classic | mobile
Follow us on:
Follow us on Facebook  Share via Twitter  Share via LinkedIn
 

Search...
Hi-Tech Security Solutions Business Directory
Residential Estate Security Handbook 2017


Make sure the channels are safe
May 2018, This Week's Editor's Pick, Cyber Security, IT infrastructure

Do you control all the channels used for transferring confidential information? Condyn and SearchInform, a developer of information security products represented by Condyn in the African market, guide readers through the threats they may encounter.

Companies should be aware of how many possible data leakage sources they have. Email, phone calls, instant messengers and social networks, cloud storage, external storage devices – to name a few. It doesn’t matter whether it's about deliberate or accidental leakage, the channels are the same.

Jorina van Rensburg.
Jorina van Rensburg.

Corporate channels of communication, such as Exchange, IP telephony, file servers, SharePoint, Office 365, etc., can be managed with the help of security policies, but personal ones – web mail, social networks, blogs, forums, etc. – have always been out of control.

Is there any point in monitoring if half of the communication channels remain vulnerable to breaches or misuse? Here are some crucial reminders of how else your information can be leaked.

Printing

The transition to digital format doesn’t mean that there’s no need to control printed documents. Paper can still be leaked. Remember Reality Winner1? While working for the NSA, she printed, took away and handed over the top secret report to journalists.

Here is another example. The head of the sales department used to work in different branch offices of the company, and several remote printers were configured for him so that he could print out the necessary documents in any office. Once his colleague received a message "Run to the printer, grab the documents, don’t look, put it straight through the shredder." The manager sent the document to the wrong device and printed out an important contract in another office.

Anyone can accidentally see confidential documents or even pick up printed files, especially if the printer is accessible for all the employees. And if you don’t find documents near the printer, the first thing you are most likely to think about is that you’ve run out of paper or ink.

Private email

Companies that monitor confidential data transfer often intercept internal documents sent to employees’ private email. A manager could send a development plan to himself to work from home. But what if he decided to share his secrets with the competitors? The analysis of correspondence will help find out about his true intentions.

Incoming emails from head hunters as well as messages from suspicious addressers pose another security problem. 65% of malware2 invades computers through infected attachments. An employee who opened the file due to carelessness or out of curiosity, jeopardises the security of the entire network.

Accidental leaks might occur as well. Six out of ten companies3 faced the fact that employees attached documents which they shouldn’t have sent by mistake.

Messengers and social networks

Today we use instant messengers and text each other in social networks for personal and business purposes. WhatsApp, Viber, Telegram and Facebook Messenger are sources of potential data leakage. Employees like messengers for ease of use, they think they’re protected from monitoring, therefore can discuss ‘secret’ topics.

Employees’ dependence on social networks might lead to exposure of unofficial or inappropriate information about the company. Uncontrolled social media publications can damage the reputation of your business. SearchInform’s experts brought to mind the case when factory employees should have checked the background before making selfies. Sharing these photos revealed some secret installation behind them. Another case featured an employee of a telecommunication company who leaked the client base to competitors via social network.

External storage devices

Flash drives, hard drives and other external storage devices are quick and simple to use that’s why they often become the source of a leak. Employees might upload confidential data to a USB flash drive intentionally. An employee of the state administration – SearchInform’s client – decided to take away more than a thousand top secret documents.

A careless employee might lose the device, as it happened in Heathrow Airport4, when an unemployed person picked up a USB drive with 2.5 GB of confidential files belonging to the largest airport in the UK which included the itinerary of Queen Elizabeth II.

Internet

An irreplaceable tool at work is a major channel responsible for information leakage. What gets posted on blogs? Which files do employees upload to cloud storage? Which sites do they visit? What are they looking for in Google? All these actions put confidential data at risk and can compromise the wellbeing of the company.

For example, an employee downloads from the Internet a harmless application for work. Along with this application comes the ransomware or malware installed on your PC for hidden mining and accessing confidential information of the company’s server. Boeing5 is one of those who have already fallen prey to WannaCry ransomware.

If there are threats everywhere, what do companies have left to do if it is impossible to avoid the Internet, email and other benefits of IT civilisation? Condyn recommends that they leave all the channels of communication open and keep them under control.

Comprehensive control with the integrated DLP (data leak prevention) system allows employees to use the necessary tools and communication channels freely and safely while protecting data from loss or theft. DLP systems will control file transferring and printing, sudden outbursts of communication in messengers, visits to the websites which aren’t related to the job responsibilities and will warn about possible leakage. Such a protection model facilitates business processes and contributes to the communication efficiency of employees.

KPMG's Global profiles of the fraudster6 study shows a curious detail: 37% of employees ‘caught cheating’ explained their actions were neither a malicious intention nor an accident – they did it only because they had the opportunity to do so. Companies should not create such opportunities, they might want to find weak spots instead and improve data protection.

SearchInform has developed a concept which makes its product differ from the standard DLP. The MPL approach stands for Money Loss Prevention. The key idea is to provide an organisation not only with incident control and notification but with the tools which will analyse the situation before the incidents happen. The MLP features the classic DLP bundled with in-depth evaluation of employee behaviour. The extra modules constitute a Forensic Suite helping to detect tendencies in the workplace, dubious activity and collect a violation evidence base. Any questionable correspondence or action among employees may cause financial damage – money loss or recovery costs. The ‘next generation DLPsystem’ reveals side schemes of sales, identifies risk groups and opinion leaders, and seamlessly keeps track of business processes.

