Categories
Blog Data Erasure Device Control File Server Security USB Sescurity

How to Prevent Potential Data Leaks before and after Employees Depart

Four Secudrive data security solutions to help prevent potential data leaks before and after employees depart

When employees join and leave enterprises, the primary concern is to find replacements or re-shuffle the organization structure. However, one crucial, or the riskiest concern that enterprises may overlook is that the departing employees can accidentally or intentionally leak confidential data on their way out, or even after their departure.

Acknowledging that confidential data leakage upon employee departure is more than plausible and that consequences can be damaging, Secudrive recommends its four solutions – Secudrive File Server, Device Control, USB Office, and Sanitizer – that synergize to stop employees from accidentally or intentionally leaking confidential data, before and after their departure.

1) Secudrive File Server helps enterprises to set up a secure file sharing environment where confidential files can be consolidated and protected in a centralized system of file servers. Firstly, Secudrive File Server ensures that consolidated files are isolated from the employee PCs’ local environment, making them only accessible and usable directly on shared folders. Then digital rights management (DRM) is enforced for each folder to stop employees from leaking confidential data.
Digital rights management is the key to Secudrive File Server, restricting specific functions of files and data. With DRM in place, employees can use enterprise files as normally; however, they will be strictly restricted from specific actions that potentially lead to file leakages, like file copying, screen-capturing, printing, and more. With data leakage blocked by DRM, employees will not be able to export confidential data to their PCs’ local environment or outside environment via offline (storage devices) or online (e-mail or messaging apps) methods.

2) Secudrive USB Office and USB Management Server is a solution suite that provides enterprises a secure media to safely store and transport confidential data outside the office environment. Secudrive USB Office is a hardware encrypted USB with DRM, ensuring data security when employees need to take out confidential files for certain situations like business trips, which may seem to be opportune for data leaks. It brings hardware-encryption with AES-256 crypto chip and DRM (identical to that in Secudrive File Server) to ensure that data stored in Secudrive USB Office are safe from not only outsiders’ unauthorized access but also potential leakage that may occur ‘after encryption.’
In addition to the security measures integrated with the USB drives, Secudrive provides a supplementary Secudrive USB Management Server (UMS) that establishes a remote, centralized platform to manage multiple USB drives and their security policies at once. The more USB drives enterprises use, the harder it is to control, and UMS was developed to eliminate such difficulty by allowing enterprises to keep track and change security policies of multiple USB drives at once, real-time. One critical advantage of real-time management is the ability to instantly respond to unexpected events like USB drive thefts or losses. As enterprises ordinarily use regular USB drives with no security measures implemented, and the data stored is exposed to leakage risks by both outsiders and insiders. Therefore, Secudrive’s USB drive security and management solution will prevent data leakage threats by not only outsiders but also insiders.
Even though the enterprises have secure USB drives, backed by a robust management tool at their disposal, they must make sure that only those USB drives are used by employees. Simply encouraging employees or enforcing some policies is not safe enough, since departing employees willing to steal confidential data can easily use their USB drives. Then how can enterprises limit their employees to use only the safe, security-equipped USB drives?

3) Secudrive Device Control regulates and monitors all or specific devices that are used on the endpoint PCs, through ports like USB, Wi-Fi, LAN, and IEEE 1394. As removable storage devices have become IT commodity for everyone, they have naturally become an integral part of enterprises as well. However, enterprises must first control the use of USB drives to eliminate any possibility of data leaving the enterprise premises.
Secudrive Device Control helps enterprises establish and implement various security policies on multiple groups effectively, by initially drawing the information on how all the PCs and employees (users) are structured together from Windows Active Directory (AD). Moreover, when an employee needs to use certain devices for specific tasks, Secudrive Device Control can temporarily ‘unblock’ specific ports, keeping the work productivity flowing. In this case, it is imperative that USB drives be integrated with reliable security measures.

4) Secudrive Drive Eraser is a disk wiping solution that stops potential data leaks from old PCs used by departing employees. When employees leave, their PCs either change ownership or are destroyed, and before doing so, enterprises often format the PCs. However, PC formatting is never enough as it merely removes the path to the data, not the data itself, which actually can be recovered and even worse, be leaked out.
By using Secudrive Sanitizer can the enterprises completely ‘wipe’ multiple PCs simultaneously, and even execute multiple wiping processes remotely from a centralized console. It ensures that PCs are free of remnant data after being wiped with internationally recognized wiping algorithms. Then the enterprises can re-assign or destroy the old PCs used by departing employees, knowing that all data has been rendered unrecoverable. Moreover, remote PC wiping allows bigger enterprises with multiple locations to wipe their PCs with just a few clicks and to monitor the process from start to finish.

All in all, the four Secudrive solutions – Secudrive File Server, Device Control, USB Office, and Drive Eraser – form a holistic data security architecture that stops departing employees from leaking confidential data before and after their departure.

