Risk //

Compliance

10/23/2014
12:33 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

20% Of 'Broadly Shared' Data Contains Regulated Info

Forget shadow IT. The new risk is "shadow data."

You're already worried about "shadow IT" -- the applications, mobile devices, and cloud services your users are using without your OK -- but what about "shadow data"? Even if your users are only using the file-sharing technology you gave them, you're not necessarily protected from over-sharers -- the people who share data (even sensitive data) with the entire organization, external parties, or the general public.

Twenty percent of such "broadly shared files" contain regulated data, according to research released today by Elastica. Of that data, 56% was personally identifiable information, 29% was personal health information, and 15% was PCI-protected credit card data.

That all adds up. On average, each user has over 2,000 files stored on the cloud, and 185 of those (about 9%) are "broadly shared," according to the research. Yet averages, in this case, are misleading -- which is good news.

"Most [data sharing] violations," says Elastica CEO Rehan Jalil, "are casually coming from a small group of users." In fact, 85% of the total risk exposures are attributable to only 5% of users. Identify and rope in those users, and most of the problem is treated. (The research cannot tell us whether or not those 5% share any common characteristics, from company to company, because the data was anonymized before it was analyzed.)

"The most surprising thing [about the research] was that, even for IT-blessed file-sharing applications, users' behavior is very casual at this point," says Jalil. "They share [files] however they want."

Some of the ways in which files are over-exposed include shared folders that are accessible to employees who don't need access to the data, folders in the cloud that continue to be accessible to users who have left the company, direct links to files emailed to people inside and outside the company, or unchanged default settings that make files public.

Jalil says that protecting against shadow data in the cloud requires IT security professionals to adopt "a completely new mindset, because on the surface, it looks like a managed service," but in truth, it isn't managed very well.

Read the full report, in the form of an infographic, here.

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
10/28/2014 | 12:15:01 PM
Re: The other Elastica
Netskope reported some recent research recently on the explosion of sharing activity recently. The data revealed sharing activity that went beyond what people typically think of sharing via cloud storage -- such as enterprise financial, human resources, project management and productivity apps . Interesting data. More here in a Dark Reading commentary  for whoever is interested. 
JessicaMorrison
50%
50%
JessicaMorrison,
User Rank: Apprentice
10/28/2014 | 10:44:40 AM
Re: The other Elastica
I love the band Elastica! The songs Connection and Car Song consisted of many playlists and burned cds Sara, you have great taste in music. :)

Shadow IT is definitely a concern we've seen with many customers and with constant changes to regulatory compliance like PCI DSS and HIPAA, Shadow IT will need to be controlled and monitored closley but in a way that doesn't inhibit the business either. We want IT to be seen as a business enabler and operating in this environment is possible so long as IT is assessing, auditing and protecting data on the move. It also helps to have compliance and security awareness training in place that stripes people, process and techonology. All too often we see human error contributing to failed audits or breaches, which is unfortunate because most people are well intended. A littie information on what is considered sensitive data can go a long way. 

Thanks for covering a great topic.

Jessica Morrison, GRC Sr Product Marketing Manager, Dell
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
10/24/2014 | 2:00:27 PM
Re: The other Elastica
Nice, it's been awhile but I did own their CD back in the day. 

Shadow Data is indeed a huge concern, and most employees are probably guilty of at least one count of oversharing data that probably shouldn't be even stored in any cloud storage offering.  I've always been a fan of whitelabelling, putting data tags to hopefully reduce the ability for misuse of data, but the reality is that there ar eso many ways to circumvent systems and policies that this will always seem to be a headache for IT and security folks.
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
10/23/2014 | 7:54:54 PM
Changing the Format of Sensitive Data
While these statistics for over-shared data may appear small, there is another issue that is hinted at here not often talked about.  That is, the format of the data.  What makes certain types of data so attractive to share is the format used to store it.  For instance, the MP3 is so easily passed amongst users that millions of songs exchange hands everyday without a second thought.  The same is true of books in PDF format.  The nature of the "file" as we know it today, whether that is on a UNIX or Windows file system, contributes to this very over-sharing.

Now consider the alternative.  For all types of data that are regulated by nature, there is an opportunity to standardize how that is delivered, stored and viewed to not include "files", thus causing over-sharing to no longer be possible.  If not a file, then what?  Well, we shall see...  Add on top of this variable encryption and decryption schemes and biometric-based access and you could all but eliminate the misuse of regulated information.  Too expensive to implement?  I suspect that depends upon how much regulated data integrity is worth to you, and how much it costs every year to deal with cases of over-sharing.  

 

 
Thomas Claburn
50%
50%
Thomas Claburn,
User Rank: Ninja
10/23/2014 | 6:43:18 PM
Re: The other Elastica
If we're going to highlight British bands of yore, I'd vote for Shriekback (which is still around and about to release its 13th recording).

www.youtube.com/watch?v=6bMM61Y5CEU
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
10/23/2014 | 4:25:44 PM
The other Elastica
I know this has nothing to do with data security, but does anyone remember the British band Elastica? I listened to their first album incessantly in 1995. www.youtube.com/watch?v=ilKcXIFi-Rc
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
Why the CISSP Remains Relevant to Cybersecurity After 28 Years
Steven Paul Romero, SANS Instructor and Sr. SCADA Network Engineer, Chevron,  11/6/2018
5 Reasons Why Threat Intelligence Doesn't Work
Jonathan Zhang, CEO/Founder of WhoisXML API and TIP,  11/7/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1786
PUBLISHED: 2018-11-12
IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.
CVE-2018-1798
PUBLISHED: 2018-11-12
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...
CVE-2018-1884
PUBLISHED: 2018-11-12
IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerabile to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.
CVE-2018-19203
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.2.41.1652 allows remote unauthenticated attackers to terminate the PRTG Core Server Service via a special HTTP request.
CVE-2018-19204
PUBLISHED: 2018-11-12
PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can cr...