IT Security Blog. Mitigating Risks. Enabling Business Strategies. W. Mark Brooks

Preventing a Data Breach

I read this great article that I believe illustrates what is typical in Fortune 500 companies with respect to data leaks.

Editor's note: Security consultancy Networks Unlimited allowed freelance reporter Sandra Gittlen to tag along as it conducted a data leak audit at a Boston pharmaceutical firm, then presented its findings to company execs. In exchange for this type of access, we agreed not to identify the pharma firm.

When the director of IT at a Boston-based, mid-size pharmaceutical firm was first approached to participate in a data leakage audit, he was thrilled. He figured the audit would uncover a few weak spots in the company's data leak defenses and he would then be able to leverage the audit results into funding for additional security resources.

While there are certainly marketing benefits of publishing such findings for the vendors, I found this article to be very good and relevant for large companies.  

The incident numbers stated may be high simply due to false positives, as the IT management team noted in the article.  In addition, since the business management did not weigh in on the criteria of the audit, it is less likely that they were able to identify leaks that require more contextual findings and analysis -- which in many cases can be the most devastating type of data leak.  Examples would be executives or key technical staff that depart companies with 1000’s of files and documents regarding strategic plans, merger and acquisition data, confidential projects, litigation strategies, or impending negative decisions on products, etc.

With that said, I believe the types of findings in this article are realistic even for companies that have extremely sound technical security controls.  Without proactive, ongoing monitoring and the sponsorship of the senior business management data, breaches of this scale are more likely the norm than the exception.

I'm confident that if a similarly designed and executed audit were done, say at the top 100 Fortune 500 companies, the audits results would be very similar in scale and nature for many of the companies.

If you are a senior business executive, I think this article illustrates that your IT group cannot do it alone.  This company certainly was counting on IT.  If you are a senior IT leader, know your IT security team can’t make it happen alone.  If you are an Information Risk Executive, I think this story is a great example to leverage in making your case for the need to understand and monitor data leak risks.

Mark Brooks

Book Review: The Energy Bus by Jon Gordon

I rated The Energy Bus by Jon Gordon 4 stars at Amazon.com.

This easy-to-digest book is a short fable that teaches the reader secrets of approaching life and work in a positive manner.

While the book doesn't contain any new startling revelations on the importance of being positive when dealing with life's challenges and opportunities, it does reinforce some key principles we often forget. In addition, it shares a few insights and observations from some interesting perspectives.

The most impactful insight from the book for me revolved around the concept of "Energy Vampires" in the work place.  Energy Vampires, according to the author, are employees who suck the life out of the room or out of their co-workers. Typically they:

• Always point out what others have done wrong
• View their problems as always the most urgent
• Have a negative outlook on life
• Cause you to feel drained or exhausted after being in contact with them (the most sure sign)
• Minimize the worth of others

I can certainly attest to having been in contact with energy vampires in the past.  After interacting with them, I felt just completely drained or exhausted.  So I began to mentally tally up all the various energy vampires with whom I had dealt, but then it hit me. Is the fact that I can so readily develop a list of energy vampires make me an energy vampire who is pointing out what other people are doing wrong?  Well, honestly?  Probably yes and no.  I could see where I too have behaved like an energy vampire in the past and reading this fable helped me evaluate my own behaviors more objectively.

The second key insight I gained from this book was learning to be more cognizant and careful of not being an energy vampire with my business partners.  It occurred to me how easily Risk and Compliance professionals could find themselves being viewed as energy vampires by their customers or business partners.  I recall the occasional comments from line management: "There's compliance. I wonder what we haven't done lately?" or, "Quiet down, here comes compliance" or worse, "Here comes bad news."  It seemed like compliance in my shop was always the bearer of bad news.  I bet line management often felt drained or exhausted after working with compliance.  Especially when they walked away with ten unplanned to dos to get into compliance.

As a Information Security professional, it is vitally important to engage the business with an attitude of "How CAN we enable business strategies?"; "How DO we mitigate the highest risk?"; "Where CAN we simply accept risk?" or "How CAN we make this work?".  Without a positive approach in our work, we too are at risk of being viewed as energy vampires.   

