It takes more than technology acquisition to protect against the insider threat -- just ask the NSA

Jared Thorkelson, Contributor

October 28, 2013

2 Min Read

Recent news reports indicate the NSA had acquired technologies to help prevent the leakage of classified data, but failed to deploy them before contractor Edward Snowden began working there. The technologies in question were purchased in the wake of the 2010 WikiLeaks scandal, but went uninstalled at NSA's Hawaii facility due to what was described as "bandwidth issues."

The path that allowed Snowden to pilfer large quantities of classified information was paved by the NSA's failure to deploy the technologies the agency had already acquired and presumably deployed at other facilities. As the technologies sat unused by the Hawaii facility, Snowden was, in essence, aided and abetted by shelfware.

This calls to mind an all-too-common story in many of today's enterprises when acquired technology is simply not deployed, but sits on the shelf where it may look good -- but doesn't do jack squat. With some technologies, the impact of not having these technologies in place is minimal. But when it comes to safeguarding sensitive data and protecting against inside threats, you could be playing a very high stakes game of chicken. And the consequences of losing the game? Simply disastrous. Just ask the NSA.

But lest I get too dramatic in my oversimplification, shelfware does not always represent a simple failure to deploy. In terms of the inside threat, there are varying levels on the fail scale, each of which we have likely encountered in our own experience. It's one thing to stick your head in the sand and pretend the threat does not exist. It's another to courageously acknowledge the threat -- but take no action. And it's something else entirely to face the threat head on, acquire technologies to protect against that threat, and then fail to put the technologies to their most beneficial use.

That said, we all know efforts made in good faith sometimes go awry. The overall initiative to protect against the insider threat may be carefully planned over months or even years, with meaningful requirements established, budgets approved, RFPs released, products evaluated, and, ultimately, dollars spent. But if organizations fail to put the technologies to their most effective use, budget is wasted and, worse yet, sensitive data is put at risk.

While we may not often see instances of blatant shelfware in our own organizations, where acquired products never even see the light of day, most organizations are guilty to some degree of lesser offenses when acquired technologies are not used to their full potential. Failure to make the most of a technology purchase may sound trivial or, at worst, just a sin of omission, but as demonstrated by the NSA's recent experience, the results can have very serious consequences.

About the Author(s)

Jared Thorkelson

Contributor

Jared is president of DLP Experts, a value-added reseller dedicated exclusively to data loss prevention (DLP) and other data protection technologies and services. For over twenty years Jared has held executive level positions with technology firms, with the last six years focused in the area of DLP and data protection.

His longtime vendor-agnostic approach to DLP technologies has netted him extensive tribal knowledge in the form of features and capabilities across many leading DLP vendors. He leverages this insider information for the benefit of his customers as they consider the best technologies to meet specific technical and budgetary requirements. Jared has long promoted the idea that DLP is not a product, but a process, with enforcement technologies being just one step of many. His company's unique approach, referred to as DLP.IQ, supports this step-by-step process from start to finish.

Jared is a recognized writer and speaker on the subject of network security and has participated in many industry events throughout the US, Latin America and Europe, including (ISC)2, BrightTALK, BankInfoSecurity.com, Infosecurity Europe, ISPCON, and Internet Business.

Jared earned a degree in English from BYU, which he now uses to write a blog.

You can cyberstalk Jared at www.linkedin.com/in/jthork and www.DLPExperts.com or just email him at [email protected].

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights