Ben and his little Data Loss Accident
It is 8 o’ clock in the morning. Ben gets up from his bed. The first thing that he does after grabbing a cup of coffee in the morning is check his email using the hi-tech highly over-rated HSIA USB modem. He checks for the MIS system mail and starts working on it. Realizing that he is already late, Ben fetches his favorite 4 GB USB drive from his bag and inserts it into his desktop PC and copies the employee information data that he had been working on from home the other day. On his way to office in a hired cab, he transfers this data to his laptop and continues to work on it. Then he emails this file to his Assistant Manager to sync it with the company database. Meanwhile he reaches office, hurriedly pays the cabbie and enters his office chamber.
[singlepic id=34 w=320 h=240 float=center]
A great new Monday morning! Ben was busy updating himself about the status of the work when he realized that something was missing from his pockets. His purse? No! His credit card? No! A chill went through his spine with blazingly fast thoughts of impending consequences. Ben realized he had accidentally left his pen drive in the cab. The company employee payroll data with a collection of social security numbers in now free to be surfed upon by 1 billion people of this world on the internet. Ben once told that his favorite USB drive had made his life easy for sure but now he realized that the same USB drive might make his life highly miserable. Well there goes down one more fan of USB drive!
[singlepic id=33 w=320 h=240 float=center]
Even more surprisingly there is at least 1 Ben in every company in this world. And every Ben either had the same experience or will have the same experience in the future. The problem with most of us is that we think we are immune to these kinds of incidents until one great day the same thing happens to us.
It is not necessary that sensitive data will be always stolen from the company. In other cases, employees tend to misplace or lose data unknowingly which leads to the loss of the company itself.
Nowadays IT managers focus more on IT administration, IT maintenance and governance and Management Information Systems. But the most important fact is that even if IT infrastructure is there to store and process data but as long as the data is not safe, IT is useless no matter how fast it processes your data, automates business processes and accelerates your business. Protecting business is as important as making it grow.
As a matter of fact, each and every company should set aside a part of their annual budget exclusively for information security and Data Loss Prevention, be it through Physical end-points like USB drives, CD/DVD, printers or through Network paths like Emails or Instant Messengers.
In a preview interview with Dark Reading, Gartner security analyst Adam Hills said that security projects and functionality are gaining attention in the corporate boardroom and claiming a larger portion of the IT budget pie. “IT spending in 2009 is basically flat, with some companies making cuts, but we’re seeing security spending increase slightly,†Hills says. “If both of those hold true throughout the year, then it’s clear that security spending will end up comprising a larger portion of the total IT budget [than in 2008].â€According to Gartner, most importantly, security is gaining attention at the highest levels of the organization.
IT Security spending is increasingly becoming a Board-Level Decision.
Employee Monitoring! i think its Evil
There has been lot of controversy around monitoring the computer system of employees inside an organizational network. Vendors all around the globe have come up with some of the amazing employee pc monitoring systems, whether its a keylogger, a website monitor, a chat monitor, even application monitoring (which tells you what programs were used by the person), screenshot monitoring, video monitoring of the computer terminal, file copy\ modified\deleted , usb drives and other kinds of devices used etc etc.
Now, there are good points and some bad points about monitoring your employees.
The good points are:-
1. You are assured that your employees will not make a mistake of leaking out your confidential data
2. You are assured that any outsider\disgruntled insider who is temporarily using one of your computers will not be able to steal your critical data
3. You know well who is trying to access what kind of data
4. You can even find out if people are actually working or watching youtube videos during their work hours
The bad points are:-
1. You are breaking privacy of your own people
2. Employee monitoring might create serious de motivation and unhappiness among your employees
3. There could be few legal complications in some of the ways of employee monitoring
4. If access to the data generated from the monitoring gets in to wrong hands, you can imagine well what could happen next
There could be lot of other good and bad points about employee monitoring which i might have missed.
