Its been a while since I have added to my blog, its been on my mind for a while so this Sunday morning took some time off, made some coffe and added this entry.
We have recently launched USB CopyNotify, a network security software for the Small Business Segment and this in turn has got me in touch with several business owners and IT administrators who are very concerned about theft of confidential data from their networks.
There has been a lot of exchange of ideas, strategies, recommendations of software to be used but in all this I am suprised that we in general tend to forgot to implement some basic common sense procedures in office which in itself would minimize confidential data from the network being taken out of office.
I am no top notch , certified security consultant but I do know that following these simple steps would help in minising the leak of confidential data from your office
1. Educate, Educate, Educate
Your staff / employees should be educated about confidentiality of data and its importance. They should be told that this data belongs to the office or its clients and should not be used un appropriately. They should be made to understand that data is associated with a value and it is property of the company or its clients. They should be taught the professional ethics behind it too. They should also be reminded of the Non Disclosure Agreements they have signed with the your company in which it clearly indicates that unauthorized copying of data could lead to serious consequences.
You will be suprised that if you drill this into the staff regularly, a correct attitude about corporate data and its usage get automatically inculcated in a majority of the employees and often education could become one of the most effective means of securing your data.
2. Backup and delete data that is not currently required.
This happens in every office, a task/assignment/project is completed, the data is backed up but several times a copy of this data still remains on the computers. After archiving it, delete this data. The less data you have, the less you have to worry about people stealing it.
3. Avoid personal belongings being brought into the work area.
This might sound a little draconian but employees should not be allowed to bring in their hand bags, haversacks, pouches into the work area. They should leave it outside. This will at least minimize the risk of them bringing & using external devices such as CDS, DVDs and USB devices such as External Hard Drives/Flash Drives/iPODS/Digital Cameras to copy data that they are not supposed to.
Of course today, USB Flash Drives unfortunately are so small they can be put in the pocket or as a key chain and no-one would know. Other than strip searching the employee (which is not always possible as a routine policy) you wont be able to detect these devices brought into office.
In fact this was one of the reasons I use USB CopyNotify! myself in office. It alerts me of USB Device usage on the network.
4. Use Login Names and Passwords
Very often , we tend to ignore the importance of the User Name and Password that is asked for during start up of the Operating System. Either it is not set or all computers have the same user name / password or everybody knows everyone else's password (it is public domain).
Take this security feature seriously and educate your employees to use it in the appropriate manner. Only you and the user of that machine should know the login name and password. This will at least reduce the risk of other people sitting on the machine and accessing the data inappropriately.
5. Internet Access
Ok, this is a tricky one as Internet access in several offices in available on all machines in the office for the purpose of email, research, uploads & downloads etc. Perhaps web based email should be restricted and only email access only via the office intranet should be allowed ie there is only a single point of entry/exit for email from/to the outside world. This would at least allow you to monitor what data & the amount of data being uploaded out of office via email.
Another simple way of finding out whether the web is used for Internet Research or for uploading data is by monitoring the amount of data transfer is taking place on the machine. I get this report every morning. When I see an increase of data transfer or an unnecessary amount of data transfer on a computer, it gives me a automatic indication that the Internet access is not only being used for browsing but only for upload/download of large files. This itself gives me an idea that the Internet is being used to transfer data out of the office.
So as you can see all the above steps are simple, cost effective and very easy to implement and would help in the increase of data security of your network.
