CISO

Enterprise Information Security

Data Loss Prevention best practices

by Leave a Comment

Data Loss Vectors

Insider threat being one among the top ten threats an organization faces, data loss prevention mechanisms play a key role in protecting the data within an organization. With all the avenues available to employees today to electronically expose sensitive data, the scope of the data loss problem is an order of magnitude greater than threat protection from outsiders .

The data loss vectors include:

  • Data in motion . Any data that is moving through the network to the outside via the Internet
  • Data at rest . Data that resides in files systems, databases and other storage methods
  • Data at the endpoint . Data at the endpoints of the network (e .g . data on USB devices, external drives, MP3 players, laptops, and other highly-mobile devices)
What needs to be protected and Why?
  • Regulatory Compliance: An organization need to implement data loss prevention systems to ensure regulatory compliance such as SOX, GLB, HIPAA, European Union data protection directive and/or PCI Compliance as companies are required to take measures to protect private and personally-identifiable information. Data loss is not only a significant problem for companies in data-sensitive industries such as health care and finance, but for nearly any organization conducting business worldwide
  • Intellectual Property Protection: In today.s business world protection of the intellectual property is of paramount importance and is a major concern for organizations of all sizes. From industrial espionage to employees defecting to a competitor and taking sensitive information
    with them, protecting one of the most important assets of the business is a key driver of data loss prevention efforts.

    • Trade secrets, according to the Uniform Trade Secrets Act (UTSA), include
    formulas, patterns, compilations, program devices, methods, techniques, or
    processes . They also can be diagrams and flow charts, supplier data, pricing
    data and strategies, source code, marketing plans and customer information .
    With so much that could be considered a trade secret, chances are good that
    employees may not even know they are handling IP

    Companies need to take steps to better protect valuable IP property from situations such as:  

                      • Inadvertent forwarding of email containing product development or business plans to another email recipient
                      • Sending unreleased pricing information to the wrong email address
                      • Customer or competitive information sent by an employee to a third-party for financial gain
                      • Proprietary information sent to a distributor, who might then forward it on to competitors

Data Loss Prevention solutions

A comprehensive DLP solution prevents confidential data loss by:

  • Monitoring communications going outside of the organization
  • Encrypting email containing confidential content
  • Enabling compliance with global privacy and data security mandates
  • Securing outsourcing and partner communications
  • Protecting intellectual property
  • Preventing malware-related data harvesting
  • Enforcing acceptable use policies
  • Providing a deterrent for malicious users (by creating the possibility of being caught)

In the following section, I will briefly list some of the best practices for establishing a comprehensive data loss prevention program

  • Build a Data loss prevention governance structure. It is really important to define the program before it can be implemented. Develop the data loss prevention policy and obtain the management commitment
  • Spend some time in defining the Data Loss Prevention needs of the organization. Perform a risk assessment.
  • Prioritize the DLP focus such as Removable media channel, email & internet channel etc.
  • Choose a solution which is best suitable to your organization. Is the solution a short term one or going to be part of the enterprise strategy? Is the vendor opted has a growth strategy?
  • Implement the solution covering all the focus areas. Utilize the existing infrastructure as well as ensure integration with the existing infrastructure
  • Perform a pilot test by implementing in small groups. Baseline the installation and configuration, once stabilized, and expand to the larger groups
  • Ensure the solution is non-intrusive. Provide transparent services to the end users such as content aware encryption, protect email and internet access etc.
  • Develop central management function. Workflow based administration and reporting. Violation reporting and analysis is a key process in enforcing the data loss prevention, if the solution is not capable of providing effective administration and reporting, the optimum use of the solution could not be achieved.

