The Great Data Exodus - Written by Nick Lowe ñ Check Point Software

Much of our personal and professional lives nowadays are heavily influenced by technology. Everythingís going digital, from the cassette player to the picture frame. And whether a technology is designed to help us communicate, to take pictures, or to listen to music or watch a movie, every gadget that we carry has the ability to store large amounts of data in digital form.

The ability to move massive amounts of information between traditional PCs and portable storage devices means that itís now incredibly easy for confidential data to be taken from companies without knowledge or consent. Interestingly, the perpetrators of such crimes are rarely stereotypical hackers, attacking systems via the internet from their mafia headquarters or their student dorms. Instead, the data thieves are frequently much closer to home. Unescorted visitors, for example, or temporary staff who have joined the organization purely to copy data and hand it over to a competitor. Or, as is becoming increasingly common, unhappy staff who are about to resign but think itís a good idea to first take copies of anything which might be useful in their new job. And lastly, innocent employees who simply donít follow security policy, copy work files to take home and lose the unprotected storage device.

In the days of Windows 1.0, Bill Gates famously said that no one would ever need more than 640 KB of RAM on their PCs. Today, you can buy a 16 gigabyte USB stick that fits on a key ring. Allowing a generous 10 KB for a page of text, and assuming 5 reams of 500 sheets comprise a box of printer paper, we arrive at an interesting modern take on Billís original quote. You can now carry 640 boxesí worth of information in your pocket alongside your keys to the office. Plenty of capacity for someone to walk off with your sales database or the source code for your next product. As to whether anyone will ever need to carry even more, only time will tell.

Unguarded USB ports on todayís PCs are perhaps the biggest threat to corporate IT security. As well as the aforementioned USB pen drive, an MP3 player, smartphone or PDA is a fundamental tool of the data thief. Not only can such devices store tens of gigabytes of data, they can all be quickly connected to any PC via a USB cable without the need for any driver software to be installed (and therefore, without the need for the thief to be logged in as an administrator). A few drags and drops, and the deed is done. Typically in just a few seconds. Where the amount of data to be stolen is beyond the capacity of an iPod or PDA, external USB drives comprising half a terabyte of storage are now available on the high street for less than a hundred pounds.

USB devices arenít the only way in which information can be stolen electronically, of course. Most mobile phones nowadays include a camera, which can be used to quickly make an electronic copy of a printed page. Pocket OCR wands and portable scanners offer similar facilities to the opportunistic data thief who stumbles across a confidential printed document. Or he could simply make a photocopy of a document and put it in the post. However, using any of these methods to steal large quantities of data is simply not practical because of the time required. Controlling the use of USB devices is of far greater importance.

While the good old disgruntled employee is a prime suspect in many data thefts, actions by former employees should also be considered in your data protection plans. Do all of your usersí accounts and passwords get deleted as soon as the person leaves the company or changes department? Failure to delete such information isnít just dangerous, but might also mean that you fall foul of the Data Protection Act by storing personal data that you have no need to retain.

To reduce the problem of data leakage in your company there are three particularly effective strategies. First, ensure that you have a policy which clearly states who is allowed to take data off-site, and how the data must be protected when itís away from your premises. Second, ensure that data doesnít leave the building without your knowledge. Finally, ensure that data which needs to be removed from the building is protected so that it canít fall into the wrong hands.

To control which data files leave your premises in the first place, set up user accounts on servers and workstations so that employees canít access information which they have no need to see. Those in sales and marketing, for example, probably donít need access to the product development departmentís files on the server, so set the access permissions accordingly. Over-use of rules and regulations can lead to low morale, however, if the workforce feels that it clearly canít be trusted. Beware of becoming seen as Big Brother. It wonít drive the data thieves away but simply make them more determined.

Itís also well worth investing in a port control product, which can automatically block USB devices from being connected to your systems without authorization. There are various such products available, such as Pointsec Protector by Check Point Software. This also includes transparent encryption, so that information copied to USB devices is automatically rendered inaccessible to thieves.

Although you will normally want to ensure that none of your confidential files leaves your premises, this wonít always be the case. Sometimes, allowing staff to take files away is necessary and beneficial. Sales personnel need access to product information when theyíre away from the office, and marketing people often prepare PowerPoint presentations for delivery at external conferences and seminars. Staff need to take work home at the weekend if theyíre particularly busy, and preventing them from doing so will deprive the company of some useful effort (not to mention all that unpaid overtime).

Itís absolutely vital that you protect information which is taken off the premises. If a sales managerís laptop is stolen from the boot of her car, you need to be sure that the customer information on its hard disk canít be accessed by the thief. If your marketing managerís PDA goes missing while heís at a conference, can you be confident that the document containing details of next yearís product launches wonít be accessible to whoever buys the stolen hardware? The solution to this problem is encrypting data. There are many products on the market, but ensure that the solution you choose is proven, transparent and automatic, eliminating user interaction and creating a fully enforceable solution that holds up to the most stringent compliance requirements. Deploying an encryption solution will improve the level of trust and loyalty of clients and employees who recognize that every effort is being made to protect their sensitive data and ensure that a lost or stolen device never results in a data breach.