Data leak prevention

The solution seems to be as simple as fast food; get a DLP or data loss prevention application from one of the renowned companies like HP or Symantec. Is it really all that simple? The problem is that employees could be the silent thieves. After all, copying data has become a dream nowadays like with the thumb drive via USB. You don’t have to struggle with bulky hard copies any more. A tiny gadget could hold a library of information. And then you have emails, and attachments could be used to dispatch sensitive information to the wrong persons.

Just like advertising wars bitterly fought between rivals in the business like in smartphones, the information war is very real. Information costs money all right, as we witness each day over the media. A few seconds of publicity for the chocolate brand and the company pays a fortune. Just imagine how much people would pay in terms of patents and designs concerning advanced products that are being researched 24/7.

No wonder then that 19 mega companies vie for top slots in the DLP market. The demand is expected to escalate by nearly $2 billion by 2019. We can imagine why. Cybercrime increases tenfold each year and we can only work with estimates. Preventing unauthorised access is what keeps so many people busy. Much of the media works with estimates but we treat the figures as very real. Nobody knows the whole truth really.

Background checks on staff may help to ascertain the reliability and signed agreements to maintain secrecy may bring confidence to the employer. If the staff is really happy with the organisation, perhaps fewer chances exist of data theft. Yet training is essential to make sure that workers understand the problem and know how to control the flow of information. Each computer may be connected to twenty other computers and information travels between them all the time. Network monitoring systematically ensures the smooth passage of information. Hackers use the same technology to breach the fortress and steal data for a variety of reasons like business, espionage, terror and plain mischief.

The insider information leak appears to be miniature, according to Verizon’s report in 2012, it was only 4%. The daunting problem is that company executives possess a goldmine of information in the office and they could easily copy it. A Bank of America leaked customer information to identity thieves and the financial loss amounted to $10 million besides the PR issues. Hard to believe? No, it is all true. The age old antivirus software with firewall backing is constantly being recommended to ensure security. It forms a mighty wall that is not easily breached, at least the top companies promise such a shield. DLPs monitor the movement of data based on the company intellectual property profile. The software examines each bit of information that leaves at ports and protocols and responds appropriately.

Thus, the information could be prevented from leaving beyond certain fixed thresholds. Encryption and USB blocking appear to be sound strategies to preserve the valuable information and prevent illegal access and tampering. Banks constantly use such encryption and the system appears to be working fine. Considering the huge amounts of cash that change hands legally each day over internet banking, it seems that there is nothing to be quite alarmed about. Web security gateway services as an alternative to DLPs do protect from evil websites and software. They scan files in all communication avenues for potential data loss, according to the language terms contained therein. If somebody is behaving irresponsibly, the software catches up and raises an alarm.

Not only is information all over the place in so many incarnations like DVDs, IM, smartphones and blogs, email and thumb drives, but privacy is constantly being compromised by smartphones with cameras and video recording that reach the most sensitive zones. Nothing appears to be beyond their reach, not even in the trial rooms of companies. Besides, being allowed to bring your own equipment to the workplace has potential hazards too, like an open invitation to steal information. Happy were the days with the manual typewriter, phone and fax alone.

Accidental loss or misuse of information does sometimes occur when you send it to the wrong person by chance. The problem is often not what lies beyond the perimeter but what happens within. Since information is constantly being sent and resent, there exists plenty of opportunities inside to manipulate or steal. Anti-malware and encryption besides other security controls do play their important roles. Three layers of defence are being used that effectively keep things in place. Imagine the degree of security that credit card and social security numbers would require.

A system of file classification would ensure that sensitive information does not pass through a protocol or gateway, raising an alarm if they do. Such a system could also be implemented in social media where objectionable content or images are prevented access. Arrangements could also be based according to file size and abnormally large files would raise doubts and halt the process. The unusual behaviour of employees could also be supervised in this manner.

The case of the theft from the DuPont database over several months of $400 million is an eye-opener. The person had been accessing 15 times the number of files the others in the office had been working with. A Duracell employee sold information about batteries, first sending it home and later to a rival company. Getting a handle on the internal data is crucial but separate software would be required for each information category. Avoid putting all the eggs in one basket.