I just read though the 2014 Verizon Data Breach Investigations Report (DBIR) which was made available on Verizon’s Enterprise site this week. Wow, 1,367 confirmed data breaches! It’s good to know that there are tools available to help prevent these incidents. And it’s our job to help businesses deploy these tools in a cost-effective and timely manner.
But regarding the DBIR; I really like how it’s written in plain English and how you don’t have to be a Rocket Scientist, or in this case, a Data Scientist, to understand the threats to the digital environment we live and work in. McAfee, part of Intel Security also contributed to the DBIR report. And being that I’m in the Data Protection world, and that encryption is our mainstay, I really like this DBIR quote, “Considering the high frequency of lost assets, encryption is as close to a no-brainer solution as it gets for this incident pattern.” You can say that again! Instead, I should mention that there was a reported 9, 704 total incidents in the Physical Theft and Loss category. With 116 confirmed data disclosures. And unfortunately, it appears that Healthcare, Public and the Mining sectors may be getting the worst of it. As you would guess laptops are a high incident type as well as desktops and removable media. Like most Data Protection solution providers, we help businesses protect the data on those devices and media.
There is also evidence that desktops should be protected as well, not just laptops! Industry Analysts have also come to that same conclusion several years ago. These incidents may happen, but practically all the exposure can be dramatically reduced by deploying data protection software. It’s interesting to note that in the Insider and Privilege Misuse category, the “Top 10 Assets Affected” had Desktops at 26%, and Laptops at 5%, the reverse of other sections. The reason stated is that desktop computers are an employee’s primary interface to the rest of the network. I’d have to agree. Since we have ePolicy Orchestrator (ePO) managing all the business endpoints, policies can be set with our Data Loss Prevention (DLP) software to monitor specific aspects of data types, in effect, helping businesses to better manage security, without end user intervention or end user burden. Also, businesses should consider DLP software for email, as pointed out in the Miscellaneous Errors section of DBIR. DLP can look for sensitive documents and associated keywords, and take the necessary steps to block and/or track email traffic. The activity from this traffic are summarized in reports and made available to the IT Admin via the ePO console. Just the fact that this info is available and made known that it’s present tends to put more compliance into a business’s security policy.
The use of USB memory devices are widespread. And since the devices are so cheap and small, it’s no stretch to say that these devices are an area of concern. The Insider and Privilege Misuse section of DBIR pointed that out. Yes, our software covers the data at rest and in flight as well. The basic function that most business require is to encrypt data on the device or media. We can also block writes to the destination as well. This is really a key value, i.e. seamless data protection. If an encrypted device is lost or stolen from someone’s desk or at the coffee shop, the exposure a business has is then dramatically limited.
We know that encryption can be a bit esoteric, so organizations like IT World Canada are organizing a Twitter Chat “insights on best practices in encryption” on Thursday, April 24 at 1pm ET to 2pm ET for anyone who wants to learn about safeguarding their data. I’ll be online participating as well, using the hashtag #EncryptITWC. Also, it just so happens, Jason Kennedy from Intel, and myself, will be presenting a Data Protection webinar on Thursday, May 1, 2014, 10:00 – 10:45 AM Pacific US Time, that highlights how you can protect your data in very powerful ways through the combined use of McAfee software and Intel technologies. Also, if you happen to be at Microsoft’s TechEd North America, the Microsoft tech conference for IT professionals and enterprise developers, McAfee will join Intel — a TechEd Gold Sponsor — at Booth #709. That would be yours truly as the McAfee Rep! We will highlight the latest in performance, security, and manageability for clients as well as key aspects of cloud innovation and big data for servers. Please attend the webinar or stop by Booth #709 if you happen to be in Houston next month, I’d certainly like to hear your thoughts on the DBIR report and the data protection area. You can find me on twitter: https://twitter.com/PatCorreia1