Protection and defense against sensitive data leakage problem within organizations
Upcoming SlideShare
Loading in...5
×

Like this? Share it with your network

Share

Protection and defense against sensitive data leakage problem within organizations

  • 215 views
Uploaded on

International peer-reviewed academic journals call for papers, http://www.iiste.org ...

International peer-reviewed academic journals call for papers, http://www.iiste.org

More in: Technology
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads

Views

Total Views
215
On Slideshare
215
From Embeds
0
Number of Embeds
0

Actions

Shares
Downloads
0
Comments
0
Likes
0

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide

Transcript

  • 1. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 Protection and Defense against Sensitive Data Leakage Problem within Organizations 1-Sahem A. Nawafleh E-business & E-commerce department - University Of Petra 2-Muneer Y. F. Hasan Management information system department - University Of Petra 3-Yousef Nawafleh The Jordanian Ministry of Justice 4-Suha Amin A. Rahman Fakhouri AL-Ghad international medicl science colleges Abstract Information security has never been as important as it is today for the business, health, and educational organizations, in addition to individuals because many organizations around the world depend, today, on reliable information to perform their daily tasks. Additionally, the information needs to be timely, accurate, complete, valid, consistent and relevant to any use on the organization. The information, confidentiality, is measured as a main topic for many organizations around the world that attempt to find the best way to protect them from hackers' attacks, so it is possible for organizations and individuals to protect themselves by being skilled on the importance of security and gaining awareness of the possible security attacks that they may encounter. This paper proposed an integrated solution for preventing and reducing intentional sensitive data leakage actions through implementing a series of effective procedures, for instance: monitoring user’s actions, protecting sensitive data properly against any intentional or accidental leaks, and guarantee these data not to be reached to the wrong individuals or groups from inside/outside the organization. The proposed sensitive Data Leakage Prevention (DLP) solution involves identification, monitoring, and protecting three groups of significant organization's data: data at rest, data in use, and data in motion. Index Terms : Sensitive data, Data Leakage, Data Leakage Prevention (DLP) solution, Acceptable Use of Information (AUI), Data in use, Data at rest, Data in motion. 1. Introduction Nowadays, Information Security became a vital and a major subject especially with the spreading of information sharing among private and public networks for all organizations across different industrial sectors e.g. telecom, banking and education all over the world. The importance of securing information is playing a significant role especially when sharing, distributing, accessing and publishing any information that's been classified as a sensitive either for the organization itself or the clients whom sharing their private information with the organization, like information that has been stored, shared, distributed and viewed through the electronic document systems and/or images of paper document systems which is widely used by a lot of organizations. Many organizations have a great deal of attention that has been given to protect their sensitive data from outside threats by using a set of security countermeasures like: intrusion prevention systems, firewalls, and management of thevulnerable points inside them. So, organizations must now turn their attention to equal critical situations that forms, for them, as a big challenge today’s: the problem of data leaking or loss from the inside. In fact, in many organizations, there is a gap in controlling, monitoring, and protecting its business environment and electronic data assets from leakage or loss to the wrong individuals or groups intentionally or accidentally. This gap is now ubiquitous in businesses, health, educational organizations and individuals who are needed to communicate with each other over the Internet networks. In our days, many electronic communications which are used heavily inside any organization for many purposes ,for instance: local mail, instant messaging, web mail, transferring data files , and also organization's website, are still used largely in different destinations without any limitations, monitoring , and controlling for its movements from the organization, thus the expected result for this issue that there is a huge potential confidential information of the organization to surely fall into the wrong hands. From this significant point, this organization's sensitive data should be protected very well or will be faced with tragedy results like: business loss, reputation damage, bad publicity, strategic customer loss, and loss 87