If you are evaluating data loss prevention solutions for your organizations, consider above points and also take a look at the list of content aware data loss prevention solutions

Data Loss Prevention Solutions worth evaluating

by Leave a Comment

12Content Aware DLP Solutions worth evaluating

Data loss prevention is being considered as one among the key information security tools an enterprise needs. Here is a list of software vendors offering the Content-Aware Enterprise DLP solutions

  1. Symantec: Symantec DLP is one among the most comprehensive data loss prevention solution. Key features of this Data Loss Prevention solution includes Discovery, Monitoring, protection and management. It offers, network and end point data loss prevention capabilities. It recently introduced capabilities for data protection at tablets like iPad. It also offers social media data loss prevention capabilities
  2. McAfee: McAfee offers a wide range of DLP products such as DLP Discover, DLP Monitor, DLP Prevent, DLP Endpoint and DLP Device control. The good thing about the product is that it is integrated to the EPO for reporting. It is one among the comprehensive products for enterprise data loss prevention.
  3. WebSense: WebSense offers enterprise data loss prevention solution in line with Symantec and McAfee. The solution include capabilities such as endpoint, network and discovery of sensitive information and its protection. It offers DLP agents for Linux based workstations and offers SaaS service models
  4. EMC/RSA: RSA DLP offers comprehensive data loss protection solution ranging from Network DLP, Endpoint DLP, eDiscovery using DLP datacentre which addresses all the requirements of a DLP solution. Microsoft and Cisco DLP solutions are mostly based on the RSA DLP technology. From an enterprise perspective its network and discover data loss prevention is at par with the competition, but the endpoint capabilities requires improvements.
  5. CA: CA DLP solution offers Endpoint Security, Network Security and data discovery. It is not very strong in document matching and other data detection mechanism.
  6. Code Green Networks: TrueDLP is complete solution for Data loss prevention. It offers three distinct products like Network DLP, Discovery DLP and Endpoint DLP. Enterprises looking for a low cost DLP solution, this would be a good bet. It is not very popular outside US and has limited distribution channels. It is an early stage product when compared with similar products
  7. TrustWave: TrustWave offers comprehensive DLP solution covering the network, endpoint and discovery aspects of data loss prevention. its solution is capable of scanning the VMware files for sensitive data. A good DLP software for SMB market
  8. Fidelis Security Systems: The XPS range of products offers strong network data loss prevention capability. However, the endpoint or data discovery capabilities are either weak or does not exist. It supports mechanisms such as control over proxied and direct internet traffic, inspect all network traffic, including attachments and compressed files for sensitive content, identification of personally identifiable information, credit cards, source code, ePHI, classified information, operational security information (OPSEC), design documents, source code, financial statements, and other proprietary information. If you need a DLP solution for the network traffic, this one would be a good option.
  9. Palisade Systems: PacketSure Data Security Platform offers content aware DLP solution which includes network DLP, endpoint security along with URL filtering, IM proxy, application filtering and email/web proxy. The pricing is suitable for SMB. It integrates encryption solutions from PGP, Voltage Security and CISCO/ IronPort for automated remediation. However, based on their growth plans and/road map ( I did not find one) they have a very slow pace in coping up with other vendors. As my IT Manager to day commented, companies may find it difficult to get the latest advancements in these tools from Palisade.
  10. Trend-Micro: Trend micro DLP solution focuses on the Network and endpoint security with limited discovery capabilities. The advantage of this DLP is the ease of implementation and usage. An organization with Trend Micro solutions are implemented at the end points, it is a very good option to assess for the data loss prevention requirements.
  11. GTB Technologies: GTB suite of products offers Network DLP, Endpoint DLP and eDiscovery. the network DLP addresses the outbound data traffic and is capable of encrypt, quarantine, log and block data exposure. Endpoint DLP supports data encryption while moved to removable media. eDiscovery helps you find data and classify them from anywhere in the network. It offers a competitive pricing which is good for small organizations.
  12. Safend: Safend offers a very good endpoint security solution with integrated encryption capabilities. It does not provide any network DLP and the discovery is performed by the endpoint agents. The price range is bit on the higher side for similar products.

The above list provides a number of solutions I have looked into during the last 6-8 months. There would be feature changes in some of the above solutions. In addition to the technical features, you may need to look into other aspects such as support, language preferences etc.. before finalizing a data loss prevention product.