Categories
Blog Data Erasure Device Control File Server Security NEWS Press Release

3 Technological Security Measures to Prevent Data Leaks When Employees Depart

To help employees fulfill their professional initiatives, enterprises must provide a variety of physical and digital tools that enable the employees to take full advantage of enterprise data and resources. When the employees move on to different jobs, however, rolling back on all the capabilities that the enterprises once gave to their employees is another important duty. After all, departing employees can be either direct or indirect causes of data leaks, whether accidental or malicious.

To prevent departing employees from leaking confidential data, enterprises have been implementing several conventional measures like establishing policies, preparing legal documentation like a non-disclosure agreement, training/education sessions, and deactivating accounts used by ex-employees (PC, devices, cloud and more). Perhaps these can be considered to be enough to prevent leakage of confidential data; however, they are only focused on “discouraging” employees from leaking data when they depart. Instead, enterprises need to implement technological measures to actually “stop” data leaks from occurring.

1) Consolidate all files into a data repository equipped with data leakage controls and real-time monitoring

Preventing data leaks by departing employees begins with consolidation and isolation of confidential enterprise files in data repositories and away from individual employee PCs, which can become exit points from which confidential data can be wrongfully leaked, deleted, or edited.

However, this security measure is just the basic foundation of security architecture to prevent data leaks by departing employees. Therefore, by integrating data leakage controls to restrict copying, screen-capturing, printing, and network-transferring the files out of file servers, can enterprises form multi-layered and tighter protection of confidential data.

If the employees need to bring confidential data out to their local storage for certain tasks, enterprises must ensure that all relevant activities regarding the files and users are tracked with logs. Logs are important for both preventative and corrective action as a response to data leaks by departing or departed employees since enterprises can not only detect wrongdoing beforehand but also identify the wrongdoers even after they have quit.

2) Control and manage portable storage device usage on endpoint PCs

Employees now have more kinds of portable storage devices, like USB drives and smartphones, at their disposal for better and improved work performance. However, these devices must be used under the organization-wide enforcement of strict control and thorough management to ensure that those devices do not leave the office premises with confidential data inside.

Together with enterprise policies and culture that discourage the use of storage devices for purposes other than those work-related, a series of technological measures must be implemented to deter employees from doing so. Firstly, enterprises must block the ports (USB, IEEE 1394, and so on) on the PCs used by the employees. By doing so, not only existing but also soon-to-depart employees cannot use portable storage devices to take confidential data from enterprise premises, whether such action was done by mistake or with malice. However, blocking all ports may not be the best option, if the enterprises require permitting specific ports for specific tasks or employees. For this case, it is imperative to implement a management tool that oversees all ports and connected devices on all employee PCs, and that is capable of enforcing and lifting restrictions for specific circumstances.

3) Wiping used hard disks before disposing or recycling used PCs after employee departures

When employees depart, it is common for enterprises first to format the used PCs, and then re-assign or destroy (if outdated) them. Unfortunately, this practice may trigger unexpected data leaks, as the remnant files that contain or are relevant to enterprise confidential data can be recovered, even though the PCs have been formatted beforehand.

Therefore, to prevent data leaks by recovery, enterprises must wipe remnant data on old PCs by using data erasure solutions like degaussing, overwriting with randomized data, or even the physical destruction of PCs. These three solutions achieve the same goal of data erasure, but only one provides enterprises with an extra advantage: overwriting wipes remnant data completely and maintains the disks as usable, while the other two methods do not. Thus the disks overwritten with randomized data can be recycled to be assigned to new employees, and the enterprises will not have to worry about possible rediscovery and leakage of remnant data.

When employees depart, enterprises must think beyond handling more paperwork and recruitment, as their confidential data can, or even worse, could have been at risk of being leaked. The biggest issue with data leaks by departing employees is the increased difficulty of identifying who the wrongdoers are, and of taking a course of corrective actions. The three key measures mentioned above address the importance of data leakage prevention before and after departing employees, whether their involvement direct or indirect. Check our next blog to see how Secudrive solutions bring these measures into practice for enterprises, whether big or small, to ensure that confidential data do not leave along with the departing employees.

Categories
Blog Data Erasure Device Control File Server Security NEWS Press Release

4 Ways How Departing Employees Can Leak Confidential Data on Their Way Out

When employees leave, it is not just about more paperwork and recruitment efforts. In fact, enterprises must also make sure that confidential data does not leave with the departing employees. According to Osterman Research, 69% of organization surveyed indicated that departing employees pose a threat of data leakage.

It is important to know “why” departing employees might leak confidential data. Often, the reasons are classified into two characteristics: accidental and malicious. Accidental data leaks are closely related to employees’ negligence of what confidential data means for enterprises and of potential consequences for data leaks. Ponemon Institute study showed that over 50% of the reasons why departing employees took confidential data was the perception that “everyone else did it when they left.”Meanwhile, malicious data leaks are about personal interests. Lately, many enterprises are warned of malicious data leaks, as data has increased in its monetary value, and competition among corporations, which may lead to corporate espionage cases, has never been fiercer.

Then, what are the four potential threats and how do employees attempt to leak the confidential data on their way out?

