Steve Wright is a Senior Manager for Risk Assurance Services with PriceWaterhouseCoopers in the United Kingdom. Steve and I have worked collaboratively over the past year on a number of web presentations related to issues related to ISO 27001 and the PCI Data Security Standard. In fact, Steve will be doing a presentation with Ecora on How companies are using the PCI Data Security Standard for improving the Security & Performance of Information Systems on September 24th at 10am Eastern. You can register here.
Recently, British papers reported on the loss of a significant number of criminal records from the Police National Computer. In response, Steve was willing to share these thoughts on the subject of preventing data loss.
"Unfortunately, Friday 22 August 2008, we once again awoke to the news of yet another data loss incident. This time, it is the personal records and intelligence on tens of thousands of UK prisoners, including secret dossiers on the UK’s 10,000 priority criminals – a kind of who’s who in the criminal world. Such a lapse in basic data security also puts at risk police informants, as a number of unspecified people included in the data breach were enlisted on the drug intervention programmes.
This makes the data highly valuable in underground world of data intelligence and literally can put ‘lives at risk’. The incident appears to involve another third party responsible for handling the data, but alas, the data had been unencrypted for data transfer reasons – the very opposite of when data should have remained encrypted.
So what could of have been done to prevent such an incident in the first place?
Well, it may be easy with hindsight to point the finger and cry negligence. The Home Office investigation will no doubt come to some conclusions, but it does not matter now, for 88,000 prisoner records is currently unaccountable for. One possible solution would be for the Home Office to look at what could have been done to prevent such a loss occurring in the first place – also known as a Data Loss Prevention (DLP) review. A DLP review could have possibly identified areas of potential weakness in either the Home Office or its trusted third parties key data handling processes and hopefully mitigated or managed the risk accordingly.
What is Data Loss Prevention?
DLP addresses three fundamental questions:
(1) Where is my confidential information being held? – This includes the data’s entire lifecycle or journey and where the data is being stored (third parties, off-shoring, outsourcing)
(2) How is the data being used? – This should include why, when, what and who accessed it
(3) How can we best prevent data from being lost? – What are the risks and thus what possible mitigating actions could be deployed to avoid loss, theft or compromise?
At the heart of Data Loss Prevention is understanding what the value of the data is to the organization, how everyone is responsible for ensuring its ‘health and safety’ – in essence, this can only be achieved through a comprehensive understanding of the risk (risk analysis) facing your data, and educating the people who handle or access it, i.e. mandatory training for all people who come into contact with it.
This may appear like a basic concept, but it is one that is often neglected - as with treating any symptoms, understanding the cause is paramount. Understanding why data is important to others and how easily it can be lost, compromised, manipulated or stolen, is a critical part of the process of understanding DLP and winning the ‘hearts and minds’ of every employee, third parties and person who comes into contact with the data.
Either way, once the UK Home Office has completed its investigation and lessons learnt, we can be pretty much guess what some of the findings and recommendations will be – Possible Finding; ‘a systematic failing of following basic procedure, further exacerbated by the lack of adequate training on data security procedures. In other words, a pragmatic approach to DLP may have avoided such an incident; and by ensuring all persons who come into contact with the data (i.e. third parties) receive an appropriate level of mandatory security and data handling training, such lapses in basic data security may be avoided in the future."
An item that I might add to Steve's comments are the essential need to understand how the infrastructure is configured around where key data is stored and accessed, as well as the applications that use this data. Without ensuring that access is limited to authorized personnel only and that appropriate security steps are employed related to password length, complexity, and frequency of updating, especially those for administrative accounts, any data is prone to be inappropriately access and potentially leveraged for criminal activity. As we'll demonstrate in Steve's upcoming presentation, Ecora Auditor Pro can automate the identification of current users, password information and NTFS share and permissions so that you can quickly remediate situations that don't meet your security policies and, in all likelihood, external government or industry regulations.
Contributed by Steve Wright, Senior Risk and Data Security Practitioner at PwC and Mark Tordoff
