How security breaches occur

There are two main ways in which sensitive data is compromised:

1. Staff misusing procedures to access company records
2. Loss or theft of backup tapes or devices containing sensitive data.

The staff misuse of procedures can fall into several different categories:

• Unwitting misuse – for example, letting someone else know your password.
• Malicious misuse – for example, staff using their legitimate passwords and permissions to access data which they do not need for their own work, then copying this data for illegal use.
• Defective process control – personnel having perfectly legitimate access to data which they do not need but which they can later misuse.
• ‘Revenge attacks’ – usually carried out by disgruntled employees, ex-employees, or spouses, these involve people with all the necessary permissions accessing data with malicious intent.

Other Considerations

In addition to the disruption to your business and the real financial losses that can occur from data being in the wrong hands. There is the issue of corporate governance and shareholder protections to consider. Particularly in the US the fiscal penalties incurred are extraordinarily severe as they have legislation in place such as Sarbanes-Oxley, Gramm-Leach-Bliley Act (GLBA), HIPAA, the Digital Millenium Copyright Act (DMCA), PATRIOT Act and more.

Celeram tackles these problems by use of database appliances, which can be deployed in the data stream and act to police how the data is being accessed, looking for irregular and unusual behaviour patterns. The database is protected.

The loss or theft of data on laptops is generally a process control problem, with key data being placed in vulnerable situations, from which it can be stolen. Policing of laptops is a very difficult issue to manage — employees may need to take data out of the office as part of their job, all the organisation can do is to ensure that correct procedures are followed with respect to physical security, password protection etc.

Securing backup data is more manageable. While the same issues apply with physical security of backup media, it is quite possible to add another layer of security to the backup data by using a range of logical security methodologies. Celeram can advise on a range of solutions to protect your backup data from improper access.