity budget
add a second security layer preventing data beingMaximizing IT investment
accessed if it is lost.IT departments want to ensure that the budget
The growing importance of DLPavailable to them – which is being asked to do more
There are several reasons for the movement of dataand more – is spent in the most efficient and
leakage prevention to the forefront of enterprisecost-effective way. Solutions that integrate DLP with
security.other security features are best placed to do this (as
High-profile, reputation-damaging data leaksdiscussed more fully below).
Bad publicity from data leakage can result in damagedEnabling DLP
reputation, lost customers, andsometimes even ruin forEnforcing an acceptable use policy
companies.Creating and enforcing an acceptable use policy (AUP)
The number of well-publicized examples of datashould underpin any attempts to stop data leaking
security breaches is growing significantly.from an organization. Because of the changing nature
Government bodies, financial organizations, educationof both the organizational infrastructure and the
institutions, industry giants and even presidentialexpectation of employees that information should be
candidates – no-one is immunefreely available to access and share, an AUP’s
. Recent high-profile incidents have included:success depends heavily on creating ongoing
Secret government documents on al Qaeda and Iraqemployee buy-in to the fact that the threat is internal,
were left on a commuter train in theoverwhelming accidental, and in their hands to avoid.
UK. (Jun 2008)As well as stressing the importance of commonsense,
The personal information of almost 1000 bankthe AUP should set outexactly how an employee is
customers was lost by an employee of Bank ofexpected to use an organization’s information,
Ireland, after the data was copied onto an unencryptedcontaining prescriptive advice on best practice and
USB memory stick which was then lost. (Novemberclearly defining prohibited behavior.
2008)4It should cover issues such as:
Stopping data leakage: Making the most of yourWhat information/files must not be emailed
security budgetThe company policy on posting to web message
An email containing names, positions, salaries, andboards or downloading from the web
social security numbers of 192 faculty and staffThe policy on use of USB keys and CDs for storing
members was accidentally sent to Ohio Statesensitive company information
University Agricultural Technical Institute students.The policy on altering security settings.
Hackers were charged with stealing more than 40The repercussions of not adhering to the policy should
million credit and debit card numbers from nine US retailalso be spelled out.
outlets by breaking into the wireless networks ofIntegrated solutions
major retailers.The key to achieving successful data leakage
An investigative reporter for MyFoxDC bought aprevention within constrained budgets is to seeit as
Blackberry device during the McCain-Palin USpart of your overall security picture, not as a separate
presidential campaign’s sale of its used officeentity. In fact, you might alreadyhave security tools with
inventory, only to find 50 phone numbers for peoplefeatures that address your most pressing DLP
connectedwith the campaign and hundreds of emails.requirements.
RegulationsAs DLP grows as a corporate concern these
Government legislationfeatures are likely to be upgraded in muchthe same
Governments worldwide have introduced increasinglyway that spyware prevention, spam detection, and
stringent data protection legislation,such as the US’sintrusion prevention all started as separate security
Sarbanes-Oxley Act, HIPAA, and Gramm-Leach-Blileycategories and infrastructures, but were quickly
Act, and the UK’s Datasubsumed into other categories, such as anti-virus
Protection Act, to provide suitable controls overprotectionand firewalls.
sensitive company information. Organizations found toAs you go forward, the inclusion of up-to-date DLP
be in breach of the legislation can be fined and forcedfeatures is something you need to ensure in order to
to put solutions in place to prevent a recurrence. Themake the most of your budget. The two key
California Senaterequirements can be summed up as:
Bill 1386, introduced in 2003, was the first to require thatProtect your data against accidental loss or deliberate
organizations notify all affected individuals if theirtheft
confidential or personal data has been lost, stolen, orSecure your data so that if it is lost or stolen, it cannot
compromised. This public disclosure is now required bybe read.
35 states.Protect your data
Many regulations also require regular audits, which anEndpoint protection
organization may not pass if the rightcontrols are not inEndpoint protection goes far beyond the imperative
place.not to leave laptops on trains:
Today, protection must focus on controlling access toUse powerful anti-malware solutions to block spyware
the information, not on blocking the perimeter.that can steal financial and other confidential data.
Cost of a data breachOrganizations need to implement products that
Up 11 percent since 2006combine DLP features with other security functions to
Average cost per breach – $6.6 millionprovide an integrated solution.
