Published: April 29 2010, 03:09 AM | 3 Comment(s)
by Shirief Nosseir

Few European Organisations Have Deployed Data Loss Prevention Tools, Jeopardising IT Security and Compliance, Survey Reveals

We today announced the results of a European study entitled "You sent what? -  Linking identity and data loss prevention to avoid damage to brand, reputation and competitiveness" (Report). The study focuses on how well European businesses understand today’s information security risks and what steps they have taken to address them.  It also looks at the issues of information governance and the benefits of linking Data Loss Prevention to identity management.

What does data loss in this sense mean?

Every organisation processes data that can be classified as sensitive. This sensitive information takes many forms, including product designs, technical specifications, software code, or employee personal data, like credit card and account numbers, medical-related information, and national identification numbers. Businesses also need to regularly share data with each other outside the perimeter, driving the cross-organisational business processes that enable suppliers to trade and governments to provide joined-up services to citizens.

While engaging in the day-to-day sharing of sensitive data, businesses need to ensure they are protected from a threat that - either by accident or design - the data is lost/leaked and end up in the wrong hands. When it does, this failure to protect data is costly, not least because of the level of fines now being imposed by regulators. On top of this there is the reputational damage and loss of competitive advantage that usually ensues - as the numerous high profile data breaches reported in recent years demonstrate.

Paradox between low adoption rates of data loss prevention technologies and tighter data privacy regulations?

The Study reveals that only 28% of organisations in Europe have deployed Data Loss Prevention (DLP) technology. As mentioned data compromise is costly and new regulations are expected to exacerbate this in coming years. For Example in the UK, new data loss fines now in force since earlier this month (6th April 2010 to be exact) mean that organisations that recklessly lose data could be fined up to £500,000.

According to the study, IT departments are struggling to deal with compliance issues, such as the Payment Card Industry Data Security Standard (PCI DSS) and the ISO 27001 information security standard. Surprisingly, they are unaware of how technology could help and many are unable to convince the business of the inherent risks to justify the required investment. This is despite the fact many organisations expect data privacy to be the area of regulation that will impact them the most in the next 5 years.

As the survey highlights, many serious cases have emerged which highlight the dangers of data loss - as the survey states lack of time and resources, followed by numerous manual processes mean that IT managers find it difficult to address many compliance issues. Some of these data losses also went big in public.

Sounds scary?

There are some recommendations to avoid these breaches. A compliance-oriented architecture (COA) would help alleviate the problem of data loss and misuse. An effective COA requires (i) an identity and access management solution (only 24% of European organisations have deployed this); (ii) the ability to locate and classify data (more than 50% claim to have such a system in place); and (iii) the ability to link people’s roles to the different types of data and enforce security policies that accordingly control sensitive information.  The second and third requirements are provided by today's DLP solutions.

Interestingly enough it was found out that almost 90% of organisations that have deployed DLP state they are well prepared to protect intellectual property and personal data - and ensure compliance with security mandates. For those without DLP the figure is 26%. A clear statement.

Identity-centric DLP

Security and compliance efforts have been thwarted until recently because they didn't consider the identities of individuals involved in various activities.  For example, without knowing the identity of an email's sender and recipient, organisations have been forced to implement one-size-fits-all, enterprise-wide policies.   This means the decision to block intellectual property, customer details or any other sensitive data from being sent or used must apply equally to all employees.

BUT in reality, employee bases are varied, consisting of many levels of roles and rights. In many organisations identity management and information protection/governance are separate silos and do not work in concert so they are missing on the benefits of a combined approach.

Incorporating identity is only effective if the solution accurately models the various roles that individuals carry out within an organisation. All too often that's not the case.

Even when a DLP system has the capacity to understand the notion of identity, the task of modelling the organisation's structure, responsibilities and entitlements takes time. Organisations frequently group individual employees into so many roles that it becomes hard to manage. For most companies, this undertaking requires concerted efforts and dedicated identity management tools to be effective. Unless properly managed and supported, rationalizing a model from tens of thousands of roles to several hundred can easily take many people-months and result in errors.

This is why it's so important for DLP systems to seamlessly integrate with identity management tools that automate the modelling of the organisation's user roles and entitlements.  This allows DLP to simply inherit all of that intelligence for contextually accurate data loss detection and prevention.

An identity-centric DLP approach improves security by ensuring that individuals have only the appropriate and intended level of access to information.  Also, when compared to content-only DLP solutions, it provides more accurate results, reduces false positives, and saves on incident management costs amongst many other benefits.

Interested?

You can find the full report as well as additional information here: www.ca.com/gb/mediaresourcecentre