  • 2. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 of the competitor with other organizations. As a result, any organization that uses a similar electronic document system must keep a close eye for securing sensitive information that is going forth/back through this system or the application to maintain business continuity and reputation and to ensure regulations, law compliance along with differentiating from others. In this paper we talk about one of the most new methodologies and techniques solution that has been raised to the top is the Data Leakage Prevention (DLP) solution which is basically protecting sensitive data of an organization from being viewed by wrong individuals, being from outside the organization, or even from inside it. This basically means that specific data can be viewed by only a specific set of an authorized individuals or groups [3]. The sensitive Data leakage prevention (DLP) became one of the most critical issues that faces Chief Information Officers (CIOs), Chief Security Officers (CSOs), and Chief Information Security Officers (CISOs). On the other hand, the DLP's solution is considered as one of the most vital security approaches and techniques that effectively assist organizations today in protecting the organization's sensitive data from leaking into the wrong hands. It's playing a major role as a part of the overall information security system framework that can integrate with existing infrastructure and systems like electronic document management systems to provide a comprehensive , holistic and effective information security strategy inside the organization [5]. 2. Background Many published papers and reports talk about the importance of (1) identification of sensitive data in any organization, (2) applying a suitable information policy to protect it from leakage into the wrong hands, (3) finally explain the benefits that any organization can gain from preventing data leakage and prove this issue that can be satisfied by controlling and monitoring the document viewer side. Eric Maiwald thinks that the identification of information policy within any organization is considered as the most important part according to many justifications like [1]: (i) The information policy defines what sensitive data is within the organization and that data should be protected. This policy should be constructed to cover all data within the organization. (ii) Each employee is responsible for protecting sensitive data that comes into the employee's possession. These data can be in the form of electronic documents or paper records, thus the organization's policy must take both into account. (iii) To protect your data from leakage you must classify the data documents into a set of levels according to their importance like: 1- Public Classification (lowest level): The data are not sensitive and can be provided to the public. 2- Private Classification (Medium level): The data are confidential and can be provided only to the authorized employees or to other organizations. 3- Sensitive Data Classification (Highes level): The data are very sensitive and must be restricted to a limited number of employees within the organization. These data must be protected well by not provided to all employees or to the individuals outside of the organization. (iv) The information policy must address how sensitive data is transmitted. The sensitive data can be transmitted through a number of ways such as (Email, Fax, and so on), and the policy should address each of them very well. Securosis -information security company- report which published on Feb/2009 described the (A) Main features of Data Leakage Prevention (DLP) life cycle, where all these (B) features are tied together in the DLP cycle as the following [7]: 88
  • 3. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 Fig1: DLP Features Cycle [7] 1. Define: The first feature which concerns with building a proper organization information policy that defines the data to be protected, and how to protect it very well. 2. Discover: The second feature which uses the DLP solution to find the definition data throughout the organization. And then relocate or remove information where it shouldn’t be. 3. Monitor: The third feature which concerns in track usage of the defined data at risk, in motion, and in use. Then it can generate a proper warning alert if and only if any organization's Information policy had been violated. 4. Protect: The fourth feature which concerns with protecting sensitive data from leaking by quarantine emails, relocate files, block copies to portable storage, and other enforcement actions. (B) Define Data Leakage Prevention concept as "Products that, based on central policies, identify, monitor, and protect data at risk, in motion, and in use through deep content analysis". This definition contains the core components of a DLP solution: centralized management, identification of defined data, monitoring of usage, and protection from policy violations. A DLP solution can do this in data storage, on networks, and on employees' computers, using advanced analysis techniques, thus this solution can provide better protection and more cost effective in the long term. (C) They expected more benefits that can be gained from implementing a proper DLP solution within any organization like the following [7]:  Risk Reduction: You can reduce the risk of threats and the possibility of data leakage by knowing where your data is stored and how it’s being used.  Cost Savings: DLP solution may help to reduce other costs associated with data management and security.  Compliance support: DLP solution helps to reduce the direct costs associated with some regulatory compliance from all employees within the organization.  Policy enforcement: Many data management policies in different organizations are difficult or impossible to enforce. The DLP solution supports enforcement of Acceptable Use of Information (AUI), not just security controls.  Data security and Threat management: While no security tool stops all threats, DLP solution reduces the risk of certain malicious activity. on March 2008, many of specialized corporations such as International Data Corporation (IDC), which is a leading center in the world of information security researches' and analysis specifically for many sectors such as: 89