Average cost per record – $202for heathcare –Three steps to AUP success
$282for retail breach – $131Create the policy
Cost of lost businessEducate users about the policy
Up 40 percent since 2005Enforce the policy
69 percent of overall cost (compared toStopping data leakage: Making the most of your
65 percent in a similar 2006 study)security budget
Source: Ponemon Institute8Block the use of non-essential applications such as
PCI DSSP2P file sharing, IM, FTP clients, unauthorized email
Alongside government legislation sits PCI DSSclients, wireless network connections, and smartphone
(Payment Card Industry Data Securityand PDA synchronization tools. All of them can be
Standard). Created by multinational corporations, it issubverted by criminals to get hold of information. Even
enforced on merchants as a part of their terms ofmore easily, employees can – usually unthinkingly
being allowed to accept credit card transactions.– send out and share company data via these
Organizations that cannot demonstrate PCI-complianceapplications.
at anaudit are subject to sanction even if no actualManage write access to portable storage devices
data leak has occurred. PCI’s reach acrosssuch as USB keys. Because these are so easy to
international boundaries and its ability to respond quicklylose, these devices are a high security risk.
to change – it last extended its scope in OctoberEnsure that every computer connecting to the
2008 – makes it as importanta security standard asnetwork – whether office-based or remote,
any local or national legislation.company-owned or belonging to guest users – is
Costcompliant with the organization’s security policy.
In addition to legal costs, organizations have to dealGateway protection
with the less tangible costs of recoveryMuch of the functionality available in email and web
andcommercial fallout, such as lost business, orproducts can prevent sensitive or inappropriate data
withdrawal of credit card merchant status. Allthesebeing sent outside the organization or to unauthorized
costs have been rising steadily.users inside the organization. Features include:
The dissolving perimeter and Web 2.0Content scanning of email messages and attachments
As business has gone online and become vastly moreto control and block sensitive information, by identifying,
mobile, the 20th century security strategyof protectingfor example, social security numbers, or keywords
the organization’s perimeter with firewalls, intrusionrelating to confidential corporate information.
detection, and other similartools has becomeContent scanning of web traffic to ensure spyware
insufficient. There are simply too many points of dataTrojans and other malware are not downloaded onto
entry and exit. Whileblocking the perimeter remainsthe user’s computer.
important,protection must focus on controlling accessPreventing the download of particular file types and
to the information.preventing users from disguising and obfuscating
Stopping data leakage: Making the most of yourunauthorized file types in emails.
security budgetControlling access to particular websites and
This need is growing exponentially with the totallyapplications and to webmail sites such as
different perspective introduced by Web 2.0 users.Googlemail and Yahoo! Mail.
This new “employee 2.0” workforce brings aControlling and blocking the unauthorized use of IM and
mindset that is highly tuned to sharing information onFTP traffic.
social networkingsites, posting to blogs, and emailingProtecting against “drive-by downloads” which
and IMing friends, with little or no regard to whether thissecretly place spyware on the user’s computer
isappropriate in a business context.when they visit a website.
The challenge for today’s DLP solutionsSecure your data
Several enterprise-focused DLP solution vendors, haveIn spite of having the best policies and the best
developed innovative solutions for preventing thesolutions, you might still find your data has beenstolen
leakage of sensitive company information. Many ofor lost. So it is essential to have a second layer of
these products focus on identifying and categorizing alldefense – encryption. In a survey by the Identity
company data and then implementing corporate DLPTheft Resource Center, 82 percent of respondents
policies to track sensitive information across thewho had lost data, said that if the data had been
enterprise, applying controls where necessary.encrypted, the risk to the company would have been
These solutions make a lot of sense in concept, but infar reduced.2 With this being the case, you should:
practice they run up against severalimplementationPerform full disk encryption of laptops and notebooks.
roadblocks.Encrypt data on removable storage devices, such as
Too much data, too little time. For many organizationsUSB drives, CDs and DVDs. Encrypt emails to prevent
data is so dispersed, disorganized, and voluminous thatunauthorized users from reading them. Encrypting your
classifying it comprehensively is just too burdensomedata and devices in this way means that your
and resource-intensive a task for most ITdepartmentsinformation is safe, even if it gets into the wrong hands.
to undertake.Summary
IT resistance. Many available DLP products areData leakage has become one of the most pressing
relatively new and still suffer from issues such assecurity issues facing organizations today. The most
frequent false positives. IT departments can beeffective solution to the problem is to see DLP as part
reluctant to invest their increasingly stretchedof your overall security problem, integrating it into a
resources indeploying another complex enterprise levelcomprehensivestrategy. You also need to create an
infrastructure at the expense of deliveringstrategicAUP, enforce it with technology and ensure that both
value to the organization.are monitored for compliance with corporate policies.