Now, lets try to find out what do you have when you start monitoring all the personal computers in your organization:-
1. You have record of every keystroke, which will have emails, passwords, credit card number, may be social security numbers, bank account details, health information etc etc
2. You will have access to thousands of screenshots and videos of the personal compters used in your organziation tracking every activity on that machine
3. You will have access to the online behavior of each and every person in your organization
It looks like you feel like going for an online monitoring systems and in fact lot of companies are doing that for a very long time. But, what about the bad points?
Its simple,why should a person buy a Christmas gift during working with his credit card. Why john should write an email to his girlfriend at the time when he is supposed to finish the proposal his boss told him to. Why bill should be trying to send a job application to another company because he wants a better job. It should have been all right if these people would have done these things from their own personal computer.
So, you see, you can justify that you should monitor your people. But, whats the proof? and what about legal complications?
There is something call job contract which is a list of points you want to have in agreement with the person you are working with and both of you sign on that only if both of you agree with those points. So, i hope you understand how can you handle those legal complications and thats a really good passport to allow you for monitoring might not be the way you want, but to some extent.
Regarding the demotivation and unhappiness crap, i dont have a clue how to get this sorted out. But, i hope all those smart CEOs and Management Gurus should be able to handle it.
Data Loss Prevention Lessons from X-Men Origins: Wolverine Movie Leak
X-men Origins: Wolverine Poster
On the night of 31st March, 2009 something happened that people initially took as an April Fool’s Joke. But as slowly as millions and millions of people started downloading the workprint of Fox’s upcoming much awaited mega release X-MenOrigins: Â Wolverine, the joke turned into a stark reality that turned into a stressful nightmare for the Fox company. The stage at which this workprint was stolen leads to a suspicion that it was stolen by somebody from within the company and leaked into the Internet as a true DVD quality print.
With the entire movie file being in near-finished DVD quality rip and with just a few unfinished graphics FX scenes the entire movie was almost theatre ready. With such a sky-high budget movie getting leaked over a month before its stated release date, Fox seems to be anticipating a very high loss margin. Fox has declared that it would take strict action against all those people who are responsible for this incident. FBI and MPAA have swung into action now and recently raided a Texas Data Center related to trails involving this incident. At the time of recession and layoff and funds being taken away from industries, Hollywood is already facing a big problem in finance and investment.
X-men Origins: Wolverine Teaser Poster
But anyone who would see this movie would definitely say, “Nah! It’s no fun watching this movie in a Home theatre System or a Laptop. I am going to the theatre in May to see this incredible movie.” Frankly, every dollar that you pay for watching this movie is worth it! The scenes are breathtaking, the storyline keeps you hooked on as if you are listening to a true story-teller and the FX is something which you won’t enjoy unless you go to a Digital Dolby Theatre and let the FX immerse you in a world of fantasy.
However, whatever be the case, Fox has definitely suffered a huge loss due to lack of awareness and protection against Information or Data Loss. The entertainment industry continues to produce creative assets that sell to bring in huge ROI. For such industries, digital asset and information protection from Data Loss is one of the most important management policy which Fox had overlooked and suffered the consequences.
X-men Origins: Wolverine
Data Loss Protection no doubt is a billion dollar market in the entire world and bringing in huge investments. Even antivirus companies are acquiring Data Loss Prevention companies to bundle their products with their own thus selling a complete security suite for personal computer users as well as the Enterprise or Corporate offices. Such Data Loss Prevention products are readily available in the market which block and secure USB drives and other ports through which data can be stolen or leaked or malicious data can enter the entire system.
With USB drive storage capacity reaching sky-high standards, It’s not that only companies and corporate offices who need to be aware about protecting digital information and files but even personal individuals should lock up their USB ports to prevent unauthorized access to their computers when they are unattended.
Dataresolve Technologies have already released two version of the product called uHook Personal for home users and corporates respectively. The company is soon coming up with uGuard (code named) which promises excellent USB drive security by blazingly fast strong encryption of the USB devices, such that even if anybody steals and takes the data out of the enterprise but he won’t be able to use it outside of the company. It’s high time you understand that every PC user has been a victim of data theft once atleast but why not prevent it from happening in the future.
