Solving the DLP Puzzle: Ways Employees Spill Sensitive Data
A company can buy every top-of-the-line security product known to man, but it won't make a difference for data loss prevention (DLP) unless end users are educated on their own role. Technology is indeed critical to DLP, as we showed in " Solving the DLP Puzzle: 5 Technologies That Will Help." But security experts say user awareness is key to keeping sensitive data safe from online predators.
Tue, July 14, 2009
CSO — A company can buy every top-of-the-line security product known to man, but it won't make a difference for data loss prevention (DLP) unless end users are educated on their own role. Technology is indeed critical to DLP, as we showed in " Solving the DLP Puzzle: 5 Technologies That Will Help." But security experts say user awareness is key to keeping sensitive data safe from online predators.
Solving the DLP Puzzle: 5 Technologies That Will Help
Enterprise Data Security: Definition and Solutions
"DLP is a process first. The technology is simply an enabler for the automation of the process," said Rick Lawhorn, a Richmond, Va.-based chief security officer. "The process needs to include education and awareness training and cover human resources, records management and compliance. The objective is to continuously train data owners and data custodians (the employees) on the company policies to reduce instances of non-compliance."
Based on feedback from several security practitioners, here are five ways in which employees maliciously or unwittingly lose sensitive data, and how a DLP program with the right people policies can make a difference.
1. E-mail mayhemIT administrators have had success detecting and blocking malicious e-mail, but users continue to let sensitive data outside the company walls by hitting "send" at inappropriate moments -- like when they've just copied and pasted customer information or intellectual property details into a message box. Many times the e-mail is meant for recipients inside the company, but the user might include outside addresses in the message without thinking.
Meanwhile, e-mail filters can't stop every phishing attempt. URLs to malicious sites will still get through, and all it takes is one user to click on it to infect one or more machines with malware that finds and steals data.
This is where the user policies and awareness training can make a difference, Lawhorn and others noted. Policies should be clear on the type of content that users can and cannot send out, including such things as customer credit-card numbers, detail on the company's intellectual property and the medical records of fellow employees. Attackers typically latch onto news events like hurricanes or celebrity deaths to concoct bogus headlines that, once clicked, open the door to insidious websites designed to drop malware onto the user's machine. An awareness program can reduce the risk by constantly alerting employees to malicious social engineering schemes making the rounds.