Data loss prevention

by 1 Comment

Businesses are driven by data. Global organizations need  more than network security to protect their confidential data and sensitive information.The protection of data itself is equally important. In any organization, data is being stored and transmitted across the systems, LAN, WAN and many times in the internet. This creates a major vulnerability within organizations and businesses are recognizing this vulnerability and the need to secure not just the network but also the data that is stored and transmitted across it.

Data Loss Prevention

Data Loss Prevention is the solution mostly sought after for data protection. Data loss prevention is a category of information security tools which helps organizations to prevent the unauthorized distribution or loss of sensitive information. A typical Data Loss Prevention solution should have three main components namely:

  • Endpoint Security: Provides the data loss prevention at the endpoint. Many implementations are focused on controlling the connectivity such as Bluetooth, wireless etc. Most implementations controls the USB and other removable media access
  • Gateway Security: Next avenue for data loss is through the network gateway.s typically, web gateway and email gateway. People tend to upload files to the internet; a Secure Web Gateway helps you in preventing file uploads, text upload and also could act as a content aware DLP solution. Secure Mail gateway.s allows you to setup what is allowed to sent and what is not. Secure Mail Gateway.s are also capable of acting as content aware DLP solutions
  • Storage Security: Protection of data at rest is the third component of a DLP solution.  For example, when an authorized user copies sensitive files to a USB, the storage security component kicks in and encrypts the data protecting the data while at rest

The DLP products alone will not provide complete protection, unless it is backed with strong policies and processes.

Cloud computing and Data security

by Leave a Comment

Cloud computing is becoming a real trend in today.s business world. Businesses are increasingly opting for cloud based applications for their business needs. Various security aspects need to be assessed before considering a cloud application.

A recent application I have reviewed offers a financial management solution. The solution is hosted at a webhosting provider which offers a cloud servers as part of its offering. So the scenario is summarized as this:

  • Vendor A offers a cloud application
  • The application is hosted in a cloud server instance of a cloud service provider (Vendor B)
  • Vendor A is a customer of Vendor B, one among many customers of Vendor B
  • Vendor A shares the hardware infrastructure of Vendor B along with other customers, which includes the storage including backup, CPU, Memory etc.
  • The real customer of Vendor A have their data being hosted at this shared storage space of Vendor B, which again is shared with the other customers of Vendor A. It would be safe to assume that there would enough controls in a normal scenario to have the data segregation established between the customer environments within the Vendor A clouds.

Now let us look into various cloud data security scenario.s a company will face in the above cloud hosting environment

  1. Data backup, once taken, is not under the custody of the application service provider, but with the cloud hosting provider
  2. Any failure of cloud storage devices, will potentially lead to data leakage as the cloud service provider will tend to replace the storage hardware.
  3. Most of the system administrators of the cloud service providers can have access to your data if the system administration is allowed by them. For example, managed services offered by the cloud service providers requires administration of the cloud instances by the cloud service providers administrators
  4. Web application security is another key issue to be looked into. Most of the cloud hosting’s are not secure cloud hosting in its default or many times in the advanced mode. Many of today.s attacks are web application attacks resulting in numerous data loss. Web Application Firewalls are an important piece of solution required to protect critical web applications. None of the cloud service providers offers web application firewall
  5. IPS & Firewall are two other pieces of network security. Cloud service providers find it difficult to offer IPS and Firewall for selected clients and hence it is not a standard offering by many of the top cloud service providers

From the above, it is very evident that the Cloud Applications offered as a SaaS are not very secure if the cloud infrastructure is not managed by the SaaS vendor. In the new business models, the SaaS providers often choose a Infrastructure as a Service (IaaS) vendor for the infrastructure needs. The IT control and governance environment become very weak in this kind of business models.

I would not bet on a public cloud infrastructure if I have critical customer data to be stored and processed. what are your views on this?