1) Employees depart with confidential data in their hands, literally.
Whether accidental or malicious, departing employees have a variety of ways to take confidential data on their way out. One of the easiest ways is to secretly export confidential data to employees’ storage devices like USB drives, external hard drives, and even CD/DVDs.In 2017, a data leakage case that involved global semiconductor firm Micron, which suffered data leakage of monetary scale up to hundreds of millions of dollars, was caused by ex-employees who used USB drives to export and steal intellectual properties.

2) Departed employees access old enterprise accounts.
Google Suite, Microsoft OneDrive, Dropbox… Enterprises now rely on cloud-based storage networks for their daily operations, for their convenience and functionality. Therefore, when employees depart, it is crucial that all accounts with access to confidential data are completely deleted. If not done so, enterprises face another risk of data leakage. Personnel changes or big layoffs are already a big burden, but acknowledging the importance of deactivating enterprise accounts must never be ignored.

3) Departed employees instruct current insiders to take confidential data for them.
Even if the relationship between departed employees and the enterprises has been severed for good, those employees can still find a way to get confidential data in their hands. By asking the current employees privately, departed employees can indirectly obtain confidential data, delivered online or offline. Because this case involves multiple individuals in and out of enterprises, a systematic approach that combines both organizational measures and technological solutions are required.

4) Remnant confidential data can be recovered from the PCs previously used by departing employees.
After the employees depart, it is a common practice to reassign enterprise PCs to new employees or dispose of them for good. Before doing so, enterprises initially format the hard disks to make sure that none of the remnant data are recoverable. However, this is insufficient to completely stop data leaks because disk formatting merely removes the path to remnant data, not the data itself. Therefore, proper data erasure, not conventional file deletion commands, must be the priority in preventing potential data leaks through data recovery.

For enterprises, departing employees must mean more than extra paperwork and recruitment efforts, because they can unexpectedly become a source of data leakage, which can be catastrophic to enterprises. It is a tough challenge; however, knowing the four potential methods of data leaks by departing employees, as mentioned above, is a solid starting point to ensure that none of the confidential data leave the enterprise premises.

Categories
Blog File Server Security

Why is EDRM Difficult for Enterprises?

Why is EDRM Difficult for Enterprises?

For enterprises, file sharing among employees must be integrated with effective security measures to avoid file leakage by internal employees or unauthorized outsiders, whether intentional or accidental. Commonly, encryption has been that key security measure that helped enterprises with secure file sharing; however, it is now considered as insufficient in protecting the files completely. It is critical that multiple and layered security features are put in place, rather than a single layer of encryption. Encryption plays a fundamental role in secure file sharing, but it alone cannot play entire role in secure file sharing.

Achieving the level of security at which most enterprises can feel comfortable and assured while they let employees share confidential files requires encryption and digital rights management (DRM) to protect file confidentiality ‘before and after’ file access. Adopted to enterprise landscape, DRM is often referred to as EDRM or enterprise digital rights management. It has been continuously touted to become the mainstay component in forming the data security architecture for enterprises, due to its ability to protect data on a file level by enforcing detailed and granular restrictions on specific file functionalities that persist even after leaving the secure enterprise premises and being accessed by external individuals.

In theory, EDRM seems like an effective and assured data security solution. However, according to a Gartner report “Market Guide for Information-Centric Endpoint and Mobile Protection,” it has proven to be rather complex for enterprises, regardless of the size and number of employees, to implement and operate EDRM due to the difficulty in scaling EDRM regarding enterprise-wide implementation and operation. Unfortunately, the troublesome complexity downplays the advantages that EDRM brings to enterprises, to the point where they become reluctant in integrating it into their data security architecture.

Modern enterprise landscape is all about data, which are the basis of a countless number of files that are being created, edited, and deleted repeatedly. The nature of operating with a high number of files means that complex EDRM implementation and operation on a file level can be even more challenging. Applying specific and granular controls for file access and usage to individual confidential files is a tough task that requires IT admins to understand EDRM mechanism thoroughly.

To help enterprises easily identify confidential files for selective implementation of EDRM controls, some solutions offer eDiscovery modules that automatically filter out files by matching predefined rules to see if those files contain confidential data. Even though this feature plays a part in streamlining the complex process, the initial stage of determining and defining the rules is just another complex, and even more important task that requires a high level of expertise and lengthy investment of time to get right. All in all, detailed and granular data security controls for confidential files that fall under the predefined rules may seem the right way to go for most enterprises; however, it is simply too complex to do so on a file level in this day and age where employees flooded daily with countless data and files.

Since the EDRM controls are implemented by those who create the files, determining what must be allowed and denied is solely up to the file creators. This may cause the conflict of interest between the two parties, as one party may face hindrance in work productivity. For lessening such complications, EDRM solutions offer adding dynamic controls to grant or revoke more controls to confidential files; however, this action can create a loophole through which confidential files, despite the enforcement of EDRM controls, may be leaked. The complexity that arises from the conflict of interest affects the individuals or groups within not only the same entity but also the external parties, like contractors and agencies with which enterprises cooperate.

