If you have anything to do with information or network security, then you are no doubt aware of many significant data breaches that have put an intense focus on information security. While “security” itself should be a simple concept, it seems that the security industry, including vendors, analysts and engineers, has turned it into a very complex business. If you have been to any industry events, tradeshows or seminars lately, you have probably realized that there are as many different approaches to “security” as there are companies offering said “security.”
Various Approaches to Security
First, for those organizations that are not protecting their data at all, it is easy to see how they are vulnerable. Private, sensitive or any other data flowing in the clear is easy pickings for hackers. With this approach, you might as well just send your data straight to the hackers.
Companies that are only deploying data classification, intrusion detection, intrusion prevention, access management, digital rights management and data leakage protection solutions are being extremely careless with their data. Organizations traditionally focus on building a “perimeter defense” at each location. They build in safeguards to keep the bad guys out and then trust everyone within. This approach works well for companies that never send any information beyond their perimeter walls.
However, the reality in today’s business world is that not many companies fit that description. Businesses are constantly moving data from location to location for disaster recovery, data back-up and other business critical purposes. Once their data leaves the confines of the Company’s physically-owned network, even if it is traveling on their service provider’s network, their perimeter defenses and anti-event detection services become irrelevant.
What to Do?
The most important thing you can do is re-think the way you look at data and security.
You must understand what is really at risk and then protect it. Below are five key principles that you must remember when it comes to protecting your data:
1. ALL data has value.
No matter how harmless or insignificant a bit of information may seem, it can probably be used by someone and they are willing to pay for it.
2. “Data” means all communication or information.
This may include many things that some may not have considered data such as VoIP calls, e-mails, etc.
3. You must assume all data sent in the clear can be easily collected, mined replicated and stored.
Over time, mass amounts of data can be collected and sifted through to gain a pretty good view of an organization.
4. Once stolen, data can be sold and used repeatedly by multiple people or groups.
Just because your data is stolen once, doesn’t mean it will only be used once.
5. Security measures should focus on protecting “the thing of value” rather than preventing “events”.
You can’t predict how, when or where an event will take place. This type of defense is always reactionary. Sometimes the event is undetected.
The Simple Answer
While anti-intrusion and perimeter defenses may give an appearance of security and may even make an organization feel that they are protected, the truth is that these solutions miss the mark. They are not focused on protecting the real object of value - the organization’s data.
The best approach for companies that are serious about avoiding security breaches is to protect the data itself and to provide protection that stays with the data, wherever it travels. Encryption is the single most effective solution for protecting data and the only security solution that travels with the data on your network, your service provider’s network or any other network in the world.
Jim Doherty is the chief marketing officer of CipherOptics, a Raleigh, N.C.-based network-wide encryption solutions provider.
