Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


How To Prevent Data Leaks From Happening To Your Organization

Data can find its way out through accidents or malice. Here are some tips for keeping your essential information from walking out the door.

What worries IT: a hacker lurking in the Internet's dark corners or Bob in accounting? Turns out it's both. Company employees pose just as much of a threat as cyberthieves, according to InformationWeek's 2012 Strategic Security Survey of business technology pros.

And yet, insider threats represent only a fraction of all attacks--just 4%, according to Verizon's 2012 Data Breach Investigations Report. So why the fuss? Because insiders have access to critical company information, and there are dozens of ways for them to steal it. And these attacks can have significant impact. Last year, a Bank of America employee sent account information on hundreds of customers to identity thieves, who used the information to steal money from those accounts. Losses totaled $10 million, not to mention the public relations fallout from the incident.

The threat insiders pose is compounded by the fact that IT tends to focus on securing the perimeter of the network from external attacks and pays little attention to malicious activity inside the network. The increasing mobility of corporate data and devices is making it even easier for insiders to steal data. Clearly, it's time companies rethink their security strategies to cover both the malicious hackers and Bob in cubicle 3B.

Insider threats can be either intentional or accidental, and you often can use one set of controls to mitigate both of these. You'll want to target three layers to address the insider threat: the network; the host device; and the people who generate, manipulate, and move data from one place to another.

At the network layer, controls must be capable of analyzing network traffic to detect and, when possible, prevent the transmission of sensitive data. Host-based protections include anti-malware, encryption, change management, and other security controls. The most difficult element of defense is the human factor--implementing policies and training to educate employees on proper handling of sensitive data. Here are steps you can take to secure all three layers.

Lock Down The Network

The two most common avenues for insiders to move data out of the enterprise are email and the Web. Both come into play with malicious and unintentional data breaches, and the intent may not always be clear at first glance. Employees using corporate email accounts may inadvertently send sensitive files to the wrong address. Meanwhile, someone who wants to steal sensitive information may use a personal Web mail account or upload information to a Web-based file-sharing site.

Therefore, email and Web security gateways are an important first line of defense against accidental and malicious breaches. These gateways are commonly used to inspect inbound traffic for spam and malware, but they can also be deployed to monitor outbound traffic. An internal security gateway sits in- line and acts as a relay, or proxy, to Web and email traffic that employees generate.

Gateway offerings from vendors such as Barracuda Networks, Cisco IronPort, McAfee, and WebSense have data loss protection features. As the traffic passes through the gateway, the DLP module inspects it for terms that are known to be sensitive within a company. It also looks for patterns involving specific data types, such as credit card and Social Security numbers, or specific classification labels on files that shouldn't leave the corporate network. If this sort of data is found to be moving out of the network, that could raise red flags. The traffic would then be blocked and the user notified. Alerts about a potential policy violation can be sent to a variety of recipients, including the security team, human resources, and the user's supervisor.

In addition to analyzing Web and email traffic, network-based DLP products can monitor protocols and services, including instant messaging, social networking sites, peer-to-peer file sharing, and File Transfer Protocol.

However, encryption can blind DLP and other gateway security products. If users are savvy enough to encrypt the data before sending it or use an encrypted network transmission method such as SSH/SCP or Tor, the data will bypass network-based DLP. To help address this limitation, DLP products typically include options for host- and storage-based DLP, which we'll discuss later.

Another network-level option is a behavioral anomaly detection system, from companies like Lancope and Riverbed Technologies. These products create a baseline of normal network activity and then send alerts when activity deviates from the baseline. For example, say a computer on the network typically touches about 12 other computers and servers, and transfers about 100 to 200 MB a day. If one day that computer touches 20 or more other systems or transfers 500 MB from a file server or a database, the behavioral anomaly system alerts an administrator.

Carnegie Mellon University's CERT Insider Threat Center has identified several insider attacker behaviors, one of which shows that insider attackers usually act within 30 days prior to leaving their employers. They download data from a company server to their workstation, then email it out, burn it to a CD, or copy it to a flash drive. The bulk data download is where a network anomaly detection system could detect the user's activity and flag it.

However, behavioral anomaly detection systems have drawbacks. For one, they can't send you an alert saying, "Looks like Bob is trying to steal a bunch of records." Instead, IT gets reports on odd application and network behavior, and it's up to security staff to investigate. That means digging into logs, reviewing network activity, and talking to people. Investigations may turn up harmless, though unusual, activity. IT and security teams must be prepared to invest time and effort in properly tuning a behavioral anomaly system, parsing reports, and investigating alerts to get value from such a system.

IT can also use tools designed to watch for anomalies in databases. They're prime targets for insiders because they contain valuable corporate information. Database activity monitoring products from vendors such as Imperva and IBM can provide insight into the activities between users and the database server. DAM products operating at the network or host layer and can detect unusual behavior, such as a user accessing 1,000 records when that person typically only views 30 or 40 a day.

chart: Does your company use mobile device management software to set and enforce a single security policy across different types of devices?

chart: Which of these technollogies or practives are very effective in protecting your company?

1 of 3
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
11/28/2014 | 3:07:03 PM
Pending Review
This comment is waiting for review by our moderators.
User Rank: Apprentice
5/10/2012 | 6:28:27 PM
re: How To Prevent Data Leaks From Happening To Your Organization
Thanks for the great article, John. I definitely agree with the points here. I actually expanded on your piece in one of my blog posts:-http://identitysander.wordpres.... -Of note,-IT should-consider proactive controls inside the applications and platforms that can be placed there by IAM - I think that can cut down on inappropriate insider behavior. Thoughts?-
G Jonathan Sander, Quest Software
User Rank: Apprentice
4/10/2012 | 10:01:19 AM
re: How To Prevent Data Leaks From Happening To Your Organization
Good to know about the How To Prevent Data Leaks From Happening To The Organization
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-20
This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request ...
PUBLISHED: 2021-01-20
This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forwarded-For header.
PUBLISHED: 2021-01-20
Keymaker is a Mastodon Community Finder based Matrix Community serverlist page Server. In Keymaker before version 0.2.0, the assets endpoint did not check for the extension. The rust `join` method without checking user input might have made it abe to do a Path Traversal attack causing to read more f...
PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. When receiving a query, dnsmasq does not check for an existing pending request for the same name and forwards a new request. By default, a maximum of 150 pending queries can be sent to upstream servers, so there can be at most 150 queries for the same...
PUBLISHED: 2021-01-20
A flaw was found in dnsmasq before version 2.83. A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. This flaw allows a remote attacker, who can create valid DNS replies, to cause an overflow in a heap-allocated memory. This...