File-level data security that persists even after leaving the secure enterprise premise is an appealing proposition of EDRM, and it is perhaps the correct security model that enterprises perhaps should be following. However, the high level of complexity that is apparent from the point of view of both IT admin and file user sides has been making enterprises to think twice before implementing EDRM. Integration of DRM to secure file sharing in and out of enterprises is a must, but doing it more simply and efficiently should be defined to cater to both small and big enterprises.

Categories
Blog File Server Security

The Need for Digital Rights Management in Secure File Sharing

From simple communication to high-profile business development, collaboration among enterprises and employees in the digital sphere is the everyday essentials for work productivity, and in the heart of it lies the frequent sharing of files between internal and external individuals and groups. However, sharing is often not the end, as users will open and edit the files after sharing the files, which can be exposed to unseen threats of breach or leakage. Therefore, sharing files securely, whether in or out of office, is a priority for enterprises to avoid potentially catastrophic consequences.

Secure file sharing is not just one process, but a set of security measures that not only protect file confidentiality but also provide work productivity, both in and out of office. However, the majority of secure file sharing solutions come short in achieving both objectives, because the solutions focus on a model that is centered only around encryption.

Why is encryption insufficient for secure file sharing?

First of all, encryption works when enterprises assume that the trust in their employees and the legal force of documents, such as non-disclosure agreement, is at 100%. However, such an assumption is never guaranteed, and leaving important matter like file confidentiality to chance should never be considered by enterprises. Such claim is even truer when confidential files with valuable data like financials or business development are being priced higher than ever before and sought by other entities.

Secondly, encryption prevents file confidentiality only from those without access keys. It is true that various encryption tactics like a one-time password or two-factor authentication provide an extra layer of security; however, they merely extend outward, meaning that they provide more security ‘before’ file access.

Therefore, secure file sharing must employ digital rights management (DRM) in addition to encryption to protect file confidentiality ‘before and after’ file access.

The possibility of most critical threats to file confidentiality increases ‘after’ encryption, and they are mainly caused by unauthorized or even the trusted insiders with access keys. Moreover, insider threats are harder to detect and deter, as they come unexpectedly and unknowingly. In response, DRM plays an important role by restricting a specific set of functions after file access, which can potentially lead to file leakages, such as file copying, screen-capturing, printing, network-transferring, and more.

DRM is crucial, but it is not there to replace encryption. Therefore, it is important to acknowledge that DRM is added to encryption, rather than replacing it, to protect file confidentiality from both external and internal threat. After all, insider threats accounted for nearly 75 percent of security breach incidents, according to SecurityIntelligence. By going above and beyond encryption with DRM, sharing confidential files can be truly secure from internal and external threats of breach or leakage.

The need for DRM in secure file sharing is evident, as the idea of holistic file security ‘before and after’ access should be prioritized to prevent both external and insider threats. Furthermore, it provides employees to use a wide range of functions within the files’ native application, under the restriction from using a specific set of potentially risky functions like copying, printing, and screen-capturing. Stepping away from read-only or complete access restriction, specific leakage controls of DRM will help enterprises and employees to share, work, and protect their confidential files with ease. Therefore, DRM will prove to be an important factor in making enterprise file sharing to be completely secure and productive, both in and out of office.

Categories
Blog File Server Security

How to Set up A Virtual Data Room

Secudrive File Server is a secure file sharing solution that helps enterprises to establish a collaborative workspace where multiple users can safely access, share, and edit confidential enterprise files, protected with digital rights management (DRM). Relative to the conventional DRM that is on file-level, Secudrive File Server’s folder-level DRM is a unique proposition as it helps enterprises to streamline and scale data security across enterprises.

With DRM as the core component of data security capability, Secudrive File Server can set up a virtual data room (VDR) that provides not only strengthened security but also continuous productivity. Before we get into how Secudrive File Server achieves such capability, let’s learn briefly about VDR.

What is virtual data room (VDR)? Derived from traditional data rooms, where only the selected individuals are given limited access to handle extremely confidential and sensitive documents within the highly secure environment, VDR achieves the same result but on a virtual scale by eliminating the inconvenience and spending due to increased logistical needs for traveling and spaces for individuals. As enterprises and businesses are going digital, VDR is becoming the staple for industries like legal, accounting, investment banking, and private equity.

Setting up VDR with Secudrive File Server involves its three key security features:

  1. Folder-level DRM
  2. Seamless AD integration
  3. Real-time monitoring and logs

Folder-level DRM, as mentioned above, is the core component of Secudrive File Server that makes VDR setup possible. It can restrict unauthorized actions that could lead to accidental or malicious leakage of documents by copying, printing, screen-capturing, and network-transferring. This capability on folder-level means that all documents within DRM-configured shared folders will be restricted altogether. Therefore, administrators can either create new or designate existing shared folders as VDR to store and handle confidential documents. Since all individuals are restricted from committing unauthorized actions to leak any of the documents within DRM-integrated shared folders, enterprises can securely facilitate handling of confidential documents by multiple, authorized individuals. Last not but least, customized watermark printing can be permitted in the case when certain documents need to be printed for specific circumstances.

