Working with security solutions has indeed made us realise a lot of things that pertain to IT governance. Like how people should start taking a broader view from it instead of getting their feet wet on many different security technologies at the onset. But one thing that I’ve been thinking about recently is that, in essence, data loss prevention (DLP) is a very good way to illustrate good IT governance.
To illustrate it, here are several steps for DLP security strategies development:
- Regulatory Compliance. Many organizations need to comply with certain regulations, such as SOX, ISO, PCI DSS, or all the above. DLP strategies are becoming the most vital part to achieving regulatory compliance requirements. PCI DSS, for example, requires that stored credit card holder data must be protected. A DLP strategy is not only a way of protecting such information; it is also a decent compensating control to demonstrate that the organization is taking the appropriate steps.
- Data classification. This is a hybrid activity involving people, process and technology. Although it is common knowledge that personal information of clients, employees, as well as business and financial data are confidential to the company, internal departments and applications are authorized to access different levels of data. Besides, the database crawling function of some DLP solutions would help to locate sensitive data on the network, based on people definition for a faster rollout.
- DLP Risk Assessment. Any risk assessment on DLP would involve monitoring the type of data transmitting out from the company network, which would give an organisation a better understanding of its IT environment. The assessment results are a strong support to the business’ investment on DLP solutions and required resources.
- Endpoint DLP and Network DLP enforcement components. This may be the easiest part once an organisation requests for proposals from different providers. This Gartner paper serves as a reference.
- Encryption components. Ever misplaced a USB thumbdrive? This explains the reason behind organizations disallowing confidential data to be stored on personally owned removable storage devices which can be brought out of the office. This is despite the availability of media encryption products.
Some vendors and cloud providers promote a concept that “Confidential data should never leave the office”. To work remotely off-site, employees are encouraged to connect via securely remote access to the organisation’s network and data. Security host check and secure cache memory clearing features are also included in most of the remote access solutions these days.
Furthermore, database encryption solutions are drawing market interest. All records on enterprise database are encrypted and decrypted when called on by authorized applications. Applications may be required to be modified in order to obtain and update desired data records from the encrypted database. Furthermore, additional hardware module of server is required to minimize the performance degraded of applications and database.
- User awareness training. It is a fact that most data loss incidents can be attributed to unintentional errors made by internal users.
- Incidents management. This could be quite a large topic. In Hong Kong for example, the government has developed an Information Security Incident Handling Guideline for government agents.
- Central monitoring and reporting. Most security solutions have monitoring and reporting tools. Besides Network DLP and End-Point DLP, one should also consider weekly checks of network vulnerabilities and important applications connected to backend database, when implementing data security strategies.
New threats are revealed everyday and these can be exploited by hackers any time. Along with DLP monitoring findings, such health checks would help a security manager form a boarder view for a security manager and is very useful for forensics and auditing.
Ideally, every project that pertains to IT investment must be supported by a business case. In my experience, I have come across clients who purchase IT solutions such as database encryption, but fail to implement them.
One thing that stood out to unify them was the lack of business case for the technology and deployment surrounding the solution, which eventually led to a communication breakdown. This eventually reached the point where related departments do not offer support upon realising the need to modify their application, to integrate a database with encrypted records.
The following points must be carefully considered and well communicated, in a business case of a DLP or data security:
- Data protection is not a task that is given solely to the IT department, but also to the senior management. In SOX, for example, the CEO and CFO would be prosecuted in the event of unprotected listed company financial data or a breach in data integrity.
- Unlike business processes, data risks cannot be outsourced. Even if the data processing is relegated (because it can be) to a service provider, the data owner (your company) would still be liable for the loss of any data.
- A company with no budget for a complete data security risk assessment can still know its risks. Install a borrowed network DLP unit from a service provider/vendor on the main data pipe (the internal gateway) to monitor the network for approximately two weeks. This will provide a decent picture of your current data security events and the corresponding data value at risk.
- Consult a trusted service provider, if your data security strategies aim for regulatory compliance. Advice from consultants is a good external source of information that will support an internal discussion on business cases.
Eventually, it boils down to the fact that business cases are significant to IT governance. Hence, we should always take note of them.
Amice Wong is for security solution strategic marketing and sales planning for Datacraft Hong Kong, where she is also the primary spokesperson on security solutions and services. She was previously a Solution Sales Manager with PacNet before she joined Datacraft three years ago. Amice is a Certified Information System Auditor, with 10 years of sales and marketing experience in security solutions.
{ 1 comments }