  • 4. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 information technology, and telecommunications. Its report which was published to demonstrate the dangers of accidental exposure for organization's sensitive data and considered it as the number one threat. [8]. At the end of the same year, another study for the same corporation has shown many important facts like: 80 percent of respondents in the survey have agreed on that data security was one of the biggest challenges facing them, and with 50 percent of respondents have possessed a good experience to deal with incidents of leakage of sensitive data inside different sectors of the organization. [9] Another important IDC’s survey indicated that the problem of intellectual property has now become one of the most acute problems that faces many organizations today, especially for the sensitive data leakage problem. 81 percent of those surveyed saw that Information Protection and Control (IPC) – can definitely be considered, as monitoring, encrypting, filtering, and blocking sensitive data contained in data at risk, data in motion, and data in use, as an important part of the overall strategy to protect the data within the organization. The highest priority of information protection and control (IPC) solution was data leakage prevention (DLP) which deployed at the organization’s perimeter and on all endpoint computers within the organization. [8] Fig2: Importance of monitoring employee use [8] The respondents to IDC’s survey demonstrated the importance of [monitoring employee use] and showed that the accidental or intentional exposure of confidential information of the organization, is ranging from legally protected personal information to intellectual property and any significant secrets about organization, is something that affects on the IT environment in its widest sense, involving lost or stolen laptops, hacking employees' emails and any other vital applications for them. Nowadays, the main challenge for many organizations is not how to find the best way to protect the sensitive data from the threat or corruption of malware programs , but just how it can add a proper second security layer that can prevent data that's being accessed if it is lost. A Sophos white paper which published on Feb/2009 under the title “Stopping Data Leakage” demonstrated the importance of enabling DLP solution within the organization by creating and enforcing an Acceptable Use Policy (AUP) to support any attempts to stop data leaking from the organization. It also proposed three steps to make an AUP success [5]: Step (1): Create the suitable policy within the organization. Step (2): Educate employees and users about the policy. Step (3): Enforce the policy properly. The AUP should cover many issues that are very important for the employees within the organization to be known for them clearly such as [5]: i. Determine clearly what information or documents must not be emailed. ii. Determine whose persons or organizations are authorized to access, receive, and see the sensitive data documents. iii. Determine what operations/actions are allowed on the sensitive data documents. 90
  • 5. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 iv. The organizational policy in sending a specific document over the web or downloading it from the web. v. The organizational policy on storing sensitive data on desktops, PC’s, laptops, and so on. 3. Main Work Nowadays, many business organizations have become vastly depending on online transactions; to complete its works efficiently and accurately, thus saving time and cost for them. This option makes a big chance for transferring data between many nodes within the organization in a more flexible way, but at the same time it faces many challenges and limitations for instance finds the best way for monitoring, keeping, and preventing data from leakage to unauthorized people. Many organizations over the world find themselves, after years of enforcing viruses, intrusions, and email spam problems, facing a significant new security issue but it becomes more important in huge data leakage. Therefore, different organizations sectors today (e.g. Health, telecom, banking, and education) are becoming increasingly more aware of the acute need to control, very well, the information that flows into, through and out of their own networks. One of these solutions is a DLP Solution which is considered as the best solution that can be used by the organizations and vendors who are offering services or products to prevent Sensitive data from reaching to unauthorized persons and others [4]. The most important part in any DLP solution involves developing awareness training courses for the users to achieve data leakage prevention through teaching them how to deal with expected security attacks that can happen for them at any moment. However, this solution does not guarantee a complete protection as data leakage may occur intentionally by leaking data or accidentally by sending data to wrong receivers. The main contribution of this paper is describing a new security solution [DLP Solution] which can be used effectively in reducing intentional sensitive data leakage actions through monitoring user’s actions properly. On the other hand, this solution can be regarded as “integrated” if and only if it is able to: • Protecting the organization's sensitive data against any accidental or intentional leakage. • Securing the organization's sensitive data so that, if it leaked or lost, it cannot easily be read by others. 4. The Process of Identifying Sensitive Data Sensitive data is any data that when it leaks, it can cause harm to somebody or an organization. Sensitive data may contain: 1- Personal Information 2- Information about the organization. There are various examples of sensitive data:          Social Security number (SSN). Credit card number. Personal information about patients. Financial data of the organization. Personal information about students. Students’ records (study plans, marks). Employees personal information. Research data within the university. University special Legal data. 5. The Process of Identifying Sensitive Data Leakage Prevention (DLP) Solution Data Leakage Prevention (DLP) is a computer security term that involves the identification, monitoring, 91