Folder-level DRM is what differentiates Secudrive File Server VDRs from conventional VDRs as the latter merely provide an extremely limited, read-only environment, which completely overlooks productivity in addition to heightened security. As the DRM integrates to native applications with which the confidential documents are opened and handled, individuals can still benefit from all the capabilities that the native applications offer, minus the actions that could potentially lead to accidental or malicious leakage.

Seamless AD integration means that Secudrive File Server can manage who can or cannot enter certain shared folders, based on the currently existing AD configurations of an enterprise. Managing who is allowed or restricted from entering VDRs is a critical aspect in talking about the security of VDRs. Straight from the management console, Secudrive File Server administrator can grant or revoke access to shared folders that have been designated as VDR with ease.

Real-time monitoring and logs give enterprises the visibility to see every piece of the action of all individuals inside the shared folders that have been designated as VDR. With the real-time visibility in check, enterprises can detect anomalous activities that may signal the leakage intentions, to which they can instantly respond by cutting access to VDR on the spot. Moreover, the visibility extends further by recording all the activities as logs to ensure that document confidentiality remains true even after the tasks in VDRs are complete, as the enterprises or the third-party auditors can review and check for suspected wrongdoings that could have been missed.

Secudrive File Server’s unique stance on confidential data security enables enterprises to set up VDRs where only the selected individuals can enter to handle confidential documents. The real benefit lies in the swift and smooth designation of shared folders as VDRs, as existing enterprise AD and folder settings can be configured straight from the management console. This benefit will certainly cut time to explore, and costs to the additional purchase of conventional VDR solution, which offer an only read-only environment that lacks the productivity aspect. With Secudrive File Server’s DRM, enterprises can benefit from trusted document security in an environment where unauthorized copying is denied, while necessary editing can be permitted.

Please visit Secudrive File Server product page for more information!

Categories
Blog File Server Security Insider threats USB Sescurity

An Economical and Effective Data Protection Tailored to Small and Medium-sized Businesses (SMBs)

Data breach threats are growing exponentially; even the small and medium-sized businesses (SMBs) are now in danger, and are most likely to suffer more than the big enterprises. According to UPS Capital, “60% of smaller businesses are out of business within six months of suffering a cyberattack.” Despite the potential catastrophe due to data breaches, preventing it is challenging for the SMBs. First of all, SMBs have relatively less budget and resources for investment. Second, they do not consider themselves as the targets of data breaches, despite the tendency that cybercriminals tend to take the path of least resistance. Simply put, SMBs are left unaware of and vulnerable to data breach threats that can sink businesses outright in extreme cases.

Due to the ever-growing number of data breach threats, we see a variety of enterprise-targeted, complex solutions like data loss prevention (DLP), enterprise digital rights management (EDRM), user and entity behavior analysis (UEBA), and virtual desktop infrastructure (VDI). Unfortunately, it is extremely difficult for SMBs to implement these types of solutions due to high cost and resource requirements for purchase, deployment, and operation. Having found the demand for solutions tailored for SMBs, some solutions vendors provide similar solutions that are less expensive. However, these solutions are still complex to operate and requires dedicated personnel to manage them effectively. Therefore, SMBs need a new concept of data protection with appropriate practices, which will suit their limited budget and resources.

Practice 1) Treating all relevant data and files as one entity, rather than classifying them by the degree of importance or confidentiality
Understanding this practice is the primary goal to set up cost-effective data protection for the SMBs, as all relevant data, whether confidential or not, is unstructured. This means that all relevant data resides anywhere in the files that are being used daily at multiple endpoints. Therefore, SMBs must first consolidate all its data into a system of data repositories, which require physical and network isolation to prevent physical harm and Internet-based threats, respectively. It is all about reducing the number of exit points from which confidential data can be leaked since SMBs will only have to protect data repositories, rather than tens and hundreds of endpoint PCs.

Practice 2) Protecting consolidated data with solutions that provide not only simple operation but also continued productivity for both administrators and employees
Limited resources for SMBs mean that they have less leeway in hiring or assigning time and personnel to implement and manage solutions on a regular basis. Therefore, quick and easy implementation, along with thorough training for operation is important for the administrator. For employees, the solutions must not interfere them from sharing and working with the protected data and files. If the data protection solution goes as far as hindering business productivity of the employees, it may cause more discomfort than the sense of relief.

Practice 3) Acknowledging that data breach threats arise from both inside and out
Data breach threats are no longer about outside-in; according to IBM, 60% of attacks are carried out by those who have insider access. Effective data protection is all about considering both inside and out; threats like hackers, phishing, and ransomware are from outside, while inside threats include malicious and accidental data leaks by the employees. It is crucial that all relevant data is protected while in use, and in motion by regulating what each employee can do and by monitoring what is happening at file and user level.