I would encourage you to read The Energy Bus to learn concepts like this and others and to ask yourself as a Risk and Compliance professional, "Am I an energy vampire?"

Achieving Cost Savings Through Information Security Strategies

Is it really possible to achieve cost savings through the proper deployment of a security strategy?  I think so.

Due to the shear volume of business priorities and the pace of business today, businesses routinely pass up or fail to recognize opportunities to realize cost savings or efficiencies through the effective implementation of information security strategies.  Failing to recognize these types of opportunities can result in delays or stoppages of information security investments in this economic downturn.

Here are two simple and practical opportunities for cost-savings:

1.  Over-securing information that is not sensitive

I have personal experience in this space with Sharepoint.  Sharepoint allows individuals with administrative-level privileges to establish the security and access controls for a Sharepoint collaboration space.  Unfortunately, many companies without comprehensive information security strategies fail to effectively address access controls in Sharepoint implementations.  As a result, collaboration owners can easily end up unnecessarily securing their collaboration sites.   Over securing happens because the users simply were not trained on how to effectively design access controls in their collaboration space or they resort to ‘old school’ LAN folder access of granting access to their department.  As a result, money is wasted in maintaining these unnecessary controls.

2.  Inappropriate Role-Based Security

Implementing role-based security down to such a fine level that a department of 30 people ends up having 15 or so different roles can result in unnecessary administrative overhead.  This might have worked in the past when the pace of business and technology changes were slower, but in today’s fast-paced work environments maintaining this proportion of roles to the size of a department is generally unsustainable.  In many cases, if a department reexamines their access controls, they could reduce the number of roles to just a few without substantially increasing their risk.  Again, money wasted via maintaining unnecessary controls.

The above problem areas manifest themselves in organizations that lack comprehensive information security strategies.  A good comprehensive information security strategy would:

• Ensure all major implementations incorporate any necessary security aspects and training.
• Help drive and influence the implementation of information classification that would help define different levels of control based upon sensitivity of company information.  Once information classification is institutionalized into procedures and employees trained on the classifications, operational controls such as setting access controls in a collaboration could be aligned with the sensitivity of information.

While effective information security is so much more and can have the benefit of increased protection and reduced risk, these straightforward examples demonstrate that a comprehensive information security strategy can enable cost savings.  Given the current downturn in the economy, this is an especially good time to leverage examples like this to assist in gaining sponsorship and support for a comprehensive information security.

Mark Brooks

Corporate Espionage

This hit the news recently.  Hilton hired two senior executives from Starwood Hotels.  Starwood is now suing Hilton along with the two executives for allegedly using stolen Starwood information to develop a new luxury hotel chain.  The executives are accused of stealing more than 100,000 electronic and paper documents containing sensitive information.

I have dealt with very similar circumstances in my work, and it is very challenging.  First, it is difficult to define what is personal property or company property.  While most companies tend to take a stance of,  "Anything and everything is ours, take nothing with you," many employees considered to be "generally" honest don't believe this meets muster in terms of common sense.  A recent study at the Ponemon Institute indicated that 59% of employees leaving companies take confidential information.  Personally, I think this is a low percentage.  Second, it is difficult to detect electronic and physical theft of property, especially if the theft occurs far in advance of an employee's departure.

The best strategy for a company to diminish this type of risk is in the context of a comprehensive information security strategy.  Unfortunately, many companies fall into the trap of wanting a quick return and will look to implement quick fixes.  As result, you see the emergence of the DLP (Data Loss Prevention) market as the latest wave in quick fixes.  If a consulting firm or security professional is forced into having to or needing to execute the short-term play, there are ways to wrap longer-term information security strategy into a near term DLP implementation. In essence, it is simply pointing at the need for DLP as a symptom of a broader need for an information security strategy, and then incrementally incorporating elements of the long-term strategy as a part of the tactical game plan.

Mark Brooks