Trust No One

Have you read the latest issue of our digital (IN)SECURE Magazine? If not, do it now.

It’s easy to say what we’re all securing our systems and data against. But isn’t easy to say exactly who we need to secure against, nor who presents the biggest threat to our business. Certainly, the largest ever data breach – 45 million credit card records stolen from retailer TJX – was committed by criminals. But the second largest, last year’s loss of over 25 million child benefit records from Her Majesty’s Revenue & Customs in the UK, was caused by an ordinary public-sector employee putting two unencrypted CDs in the post.

This highlights the real problem. Anyone can cause a data breach – whether wittingly or not. As computing becomes pervasive, with data being accessed, worked on, saved and sent from almost any location, it’s not just the notional “bad guys’ we need to protect against: it’s ordinary people too.

Because we all make mistakes. We think it will be OK to bend the rules, just this once. And unfortunately, one such incident is all it takes to make a business-threatening data breach. Let’s take a closer look at just some of the types of people, and everyday circumstances, that can present this type of security risk.

Can I take that with me?
The overwhelming majority of data leaks reported in the UK over the past year happened because ordinary employees copied data to disks or devices that they shouldn’t have. It’s easy to do, and in most cases, is done innocently. But it’s the first step towards a breach.

In November 2007, Check Point surveyed 140 IT managers and directors in British public and private sector companies. 73% said their published IT security policy covered data protection issues such as use of USB drives. Less than half the sample had any solutions in place (such as data encryption, or port control) that would actually enforce those policies. It’s no surprise that people will continue copying data. They’re just trying to work as efficiently as they can, aren’t they? But unless policies are actively enforced by the use of IT solutions, leaks will continue to happen.

Local customs
Last month, the US Department of Homeland Security confirmed what some weary travellers already know: border agents are allowed to search through files on your laptop, Blackberry, smart phone or any other digital device when you enter the country – even when there is no “reasonable cause’. Officials can keep data or the entire computer, copy what they want and share this data with other agencies. Even if that data is encrypted, are you really going to refuse to give the password? How far will quoting your rights take you? Of course, if the data is not suspicious, guidelines say the copied data should be destroyed. Can you be sure of this? And given the recent track record of Government bodies losing sensitive data, would you want your data in their hands?

Terminal case
Internet kiosks and terminals in departure lounges are a sore temptation for many business travellers. It’s a last chance to check emails before that long flight, or make last-minute changes to an important presentation. After all, it’s just making best use of down time. What happens to that sensitive data after the person’s finished with the computer? Is the data really permanently wiped from memory? Did they leave a USB stick behind? What are the implications for the company’s security policies if such data is being processed on an unsecured PC? Sometimes, it’s a company’s top guns that take the biggest risks with data.

Cold shoulder
Don’t forget that people can steal data by simply looking and reading, even when you’ve locked down the electronic routes for data theft. A senior executive that I know was flying to the UK, and had to tell the person next to him that 1) he could read the high-level presentation on his neighbor’s screen and 2) that their two companies were in fact deadly rivals. This sparked a lively conversation. And while the chances of this happening are small, it shows you can’t be too sure who’s looking over your shoulder.

The big fix
What do you do if your home PC or laptop goes wrong? Well, this really depends on the type of repair. If it’s a hardware repair, then consider keeping the hard drive and sending the laptop without it, to keep any personal or business data secure against malicious or well-intentioned copying. If the drive itself is faulty, be very careful who you choose to try and fix it – the data is still likely to be salvageable. It may be safer to destroy the drive and get a new one fitted – which is why regular back-ups not only keep you running if a PC is faulty: they’re also important for security.

Trust, but verify
These examples make the point that your data is only a couple of steps away from misuse, and the intentions behind that misuse actually do not matter. Of course you need to have trust in your staff. You should be selective over what you entrust to them, and also verify that security is maintained. To protect against leaks and breaches, security has to be automated, and set up so that your employees cannot tamper with the process. Don’t leave decisions on what to secure, and when, to your staff. First, it’s not their job to decide this, and second, nor should they have to worry about it. It means thinking about what data you allow your staff – at all levels – to carry with them. It means automatic encryption of disks on laptops, and the same for any data, which is copied to portable storage devices. By taking the potential for human error out of the loop, you make a giant stride in security.