Condyn will be hosting two events to further discuss this topic as well as SearchInform’s capabilities.

• Johannesburg Roadshow: Forever Hotel @ Centurion (/O Basden Ave & Rabie St, Lyttleton, Centurion), 16 May 2018, 09:00 – 13:30.

• Cape Town Roadshow, Atlantic Imbizo (3rd Level, Clocktower Offices, Clocktower Precinct, Cape Town Waterfront), 23 May 2018, 10:00 – 14:00.

To attend, please RSVP to rsvp@condyn.net or contact Leon Labuschagne on 082 7884556, or Riana on 082 333 4464.

References

1. https://www.nytimes.com/2017/06/06/us/politics/realityleighwinnerleaknsa.html

2. http://www.verizonenterprise.com/verizoninsightslab/dbir/2017/

3. https://www.darkreading.com/endpoint/60ofbusinessesmistakenlysentoutsensitivedocuments/d/did/1328396

4. https://www.mirror.co.uk/news/uknews/terrorthreatheathrowairportsecurity11428132

5. https://www.forbes.com/sites/leemathews/2018/03/30/boeingisthelatestwannacryransomwarevictim/#187e2cc56634

6. https://home.kpmg.com/xx/en/home/insights/2016/05/globalprofilesofthefraudster.html


  Share via Twitter   Share via LinkedIn      

Further reading:

  • What is your CCTV really trying to do?
    June 2018, Leaderware, This Week's Editor's Pick, CCTV, Surveillance & Remote Monitoring
    We need to reinvent the way CCTV is done on a regular basis, to freshen up perspectives, and to realign what we want to get out of our systems.
  • Guarding your time with WFM solutions
    June 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Asset Management, EAS, RFID, Integrated Solutions, IT infrastructure
    Workforce management solutions ease some of the burden of out-of-sight-out-of-pocket costs for companies by instituting simple or complex checks to ensure that schedules are followed to the letter.
  • Simplicity, standards and predictability
    June 2018, Technews Publishing, This Week's Editor's Pick, Integrated Solutions
    In today’s world of technology, global communications and the IoT, we have almost endless options when it comes to building management.
  • Intelligence and compliance ­depend on data governance
    June 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management
    The growth of data in all its forms caused data governance to become increasingly complex, to the point where it is a skill in itself.
  • Data governance and security
    June 2018, Technews Publishing, This Week's Editor's Pick, Cyber Security, Security Services & Risk Management
    Data governance has become a key issue for all businesses, and as with all things data-related these days, security is a key component of data governance.
  • The dark side of the Internet
    June 2018, Check Point South Africa, This Week's Editor's Pick, Cyber Security
    Research from Check Point Software Technologies shows that Telegram may be the new channel of choice for conducting cybercrime anonymously.
  • Milestone successfully expanding in Africa
    June 2018, Milestone Systems, This Week's Editor's Pick, News
    Milestone Systems reorganises to support strong interest from customer and partners in the African region.
  • ONVIF celebrates 10th anniversary
    June 2018, This Week's Editor's Pick, News
    ONVIF is celebrating its 10th anniversary, capping off a decade of growth and rising influence as a provider of interoperability standards to the physical security market.
  • SMS emergency service for the deaf
    June 2018, This Week's Editor's Pick, News
    Vodacom has announced the launch of South Africa’s first SMS emergency service for deaf, hearing and speech impaired customers.
  • Vulnerabilities in industrial protocol
    June 2018, Kaspersky Lab, News, Cyber Security
    Kaspersky Lab discovers critical vulnerabilities in popular industrial protocol, affecting products from multiple vendors.
  • SA fraud statistics confirm higher levels of crime
    June 2018, This Week's Editor's Pick, News, Security Services & Risk Management, Retail (Industry)
    Once believed to be the domain of government, high level economic crime has become more common in the corporate arena with exposure of the wrongdoing of many reputable companies.
  • Logical SAP access via biometrics
    June 2018, Technews Publishing, This Week's Editor's Pick, Access Control & Identity Management, Integrated Solutions
    Linx/AS Africa recently held a conference in Johannesburg to highlight the company’s success in controlling logical access to SAP systems via biometrics, meeting compliance and governance demands.

 
 
         
Contact:
Technews Publishing (Pty) Ltd
1st Floor, Stabilitas House
265 Kent Ave, Randburg, 2194
South Africa
Publications by Technews
Dataweek Electronics & Communications Technology
Electronic Buyers Guide (EBG)

Hi-Tech Security Solutions
Hi-Tech Security Business Directory (HSBD)

Motion Control in Southern Africa
Motion Control Buyers’ Guide (MCBG)

South African Instrumentation & Control
South African Instrumentation & Control Buyers’ Guide (IBG)
Other
Terms & conditions of use, including privacy policy
PAIA Manual
         
    Mobile | Classic

Copyright © Technews Publishing (Pty) Ltd. All rights reserved.