  • 6. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 and protecting three groups of organizing data [7]: 6. Data at Risk “Data at Risk” is a recorded and stored data in media storage or any data that resides in filing systems, databases and other storage methods [3, 6]. This data can be regarded as “Secure” if and only if: • The data is protected by strong encryption (where “strong encryption” is defined as “encryption requiring a computationally infeasible amount of time to brute force attack”). • The key (required to decrypt the data) is (i) not presenting to the media itself (ii) not present on the node associated with the media; and (iii) is of sufficient length and randomness to be functionally immune to a dictionary attack. 7. Data in Use • “Data in Use” is all data that is not at risk state, and only on one particular node in a network (for example, in resident memory, swap, processor cache or disk cache, or memory) [3, 6]. This data can be regarded as “Secure” if and only If: • The Access to the memory is thoroughly controlled (the process that accessed the storage media data and read it into memory is the only process that has an access to the memory. • Regardless of how the process (the owner of the data) terminates, (either by successful completion, killing the process, or shutting down the computer), the data cannot be retrieved from any location other than the original at risk state, requiring re-authorization. 8. Data in Motion • Or “Data in Transit” is all data being transferred between two nodes in a network [3, 6]. This data can be regarded as “Secure” if and only if: • Both nodes (the source and the receiver of the data) are capable of protecting the data in the previous two classifications from any threats. • The communication between the two hosts is identified, authenticated, authorized, and private; meaning that no third node over the network can overhear the communication between the two endpoint nodes. 9. Data Leakage Prevention (DLP) Techniques Protecting those data groups is achieved through the following techniques that can be found in DLP literature [ 6]: • Deep content inspection (Advanced Option). • Contextual security analysis of transaction (attributes of originator, data object, medium, timing, and recipient/destination). • A centralized management framework. The systems are designed to detect and prevent the unauthorized use and transmission of confidential information. 10. How is Data Leakage Prevention (DLP) different from other security technologies? Conventional security tools that have been in use, such as firewalls and An Intrusion detection system (IDS) /Intrusion prevention system (IPS) look for anything that can form or pose a threat to the organization's information and then obtain set of steps to deal with these threats. But Data leakage prevention (DLP) solution is interested in identifying the sensitive data inside the organization and then the first option is monitoring the users’ usage and the last option is preventing them from leakage to unauthorized organizations or people [3]. 92
  • 7. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 11. DLP Integrated Solution The truth is that, most business organizations in the world across different sectors (governmental establishments, ministries, specialized companies, banks, and universities), for example, don’t have enough technical staff, governmental /special funds, resources, and they need for intensive efforts to implement suitable security requirements within the sturdy strategy security plan to face the data leakage problem effectively. Accordingly, an urgent need emerged for organizations to implement a series of new security solutions that combine the features of a DLP solution with other security tools to provide an integrated solution to this problem from its roots. Hence, this paper has proposed an integrated solution based on the achievement of two main phases [Two Layers of Defense], which can be summarized as following: Phase (1): (First layer of defense) Protecting sensitive data of an organization Endpoint protection (Protecting Data inside Organization): The proposed procedures to guarantee endpoint nodes inside the organization are safely. Table 1: Endpoint Protection Procedures Prohibiting the use of non-necessary applications such as wireless network connections, sharing files, FTP clients, instant messaging service (IM), and unauthorized email clients. Therefore, all employees should be fully aware of the dangers of sending and sharing organization’s data via these applications. Blocking different spyware programs that can be used effectively by information's hackers in hacking sensitive data of an organization by using powerful anti-malware solutions. Checking carefully that every PC connected to network within the organization is compatible with the organization’s security policy. Managing properly access operations to any type of portable storage devices such as USB keys and others. Consequently, these devices can cause a high security risk within any organization, because they can be easily lost. Gateway protection (Protecting Data outside Organization): At present, many organizations have their own websites and e-mail; these may contain a lot of security functions that can be used to prevent sensitive/confidential data from being sent outside the organization or to un-authorized users within the organization.These Features include: Table 2: Gateway Protection Procedures Monitoring and Controlling users from accessing particular websites, well-known webmail sites (e.g. Yahoo! Mail and Google email), and applications which can cause a serious threat to the organization itself. Preventing users from uploading or downloading certain types of data files and warn them clearly from unauthorized file types which are received in their emails. Controlling and blocking the unauthorized use of Instant Messaging (IM) and FTP traffic between the users themselves or with other users/organizations from outside. 93
