Security threats Toolkit

Story: Privacy watchdog to get power to fine for data loss

• 
• 

Technical measures are required to actually know what data is lost!

This step helps focus the mind on what data is owned by a department and where it is but technical measures are required to manage and control the data such that if data is lost then the department knows what data was actually lost.

One example is the ubiquitous USB stick.

In order to ensure the effective enforcement of a USB device policy, I recommend the following 3 key steps:

1. Quantify the risk of unmanaged USB devices on your network. A good way would be to do a device scan. Any data protection solution should have this capability.

2. Define data policy on the use of USB sticks and the data and file types transferred to these devices. Identifying what file types or desktops should automatically apply encryption would be part of this effort. Data shadowing could be utilised for sensitive information and selective auditing would track what files are being distributed on specfic media types. If required, IT administrators are able to capture the complete binary code of the data transfered and save it on a centralised server. This can be assimilated to an entire mirror copy of the data and used for auditing purposes.

3. Enforce the policy. While you can do this through technology solutions you must also adopt a enterprise wide educational effort and ensure the buy-in of all senior management. Focused education and awareness is paramount to policy enforcement.

• 
• 

• 
• 
• 

Full Talkback thread