Naturally, SMBs have less freedom of budget and resources to run their businesses efficiently, and this constraint makes it difficult to find the right ways to protect their data from being breached by ever-growing threats from both inside and out. Blending data consolidation and protection helps SMBs to achieve the primary stage of complete data protection effectively and efficiently. With added protection against data breach from inside and out, SMBs can cap off the implementation and operation of data protection that delivers cost-efficiency and effectiveness to suit their limited budget and resources.

To learn how Secudrive solutions help SMBs protect their important data from being breached from internal and external threats, please read our next blog!

Categories
Blog File Server Security Insider threats USB Sescurity

3 Reasons Why Data Breach is a Difficult Challenge for Most Small and Medium-sized Businesses (SMBs)

Data breach is causing a lot of headaches among global businesses, and it does not seem to slow down anytime soon. In the US alone, businesses and customers suffered 1,120 total breaches and more than 171 million record exposures during the first 10 months of 2017, according to Identity Theft Resource Center (ITRC). Furthermore, its impact is growing as the average cost of a data breach in 2017 has been reported to be $3.62M globally and $7.35M in the US, according to 2017 Ponemon Cost of Data Breach Study.

These numbers may reflect only the reality that big enterprises face; however, to small and medium-sized businesses (SMBs), data breach is a threat that is just as clear and present. In 2016, Symantec’s Internet Security Threat Report reported that43% of data breaches were targeted at SMBs.

Data Breaches Hit SMBs Harder!

Data breaches cause SMBs the financial, reputational, and other organizational damages. A report by Kaspersky Lab shows that average cost of a data breach for SMBs was measured at $117,000 per incident, while more potent and targeted breach cost SMBs $188,000 on average. Some of the key spendings on damage control were as below.

  1. Hiring professional experts and preparing employee training programs
  2. Lost customers or business
  3. Lowered credit rating and increased insurance premiums
  4. Software and infrastructure improvement
  5. Brand image reparation and customer compensation

Monetary loss or business setbacks like above may not be the end of what data breaches can inflict the SMBs; data breaches can lead to business bankruptcy as SMBs are most likely to be lacking in the capital and resources to handle such impact. To According to UPS Capital, “60% of smaller businesses are out of business within six months of suffering a cyberattack.”

Why Do SMBs Suffer More?

SMB owners already have more than enough responsibilities to drive their business forward with limited capital and resources, and this puts data security in a less prioritized position, where it gets either neglected or overlooked without any seriousness. SMB owners and employees are generally unaware of the current state and potential damage of data breach; therefore, they naturally become good, naïve targets of opportunity for the cyber criminals, whether they are inside or outside the organization. This lack of awareness ties closely into the nature of data breach, being not only malicious but also accidental, as most breaches are in fact, caused by mistakes like negligent employees mishandling security configurations or employees clicking wrong links online. Not only that, the limitation of capital and resources will lead to difficulty in covering the costs of implementation of technical measures and damage control. The absence of technical measures undoubtedly puts SMBs in a vulnerable position, which is exposed to data breach threats from various fronts.

Say that SMBs were familiar with and prepared for data breaches, the measures which they implemented can turn out to be insufficient as security gaps can unexpectedly emerge, opened to exploitation by data breach threats. This issue can be considered as a by-product of current trend of data security industry that is focusing on providing enterprise-grade security that demands high investment, dedicated IT resources, and complex configurations. Thus, SMBs are finding it difficult to find the right solutions that will meet their specific requirements, and they are left to settle for cost-effective alternatives that are less capable.

If you, as an SMB owner, have experienced or are worried about data breaches, the important thing is to start seriously considering the potential risks now, and not after the damage has been done. With lack of awareness, capital, and resources, SMBs can be left unsure on “how and what” to do to prevent data breaches. Head to our next blog to learn how SMBs can establish their data security against data breach threats from outsiders and insiders.

Categories
Blog Data Erasure Device Control File Server Security USB Sescurity

[General Data Protection Regulation ④] How to Comply with GDPR

Secudrive recognizes the GDPR as a welcoming and progressive leap to protect the rights and freedom of all EU citizens with the new laws for comprehensive personal data protection, and an exciting opportunity for us to solidify our commitment to what we do best: providing reliable data security solutions for businesses and organizations.

The GDPR requires global organizations to comply with its organizational and technological requirements if or to process personal data of any EU citizen. Organizational requirements are considered as clear-cut, as they pertain to appointing the right people for the right positions, such as Data Protection Officers (DPO), and educating the employees and external personnel about the GDPR and the rights of the EU citizens. On the other hand, meeting technological requirements are rather obscure and difficult, as organizations are now flooded with numerous data security solutions in the market and simply unsure where to begin. To guide the organizations to an effective shortcut to comply with the GDPR, Secudrive provides a lineup of four data security solutions.

  1. Secudrive File Server
  2. Secudrive Device Control
  3. Secudrive USB drive solutions
  4. Secudrive Drive Eraser

It is critical to protect the confidential data in storage, and even while being processed by individuals. As mentioned in the previous blog, organizations can consider typical solutions like data loss prevention (DLP), enterprise digital rights management (EDRM), and virtual desktop infrastructure (VDI). These solutions promise to be effective in protecting your personal data, but are considerably challenging to implement and manage without professional consultants or qualified data security managers. Big, rich organizations may feel indifferent to these potential barriers, but SMBs with limited capital and human resources may look for other solutions that are as comprehensive and straightforward.

