Data Breach Risks: Not Just the Insider Threat
There's a very large push within the last few years for organizations, of all types, industries and sizes, to spend the majority of their data protection efforts on the "Insider Threat". That's to say, focusing in on the employee or temp with the access already in hand, who then could decide to misuse or abuse those given privileges. It is true, the insider threat needs to be addressed and given attention. But is it possible that some of us are focusing on that too much and losing sight of what may be happening on the outside?
Thu, September 08, 2011
CSO — There's a very large push within the last few years for organizations, of all types, industries and sizes, to spend the majority of their data protection efforts on the "Insider Threat". That's to say, focusing in on the employee or temp with the access already in hand, who then could decide to misuse or abuse those given privileges. It is true, the insider threat needs to be addressed and given attention. But is it possible that some of us are focusing on that too much and losing sight of what may be happening on the outside?
Slideshow: The Data Breach Quiz
Slideshow: Security Quiz: How Well Do You Know the Insider Threat?
The question to consider here is: "What about the critical data assets businesses willingly send out externally?"
For example, a bank needs to share information with auditors, regulators, suppliers, vendors and partners. The data transfers associated with these external organizations are absolutely critical for continuing business. However, they also happen to be quite risky activities, with an elevated probability of data loss, and thus a huge negative impact to the bank's reputation, when not properly controlled.
[Also see PCI and the art of the compensating control]
With the necessity to share information, and the increase in vectors and formats in which data can be distributed, points for consideration include the following.
Threats must be considered
-- What or who is placing the data at risk?
-- The data, as it flows externally from your firm's environment, is subject to all types of threats ranging from man-in-the-middle attacks while in transit, to social engineering hacks while stored at the 3rd party's network.
Possible risks should be accounted for and documented
-- The threats mentioned above create serious risks around a firm's critical data assets. One of these risks is the obvious loss or breach of confidentiality or data. If Firm X doesn't have the proper data transmission controls, such as TLS, SSL or sFTP, the man-in-the-middle threat can successfully materialize the risk of data loss.
-- Such loss can then compound the risks and impact to an organization or entity, via such things as revenue loss, negative reputation, remediation cost, customer notification expense and loss of client trust.
The appropriate security controls need to be enabled in order to counter those threats and mitigate the risks.
-- The set of controls to consider are not only those pertaining to electronic data protection, such as software/hardware encryption.
-- This goes beyond technology, to things such as social, governance, operational and process controls, to protect against such things as social engineering and ensure other factors are in place including password policy, user access/entitlements processes and data security awareness activities.
