Archive for ‘Email Security’

Mobile email security: Why using a lightweight container is the recommended approach for both security and work/life balance

Thursday, December 13th, 2012

It’s no secret.  I dress up at work.  It is not required at my workplace, nor is it necessarily the culture.  It’s a personal choice.  I think it provides benefits for my work life, as well as my home life.  How does dressing up at work help in my personal life?  And what does this have to do with mobile email security?  Good questions.

We all know mobile devices are everywhere.  We all see the stats.  We all have one.  Most of us use our mobile devices for both personal and business endeavors.  For employees and managers alike, mobile computing is a welcome trend. They can check their email and conduct other business in any location. If they can combine work and personal information on their device, they only require a single device for all their needs.  This causes a serious security problem, especially for the most used app on any mobile device:  email.  Today’s smartphones make it difficult to draw the line between personal and business email, as both business and personal email (and their attachments) tend to live all in the same place, and without separation.  This is where the problem of protecting business information, all mixed together with personal information becomes very difficult.  With more and more users mixing business and personal data on their mobile devices, the risk of a data leak occurring from email increases significantly because:

  • Mobile devices are often used in public environments, where users are more likely to get distracted. This increases the potential for mistakes and accidental emails.
  • Mobile devices are easily lost, misplaced or stolen. How do we protect sensitive data on the missing device?
  • Privacy/e-Discovery. How do organizations know what data is on the mobile device? How can this data be found for e-Discovery purposes? What right does the company have to data on the device, when business data is mixed with personal data?

What is the answer to mitigating this biggest mobile risk of email?  Dress up at work.

(more…)

 

 

Why Isn’t My DLP Investment Paying Off?

Wednesday, January 4th, 2012

It’s a common scenario: a large organization invests millions of dollars in a DLP solution, only to leave it in “watch mode” because the rate of false positives is too high to enable full blocking. The result is a DLP investment that becomes a white elephant: a promising technology that does not pay off in actually preventing data loss.

The problem often begins with an over-reliance on automated scanning to prevent data loss. The DLP system is expected to automatically identify all sensitive content, which requires IT administrators to translate business processes and policies into automated rules for every data loss scenario. This is an impossible task, which usually results in overly restrictive rules that block non-sensitive data (false positives) or overly permissive rules that mistakenly release sensitive data (false negatives).

The impact of false positives can be just as detrimental to the business as the data loss caused by false negatives. False positives disrupt business agility and productivity, and can impact collaboration, innovation, and business growth. As well, false positives can actually lead to increased data loss, with users looking for alternative, less secure methods to get around restrictions and carry out their business tasks.

The best way to address this problem is for organizations to identify their information appropriately. The sensitivity of each piece of information must be identified, or ‘classified’. Information classification is crucial for proper handling, and for the ultimate security of an enterprise’s information. Classification provides context to unstructured data such as email and business documents, making it possible for DLP solutions to know how to protect your organization’s sensitive information. (more…)

 

 

Top Data Security Blog Posts for 2011: Data Classification, Mobile Security, Data Security and Compliance, Data Loss Prevention, and Cloud Data Security

Wednesday, December 28th, 2011

As 2011 draws to a close, I thought it would be interesting to provide a list of the most popular data security articles on this blog. Here are the topics and articles that were most popular with our readers:

1) Data Classification

More and more commercial organizations have started to see data classification as the foundation of their information protection strategy. We wrote several articles about this trend, including an article that described how to implement a data classification policy in 5 simple steps, and an article that recommended best practices for defining a data classification scheme. Readers were also interested in how to use classification software to bulk classify, mark, and label large numbers of files.

2) Mobile Security

Mobile security has become a hot topic, especially with the trend toward consumerization of mobile devices. (more…)

 

 

New White Paper: 5 Easy Steps for Implementing a Classification Policy

Monday, December 5th, 2011

Most organizations have an established corporate information handling policy to protect sensitive and confidential information. This policy is typically expressed with a classification scheme that describes the handling procedure based on the sensitivity of the material in question. The challenge, however, has been implementing and enforcing this policy; in other words, ensuring that sensitive information is adequately protected on a consistent basis.

To address this challenge, organizations often make large investments in technologies such as data loss prevention (DLP) and information rights management (IRM) solutions. Unfortunately, these technologies are often implemented without classification as a first step, and therefore lack context about the information they are protecting. This results in inconsistent and inaccurate data protection, which increases the organization’s risk exposure, may reduce business velocity, and can make a large infrastructure investment a white elephant.

The solution to this challenge is to make classification the foundation of your information protection policy. Fortunately, implementing a classification policy is actually quite simple. In our new white paper entitled “5 Easy Steps for Implementing a Classification Policy”, we discuss how you can implement – and enforce – a classification policy that will increase user security awareness, enhance DLP and IRM solutions, and protect your organization against data loss. (more…)

 

 

Is Your Agency Ready for CUI Compliance? Meet Your December 6th Deadline

Thursday, October 13th, 2011

On November 4, 2010, U.S. President Barack Obama signed a new Executive Order to establish a uniform policy for the government treatment of “Controlled Unclassified Information” (CUI).  This framework standardizes practices around the sharing of Controlled Unclassified Information, with the goal of improving the sharing of information within the executive departments of the U.S. Federal Government.