Secudrive File Server is a data loss prevention (DLP) solution for file servers, equipped with digital rights management (DRM) and application whitelisting to prevent internal data leaks and external cyber attacks, respectively. As file servers serve as a popular form of repository for confidential and unstructured data like personal data, organizations must consider some of the key security principles like network separation, encryption, anti-virus solutions, and backup. However, insider threat prevention must also be considered as confidential data is most exposed to data leakage when it is being processed. With Secudrive File Server, users are configured with different DRM policies, which can restrict them from unauthorized copy, print, screen-capture, and network-transfer; therefore, all personal data that are either in storage or processing will be prevented from accidental or malicious leaks. Against external cyber attacks like ransomware, application whitelisting prevents unauthorized applications or even malicious malware from being installed and run on the file servers to protect the personal data from harm. For visibility across an organization, Secudrive File Server provides logging of all file and user activities for real-time monitoring and future audits. It also provides security for personal data in motion, as its secure audited copy protocol (SACP) allows users to first encrypt the files for export, transport them in Secudrive USB drives, and decrypt later for access within Secudrive File Server environment.

Secudrive Device Control prevents internal data leaks by regulating the access of various ports such as USB, Wi-Fi, LAN, and IEE 1394, and monitors all activities regarding storages devices like USB drives, external hard drives, and smartphones that are connected to endpoint PCs. Among various ports, it is crucial to regulate the ports to storage devices, as data leaks through storage devices do not leave traces for the organizations to investigate and identify the wrongdoers. Therefore, organizations must either completely restrict or temporarily permit these ports for access. Secudrive Device Control achieves this with an added security feature of real-time monitoring in case of temporary USB port permission.  However, what if it is unavoidable for an organization to use USB drives, and simply restricting USB ports is no longer a viable option? Organizations can consider permitting only the designated USB drives with reliable security features like password encryption, file activity logging, and remote management.

Secudrive USB drive solutions provide a system that helps organizations securely manage the storage and transportation of personal data while being protected from accidental or malicious leaks even outside secure office premises. First, Secudrive USB drives are well-equipped against losses and thefts, the two most common human occurrences during data transport. Furthermore, Secudrive USB drives provide visibility as it records all file activities as logs for future audits. For the organizations that wish to manage multiple Secudrive USB drives simultaneously, Secudrive USB Management Server(UMS)  provides management of monitoring of multiple USB drives in real-time and even lock or wipe them remotely through a centralized console. With UMS,  organizations have the liberty to manage thousands of Secudrive USB drives and security policies remotely and respond to thefts and losses as swiftly as possible.

Lastly, Secudrive Drive Eraser provides assured and cost-effective data wiping for organizations. The caveat here lies in the danger of potential data leakage through recovery, even after deleting the stored data beforehand. Not only that, PC disposal is often performed by specialized facilities outside the office, and this leaves in doubt the danger of data leakage through loss or theft while en route. Secudrive Drive Eraser eliminates this danger by allowing the organizations to wipe the data on the PCs within the secure, on-site premises, and even to ‘recycle’ them to help cut costs. Furthermore, it provides extraterritoriality with the ability to distribute the solution to the PCs via online, wipe the PCs, and monitor the entire process remotely from a centralized location. Last but not least, Secudrive Sanitizer boasts effortless data wiping for any organizations as it performs with only a few clicks, even while operating systems are running.

The GDPR is out to achieve a common goal across the EU, but organizations of all sizes and industries are considering the Regulation a varying level of difficulty and different perspectives. As a data security solutions provider, Secudrive considers it as an exciting opportunity to provide a reliable blend of data security solutions that are comprehensive and straightforward. With Secudrive Device Control, organizations can ensure that untraceable data leaks through storage devices are restricted at the endpoints. Meanwhile, Secudrive File Server protects the confidential data directly from where it is stored by enforcing user-specific DRM policies for insider threats and application whitelisting for external attacks. When organizations require transporting their personal data outside the secure office premises, Secudrive USB Drive Solutions provide on which the personal data can be stored and protected from leakage with hardware encryption, DRM, and remote management. Finally, Secudrive Sanitizer helps organizations to ensure that personal data are deleted and rendered unrecoverable before disposing of the PCs. With our solutions lineup, will be well-prepared to carry on their operations without having to worry about where and how to begin their action plan for GDPR compliance.

Blog Posts in this Series:
① The GDPR Summary: The 5 Key Points
② Checklist for the Organizations to Comply with the GDPR
③ Data Protection by Design and by Default: Technological Measures
→ How to Comply with GDPR

Categories
Blog Data Erasure Device Control File Server Security USB Sescurity

[General Data Protection Regulation ③] Data Protection by Design and by Default: Technological Measures

Just over five months from now, the GDPR will be enforced for a stricter, thorough, and fair protection of personal data of all EU citizens, and the organizations with the presence in the EU have a tough task of GDPR compliance in their hands. To lighten the burden, we wrote a checklist of requirements for the organizations to follow on our earlier blog. Continuing our blog series on the GDPR, we will take a closer look at a technological aspect of compliance and how organizations can approach it.

