ExpressHR helps companies in the U.K. manage temporary workers. "Our whole business is this application of sensitive data," including Social Security numbers and passport information. "If there was a security breach, it would be terminal," says Ray. Before heading up expressHR, he was cofounder and CEO of Prevx, an Internet security company.

"The biggest potential risk was from someone on the inside abusing the system and using the information for something other than work," he says. ExpressHR has tens of thousands of users (including recruiters and hiring managers) who access their database.

Ray deployed software from Secerno, which provides activity monitoring of databases. "It could learn what were normal requests from the database," says Ray. With the information the Secerno product gathered, it could automatically build rules to prevent unauthorized usage of expressHR's data.

The software allows systems administrators to define rules that reflect their particular database's activity. The software learns how the customer's application talks to the database—such as how many times a day a file is accessed or whether it's ever printed. Those typical queries become the basis for access policies. If data is accessed in an unusual way, the system notifies IT managers and automatically executes policies for containing the problem (such as quarantining users or locking down the data).

Ray says the biggest downside to a rule-based solution is the potential to block a legitimate transaction if a rule is improperly specified. Ultimately, he says, the risk of blocking a normal transaction is negligible.

Ensuring Usability

Once you've given someone access and have established access polices, then what? There are granular questions to ponder: Who can edit the data? Or print it? And who can distill it into a different format? Those are normal workflow questions, so it's important to figure out how people use the data when trying to implement security and usage policies.

"You could make your organization extremely secure, but at the expense of the workflow," says Ed Gaudet, SVP of corporate development and marketing at Liquid Machines, a provider of enterprise rights management software.

Companies such as Goldman Sachs and Dow Chemical use Liquid Machines software to protect intellectual property by defining not only who can use the information but also how they can use it. The software is typically used to encrypt all corporate data and lets systems administrators create access and usage rights to protect against misuse. When unauthorized users access data they don't have rights to, they get a message telling them the file is protected.