Government agencies must complete a number of deliverables as part of the CUI implementation plan. In May 2011, agencies were required to submit a catalogue of proposed Controlled Unclassified Information categories to the National Archives and Records Administration (NARA). The next step is for agencies to develop a CUI compliance plan, which is due by December 6, 2011.

TITUS has partnered with PKH Enterprises to help agencies develop their CUI compliance plan. In a joint white paper with Patricia Hammar, executive secretary of the CUI Presidential Task Force, we provide expert advice, templates, and best practices from governments that have implemented similar initiatives. The white paper, called “Protect Your CUI Data: 5 Steps to Implementing Your Controlled Unclassified Information Plan”, includes the following content: (more…)

 

 

Data Loss and Other Risks – Employees Sending Email to Their Home Computer for Business Purposes

Thursday, September 1st, 2011

It can be very tempting for employees to use their personal email accounts to do corporate business. The typical scenario is that they didn’t quite get all their work done on a document in the office, so they send that document to their personal email account, where they can pick it up at home and continue working on it.

In this article, we’ll have a look at why employers should have a policy against employees using this practice. Having a clear policy might save some embarrassment, financial penalties or even legal difficulties,  and might help people understand why it’s important.

(more…)

 

 

Oh no! – Email Auto-Complete – Helping Users Prevent Data Leakage to Unintended Email Recipients

Thursday, August 11th, 2011

Most of us have inadvertently sent email to an unintended recipient due to the fateful “Reply All” button, or as a result of a hastily typed recipient name that gets “Auto-Completed” with the email address of somebody who has a similar name to the intended recipient. The result can be not only embarrassment, but actual data leakage that should be treated as a security incident or breach.

This blog discusses how common mistakes including inserting the wrong email address and sending emails that contain sensitive and restricted data to the wrong recipient(s),can impact an organization, and how the TITUS Aware for Microsoft Outlook product can  prevent these kinds of incidents.

 

When the convenience of auto-completed Email recipients turns into a data breach

The results were disastrous in 2010 for the Gwent Police Department in the UK, when an unencrypted spreadsheet containing the results of criminal record checks was accidentally sent by a police department employee to a newspaper, instead of an internal departmental recipient. The culprit was the “Auto-Complete” feature in their email program that filled in, or suggested, the newspaper’s email address as a CC recipient, rather than the intended internal recipient.

The file contained Personally Identifiable Information (PII) of 10,000 citizens who had applied for jobs that required criminal record checks. For a brief summary of the story, click HERE.  If only the unfortunate police department employee had been warned that they were about to make this mistake, the incident would certainly have been avoided by alerting the user before they send an email to correct the recipient list.

The ultimate unintended Reply-All ruins a legal case

Imagine being an attorney working on a legal case when you respond to a colleague’s email with the Reply-All button, and realize that the recipient list included a member of the opposing counsel. This could be the ultimate breach of attorney-client privilege. In such a case (click HERE), the judge, when asked to rule that the email’s content was inadmissible, noted that this was not the first incident of this type for the attorney in question. Clearly, a firm is expected to be diligent with its email communications.

How TITUS Aware for Microsoft Outlook can help solve inadvertent email misdirection

TITUS Aware for Microsoft Outlook is a powerful email tool for preventing data leakage. Policies can be defined to warn an users or to prevent email from being sent when certain rules are violated.

For example, in the case of the Outlook Auto-Complete problem, any email recipient that is not within predefined SMTP “Safe Domains” (e.g. the employer’s corporate domain) can trigger a pop-up warning to the user to inform them of the potential data loss and asking how they wish to proceed. Giving users a second chance to review the recipient list, to make sure that there are no unintended external recipients,  can prevent massive breaches such as occurred in the Gwent Police Department story above.

The image below shows a typical warning, to a user, that a recipient selected via Auto-Complete is actually an external Hotmail user.

Policy Warnings Dialog

Figure 1 – Safe Domains in TITUS Aware for Microsoft Outlook

The risk of accidentally using the Reply All button can also be mitigated through the use of the “Maximum Recipients” feature in TITUS Aware for Microsoft Outlook. When a message has more than a certain number of recipients, a rule can be triggered that presents a warning dialog to the user. This gives users a warning that they might be sending the email to more recipients than they had planned. This can be enough of a reminder that the user will correct the recipient list.

The administrative setting shown in the image below allows for a maximum number of message recipients. Whenever the number of recipients exceeds this value, the user will see the warning dialog.

Maximum Recipients Dialog

Figure 2 – Maximum Recipients Setting in TITUS Aware for Microsoft Outlook

These are just a couple of examples of how TITUS Aware for Microsoft Outlook can guide users to making good security decisions when working in a high-pressure environment. Overall, the aim is to create a decision point for the user, encouraging them to review what they plan to send and to whom. This increases users’ responsibility and helps to correct any digressions from the company’s security policy before an incident happens.

How soon do you think the next preventable email incident will occur in your organization? Having an automatic reminder can really reduce the chances of it actually happening. In addition this will empower the user and enable IT to focus on more strategic tasks

If you’d like more information on how the TITUS products can help implement recipient list validation to improve DLP, please use the coordinates on our Contact Us page to let us know.