Data Lockdown

Elizabeth Millard

12/15/2009

Locking down customer and employee data can be rife with challenges, but proper security measures are imperative and often involve multiple layers of defenses and processes. Here’s a look at what you need to know about protecting your valuable data.

Security Challenges

Securing the entire data pathway is a difficult task because all data is seen by someone, notes Christopher Cain, director of software development at AppRiver (www.appriver.com), a provider of exchange hosting.

“In order for a business to comply with today’s strict regulations, the entire pathway for data—from secure storage to the point of dissemination—must be secured,” he says. “It is no longer adequate for organizations to simply store customer and employee data in an encrypted form on a secure server with good access policies in place.”

An important aspect of securing customer and employee data is making sure that email controls are in place, Cain says, because emails can include financial data in spreadsheets or personal information transferred from HR to health departments, for example.

Ensuring that transmission of data is encrypted is not enough, he believes, because it doesn’t provide end-to-end security. Instead, the email sitting in one user’s inbox is stored in an unencrypted form on the machine or on the company’s server. “This is why end-to-end email encryption services are the only types that should be considered,” Cain says.

That approach includes a cost-effective solution that provides ease of use, high security, and security policy management, he adds. For instance, some applications include a policy control that looks for security cues in an email and then makes a decision if the email should be encrypted before it’s delivered.

Physical security is crucial, as well, Cain says. Although it seems obvious, making sure all servers are kept in a secure storage facility is an area that sometimes gets overlooked. “Of course, every network should also be secure at every possible point of dissemination for that data,” he adds.

The Human Factor

Another major challenge is auditing administrative-level users. These individuals are particularly important to track because they can create back-door logins and other configuration items and can cover their activities.

For the administrative-level users, there should be strong password policies and also more focus on those few highly privileged users, notes Martin Ryan, vice president of sales and marketing at e-DMZ Security (www.e-dmzsecurity.com). “They have the access and knowledge to do the most damage,” he says. “By focusing on those users that can do the most harm, you can free up budgets from unnecessary monitoring of users that cannot do major damage.”

That focus includes putting in stronger audit capability, he adds, and implementing individual account abilities so that an IT manager can see who logged in using the admin account password. An added security level is recording and monitoring access—essentially, doing session recording of everything so that there’s a record of what’s been done and by whom.

Ryan notes that strong password change controls can be another security measure for improving the safety of customer and employee data. Some companies have found better protection, for example, by changing passwords each time after use for privileged accounts.

Additionally, automation can be a boon for every strategy, notes Raphael Reich, senior director of marketing for data governance solution provider Varonis Systems (www.varonis.com). Specifically, automation can be used for such tasks as regularly collecting permissions and permissions changes, auditing data access, looking for indicators of when access is no longer needed, and even implementing automated access entitlement systems to connect data users with data owners—who can then place time limits on access, for example.

Extra Measures

Some industries will require even more security controls, such as healthcare and financial services, which are covered by regulatory mandates. At some level, though, many companies are affected by these rules, even if they aren’t healthcare firms specifically.

“Customer and employee data protection is cross-industry with compliance requirements such as PCI and HIPAA, bringing added focus to those companies that process credit card transactions or deal with patient records,” says Ryan. “[Sarbox], though a bit more generic in nature, drives compliance at some level to every public company.”

The good news is that compliance can sometimes drive better security at a company, Cain adds. Although regulations can add pressure to already-strained budgets and mounting end-user requirements, many organizations may view them as an opportunity to improve systems and upgrade infrastructure to stay ahead.

“The bottom line is that every organization should be managing data protection proactively and not waiting until something bad happens to them or their industry,” Reich says. “That is not a forward-thinking business strategy; it is a recipe for disaster. Good risk management means balancing risks, the likelihoods those risks will occur, and resultant costs.”

Article by Elizabeth Millard for

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

Weekly ITEC-TV netcast live or on-demand!

Featuring ITEC General Manager Bill Sell and ExtremeLabs analyst Tom Henderson every Wednesday at 4:00 PM Eastern time.

Each week ITEC-TV hosts leading IT experts examining the day's most newsworthy technology issues.

ITEC Conference & Showcase

ITEC Connect

Data Lockdown

Elizabeth Millard

12/15/2009

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV

ITEC Conference & Showcase

ITEC Connect

Data Lockdown

Elizabeth Millard

12/15/2009

Subscribe to ITEC Connect Newsletter

CONFERENCE SCHEDULE

National Association Partner

ITEC-TV