Endpoint Protection

Now here is a topical subject on the eve of the A level results due out tomorrow. If you have a someone who is waiting for results then you have my sympathies. The waiting is excruciating!

But if you are the ones who do not necessarily get what you hoped for then the DPA is here to help. According to the Information Commissioners Office, an individual can access personal information about themselves from any organisation. This is known as a Subject Access Request (SAR). Students wishing to know more about why they were awarded certain marks can use a SAR to request examiners’ comments from examinations scripts. Students who appeal their results can also request the minutes of appeals.
At last, it seems that the DPA actually has some value to the public as opposed to its oppressive prevention of access to information.

So don’t delay, use your rights and use your SAR. Its nothing to do with SARS!!

It is really worrying that organisations are completely blind when asked if they know what critical information exists and what their employees are doing with it. So many customers regard DLP as only a product that will solve all security ailments.

At the moment employers have no choice but to trust their employees as there is no alternative. Organisations have no real idea what data is confidential, where is it being held and where it is going to. However, as disgruntled ex-employees continue to take all their data with them whether unintentionally or maliciously the result is the same. The potential for important information to be removed. As more organisations rely on outsourcing and the use of partners to advise, project manage, augment skills so the problem gets worse. 
So the trust is breaking down particularly as cuts are coming but still organisations have no idea what to do

So what is the answer? Not an easy one for sure. First thing is to work out what data there is and where. Look for something that will index your endpoints so that live keyword searches can be used to identify what data is stored and where. Secondly, start to categorise your data into no more than four levels such as Internal Use Only, Confidential, Confidential and Restricted, Critical. Then decide on the policies required at each level. Once you have a classification and the policies for security then you can start to develop the DLP policies to protect the data.

So the basic answer is ‘No you don’t trust them’ but until work is done there is no choice.

See my next post on the economic climate and the impact on data loss

On the 12th December, it was widely reported that another laptopn was taken from MOD Headquarters in central London. This would not normally cause worry as all laptops are encrypted. However, the encryption key was also taken so exposing the information to the thief. It is not known if there is any exposure whilst investigations proceed. However, news items referred to the laptop as a ’secret data laptop’ which gives an indication. It was only in July thsi year (as reported in this blog) that 658 laptops have been stolen from the MOD in the last four years.

Below is one report on the story but the BBC also have reported it

http://www.pressassociation.com/component/pafeeds/2009/12/12/secret_data_laptop_stolen_from_mod_headquarters?camefrom=regional

St Albans City and District Council is the latest organisation to lose four laptops with personal data on over 14,000 voters. Files contained names, addresses, dates of birth, signatures, postal vote forms and statements which is all the information required to obtain a bank account.

Councillors were recently debating the loss and how the laptops could be stolen from the actual offices. Even though the data was protected, the portable devices were not physically secured. This goes against council policy of portable devices being physically as well as logically protected.

It also begs the question as to why personal data was held on portable devices. Such data should only be accessed on central resources and users prevented from copying to local devices.  We shall see what lessons will be learned and then forgotten til the next time.

The council needs to develop an information classification with associated policies on protection. A simple Data Loss Prevention product would have prevented the personal data from being copied in the first place but, had it been copied then the data would have been encrypted. It is noted that one of the laptops was left for months on an unused desk with no one knowing that held all this data. This is why an information audit and classification is required to start to get some control.

This story has been widely reported so use these links for more detail (such as there is)!!

http://www.stalbansreview.co.uk/news/4760711.St_Albans_councillors_debate_laptop_theft/

http://news.bbc.co.uk/1/hi/england/beds/bucks/herts/8363514.stm

http://www.stalbansreview.co.uk/news/4743799.St_Albans_council_worker_claims___Laptop_was_ignored_for_months_/

Latest reports on conficker infections include not only Ealing Council (see previous post) but also Oxford Brookes University, Manchester City Council and Whipps Cross University Hospital NHS Trust. Prior to this, the Houses of Parliament and Ministry of Defence were infected.

So AV has been proved to be powerless with this worm and even the DLP vendors do not have any defence as they tend to focus on information passing out of the organisation. Application control should be a part of a DLP solution to stop worms from running and spreading to the rest of the organisation. In most cases it is not as AV and most DLP is focused internally not at the endpoint which is the highest risk. Maybe Windows 7 will save us but how many will implement the application control features and AV and DLP. Not many I fear - Take a look at our sponsors product and if implemented will protect against zero day attacks and Conficker worms as well as the normal DLP features.

It is clear from meeting customers that the technology fix continues with security - the belief that a product will solve all the security problems in an organisation. This misguided expectation is exploited by vendors who sell every flavour and permutation for each identified security flaw. This results in customers wasting a lot of money on shelfware (software that is never installed and sits on the shelf) or problems trying to effectively deploy the product with no clear idea of configuration or threat.

However, simple consideration before buying a product fix could be to consider what are the security policies that an organisation shouid reasonably implement which would then save time and money. With protection of information, it is vital to define the policies that are reasonable and actionable to do the job. Once the policies have been set, agreed and communicated then the tool can be matched to the policy.

So many clients buy a product that they cannot effectively use as there are no existing policies defining what the product should do. It takes time to get the product reflecting the policies. From experience, one should start with strategic policies that, at a high level, define the overarching rules of the organisation. These can then be broken down into tactical policies. From the tactical policies, the standard operating procedures can be defined and written.

In summary, product purchase is used as an excuse for ‘ doing something’ wiht security but with no organisational framework defining its use.