Whodunit? Stop these employees from leaking your corporate data
Was it the receptionist, the salesman or the building manager who gave away company secrets? Here's how to find and stop the leaks.
Computerworld - You might know how to secure your network devices and data centers to keep your corporate intelligence safe. But do you know how to teach your employees how to guard against attacks -- not generically, but based on the work they do? Experts suggest that a well-constructed security plan involves customized training by job function. You need to tell your HR people to manage personnel files that might reside in multiple locations, your facilities crew to watch out for people entering the building with fake IDs and your salespeople to guard access to the company's CRM system.
Read about the key security threats in each of six job functions, and learn tips from security experts like Ira Winkler for spotting the most common ploys of con artists who make it their job to extract sensitive corporate intelligence from unsuspecting employees. And finally, ask yourself: How far will you go to defend the privacy of your customers' and employees' personal data? Columnist Mark Hall looks at the stellar example librarians have set in protecting their patrons' privacy.
Trusting an employee with access to mission-critical or sensitive systems is a risky but unavoidable gamble. Let's face it: People are wild cards. In fact, let's take the gambling analogy a step further. Just as casinos thwart cheaters at every table or station on their floors, so, too, can IT officials thwart breaches by customizing security plans for individual employees in every zone of their companies.
In fact, casino practices can be translated to the corporate IT world to create at a common-sense list of do's and don'ts for redoubling security based on who does what job. The lessons we learn from craps pits and blackjack tables reveal that it's never wise to entrust your business's most valuable or vulnerable assets to a single employee. Instead, compartmentalize access whenever possible, and never hesitate to look over employees' shoulders.
Above all, follow the golden rule of a casino: Gauge your level of risk and develop airtight audit trails, urges Bruce Schneier, a security expert in Mountain View, Calif., who has written several books on computer and network security, including Applied Cryptography (Wiley, 1996). Schneier often uses the casino metaphor to drive home important points surrounding individualized security. "If you look at a casino floor, you will notice immediately that people are watching people," he says. "That's because a lot of cash is moving, and it's moving very quickly."
Just as edgy casino managers constantly size up everyone on the floor as potential security threats, so must corporate IT security leaders size up every employee. "People are the weakest link in security. They always have been, and you will never change that," Schneier says. "But the reality is that you've got to deal with people, and people are going to make mistakes."
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts