The encryption vendor SafeNet publishes a Breach Level Index that records actual reported incidents of data loss. While the number of losses attributed to malicious outsiders (58%) exceeds those attributed to malicious insiders (13%), SafeNet claims that insiders account for more than half of the actual information lost. This is because insiders will also be responsible for all the accidental losses that account for a further 26.5% of incidents, and the stats do not take into account that many breaches caused by insiders will go unreported. The insider threat is clearly something that organisations need to guard against to protect their secrets and regulated data.
Employees can be coached to avoid accidents and technology can support this. Intentional theft is harder to prevent, whether it is for reasons of personal gain, industrial espionage or just out of spite. According to Verizon’s Data Breach Investigations Report, 70% of the thefts of data by insiders are committed within thirty days of an employee resigning from their job, suggesting they plan to a take data with them to their new employer. Malicious insiders will try to find a way around the barriers put in place to protect data; training may even serve to provide useful pointers on how to go about it.
Some existing security technologies have a role to play in protecting against the insider threat. Basic access controls built into data stores, linked to identity and access (IAM) management systems, are a good starting point. Encryption of stored data strengthens this, helping to ensure only those with the necessary rights can access data in the first place. In addition, there have been many implementations of data loss prevention (DLP) systems in recent years; these monitor the movement of data over networks and alert when content is going somewhere it shouldn’t and, if necessary, blocks it.
However, if a user has the rights to access data, and indeed to create it in the first place, then these systems do not help, especially if the user is trusted to use that data on remote devices. To protect data at all times, controls must extend to wherever the data is. It is to this end that renewed interest is being taken in digital rights management (DRM). In the past issues such as scalability and user acceptance have held many organizations back from implementing DRM. That is something DRM suppliers such as Fasoo and Verdasys have sought to address.
DRM, as with DLP, requires all documents to be classified from the moment of creation and monitored throughout their lifecycle. With DRM, user actions are controlled through an online policy server, which is referred to each time a sensitive document is accessed. So, for example, a remote user can be prevented from taking actions on a given document, such as copying or printing; documents can only be shared with other authorized users. Most importantly, an audit trail of who has done what to a document, and when, is collected and managed at all stages.
Just trusting employees would be cheaper and easier than implementing more technology. However, it is clear that this is not a strategy businesses can move forward with. Even if they are prepared to take risk with their own intellectual property, regulators will not accept a casual approach when it comes to sensitive personal and financial data. If your organization cannot be sure what users are doing with its sensitive data at all times, perhaps it is time to take a look at DRM.
Quocirca’s report “What keeps your CEO up at night? The insider threat: solved with DRM”, is freely available for download.