For starters, where should the organizations begin to comply with the technological requirements of the GDPR? We turn our attention to “Data Protection by Design and by Default”, or Article 25. It explains that the organizations that fall under the GDPR scope must implement appropriate technical and organizational measures, which are designed to implement data-protection principles to integrate the necessary safeguards in order to:

  1. meet the requirements of this Regulation and protect the rights of data subjects, and
  2. to ensure that only personal data which are necessary for each specific purpose of the processing are processed.

The organizations are explicitly required to implement appropriate technical measures for personal data protection. However, with a plethora of data security solutions out there, some organizations may feel lost. From the technological point of view, we understand the Article 25 as the organizations’ responsibility to apply a cohesive blend of multiple data security principles to the full extent of data life cycle, which largely consists of data storage, processing, and erasure. We believe that this approach will serve as a backbone from which the organizations can start preparing for the GDPR.

After collecting personal data by complying with the GDPR requirements, data storage follows. The fundamental security principle here is to store all the personal data in one or more secure data repositories, separate from, but accessible by individual PCs via local network. The most common data repository is the file server, which is often operated and managed in multiple numbers, dedicated to multiple groups of users that will only be allowed to work on the files while being restricted from unauthorized file exports. To make sure your file servers are kept safe from potential dangers, organizations must consider some of the key security principles as below.

  1. Physical security to prevent intruder breaches
  2. Encryption to ensure protection of data against hackers or theft
  3. Keeping it off Internet to restrict potentially malicious or accidental access from outside of your LAN
  4. Anti-virus solutions to prevent cyber attacks from the outside
  5. Maintain high availability to ensure continuity of work productivity in case of accidental or malicious disruption to file server(s)

Once personal data is stored in the file servers, it will be subject to data processing by diverse personnel such as employees, contractors, partners, and consultants. It is critical to realize that data processing is the breeding ground for both accidental and malicious data leak threats from inside and out. The most common form of data leaks is accidental, due to employee negligence, operational mistakes, or lack of education. However, organizations cannot overlook the risk of malicious data leaks that can be caused by greed, ego, and competition. Therefore, a stringent data security system is required to ensure that only the certain files and folders are accessible by authorized users. Furthermore, all user, file, and folder activities must be logged for auditing and only allowed to be accessible by certain users. When processing personal data, employees may also transfer or share it outside the secure premises. For secure processing of personal data, organizations can consider some of the general countermeasures as below to mitigate the risks of leaking data.

  1. Data loss prevention (DLP) detects potential data leaks by monitoring the important data and blocking it from leaving the secure premises from the end-points.
  2. Enterprise digital rights management (EDRM) provides file access control and file activity restriction features that are persistent and manageable even outside the secure premises.
  3. Virtual desktop infrastructure (VDI) runs multiple user desktops inside virtual machines (terminals) with persistent data security policies that only allows users to access the data within the centralized data center(s).

Once the processing of personal data is complete, organizations may undertake data erasure to free up their storage space, or to ensure that personal data remains unavailable to others. Data erasure is closely related to the Article 17, which states that the data subjects have the right to erasure, or the right to be forgotten. Therefore, organizations must be prepared to erase personal data, rendering it unrecoverable in any situation. In this case, direct data erasure on the storage devices, through one or a combination of the general methods as below, is the safest procedure.

  1. Data erasure software by overwriting with randomized data
  2. Degaussing, or elimination of magnetic fields on storage devices to erase all stored data
  3. Brute destruction of storage devices

Despite the advantage of complete data erasure, degaussing and brute destruction carry two distinct disadvantages. Firstly, they make the storage devices unusable, and secondly, they require the devices to be transported to the external facilities, risking them to potential theft or loss. On the other hand, data erasure via software bypasses the two disadvantages by allowing the organizations to ‘recycle’ their storage devices and perform data erasure within their office premises. Therefore, organizations can ensure complete and secure data erasure with a software initially, and by subsequently degaussing or brutely destroying devices.

Meeting the technological requirements of the “Data protection by design and by default” can help organizations to get off to a solid start in achieving GDPR compliance before the deadline. We recommend the organizations to consider implementing the technological measures for the three steps of data life cycle: storage, processing, and erasure. This approach allows the organizations to devise a cohesive blend of multiple data security solutions, which will protect personal data from leaks and breaches from both internal and external threats. Capping off our blog series on the GDPR, we will discuss how Secudrive solutions can technologically help you to achieve “Data protection by design and by default” to prepare for the GDPR.

Blog Posts in this Series:
① The GDPR Summary: The 5 Key Points
② Checklist for the Organizations to Comply with the GDPR
→ Data Protection by Design and by Default: Technological Measures
④ How to Comply with GDPR