Security Manager's Journal: New Tool Pays for Itself Within Days

Computerworld - Trouble Ticket

Issue: The companys intellectual property must be safeguarded.

Action plan: Give data loss prevention a try, even though it seems similar to IDS technology.

Our intrusion-detection sensors give us about 40% coverage of our network, but we lack the manpower to pay proper attention to them. With only two network engineers  whose time is consumed with managing firewalls, the virtual private network, RSA SecurID tokens and the like  its difficult for us to get the full benefit of those sensors, which need to be tuned to decrease false positives. They do provide meaningful information, especially when an incident occurs that prompts us to monitor network traffic more closely.

So, Ive been skeptical about data loss prevention (DLP) technology, which seems to share many characteristics of an intrusion-detection system (IDS). For example, DLP technology needs to be tuned to be most effective. On the other hand, it looks deeper into network traffic than a traditional IDS and is able to detect sensitive data leaving the network.

I was skeptical when I met with representatives of Mountain View, Calif.-based Reconnex Inc. Still, its DLP product was feature-rich, and the promise that it could detect even small portions of data leaving the network was intriguing.

For that to happen, you have to first feed data to the Reconnex product. For example, if I load an entire directory of source code, it will be able to alert us should an engineer cut and paste even a small portion of it into a Yahoo e-mail message.

We decided to pilot a limited deployment of the Reconnex technology on our network.

The pilot was timely. A few days after installation, I was asked to determine whether any employees were leaking information related to an acquisition the company was contemplating. We fired up the Reconnex management console and created a rule that would flag any network traffic containing certain keywords associated with the acquisition. After a couple of days, no hits were recorded on that rule, but something else popped up that was extremely alarming.

When they installed the Reconnex tool, my security engineers experimented with various rules. They created one to watch for design documentation files on the network, and thats the rule that triggered the alert: An employee had uploaded a computer-aided design document to his personal Yahoo Briefcase storage account. Not knowing much about design documents, I forwarded a copy of the file to an engineering manager, who explained that this particular document is for the design of one of the very sensitive, proprietary sensors we manufacture. Its a design that any of our competitors would love to get their hands on. As it turns out, the employee who had uploaded this document had given his notice a few days earlier. My adrenaline was rushing.