  • 8. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 Adopting a series of preventive measures to protect against “drive-by-downloads” feature’s which secretly place specific spyware code on the user’s PC when they accidentally visit a particular sabotage website. Consequently, these tricks require from the users' within the organization to be well aware the seriousness of these threats if occurred. Verifying the contents of web traffic periodically to ensure it is free from any Viruses, spyware, and malware. On the other hand, being confident that these programs will not be downloaded into the user’s PC. Scanning accurately the Contents of email messages and attachments of various kinds to control and prevent sensitive data from leakage by identifying a specific keywords relating to confidential data of the organization. Phase (2): (Second layer of defense) Securing sensitive data of an organization In fact, despite of having the best solutions for data leakage problem and the best policies for securing the sensitive data of an organization, there still a possibility of leakage or loss at any moment in the wrong hands intentionally or accidentally. So it is essential to have a second layer of defense [Encryption Sensitive Data]. Data encryption is considered as one of the traditional methods that have been used effectively for a long period to protect data when moving from one place to another. Over the past years, many researchers and specialists in information security agreed on that the percentage of the potential risk, for the organization itself or the users, will be reduced if data had been encrypted very well compared with non-encrypted data. If the organization wants to secure its sensitive data and devices, they should: Table 3: Secure Data Procedures Perform full disk encryption for PC’s, laptops, and notebooks according to their importance. Encrypt sensitive data which are stored on removable storage devices (e.g. USB drives, CDs and DVDs). Encrypt E-mail’s content to prevent unauthorized users from reading them. Encrypting sensitive data and devices, that is used in the organization, this way indicate that both are subsisted in a safe mode, even if they reached the wrong hands. But the main question which must take into consideration; whether if encrypting sensitive data only, is enough to protect it from any risk 12. Conclusion Sensitive Data leakage prevention problem, become as one of the most vital security issues facing Organizations today. The most effective solution to the problem is to see Data Leakage Prevention solution (DLP) as part of the overall security problem. This solution can be integrated fully with other security tools within organization to form a comprehensive security strategy plan to protect these data properly .DLP solution can be used effectively in reducing intentional sensitive data leakage actions through monitoring user’s actions and protecting three groups of organizing data: data at risk, data in use, and data in motion. This solution can be regarded as “integrated” through the achievement of two main phases [two layers of defense]: protecting sensitive data and securing sensitive data of an organization. The organization also needs to create an Acceptable Use Policy (AUP) for users, at the same time ensuring both are compliant with organizational policies. 94
  • 9. European Journal of Business and Management www.iiste.org ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online) Vol.5, No.23, 2013 To avoid data leakage, organizations must evaluate their weakness and respond appropriately in many ways like: Endpoints protection, Gateway protection, and encryption data. 13. References [1] Eric Maiwald, “Fundamentals of Network Security”, McGraw-Hill November 2003. [2] John M. Carrol, “Computer Security”, Third Edition Butterworth-Heinemann 1996. [3] Prathaben Kanagasingham, “Data Loss Prevention” (Aug/2008), Retrieved November 14, 2009 from http://www.sans.org/reading_room/whitepapers/dlp/data_loss_prevention_32883. [4] Sans Security Institute, “SANS What Works in Data Leakage Prevention & Encryption Summit” (Jan/2010), Retrieved January 16, 2010 from http://www.sans.org/data-leakage-prevention2010. [5] Sophos Institute, "Stopping data leakage: Making the most of your security budget", Published 19 November 2009, Retrieved January 18, 2010 from http://viewer.bitpipe.com/viewer/viewDocument.do?accessId=11492295. [6] Sans Security Institute and Securosis, "Understanding and Selecting A Data Loss Prevention Solution" (2009), Retrieved January 24, 2010 from http://www.websense.com/site/Docs/whitepapers/en /Understanding_and_selectinga_DLP_solution_wp. Pdf. [7] Securosis Information Security Research and Analysis, "The Executive Guide to Dat Loss Prevention" (2009), Retrieved January 24/ 2010 from http://www.websense.com/site/docs/whitepapers/en/Mogull_DLP_WP.pdf. [8] IDC, “Information Protection and Control Survey: Data Loss Prevention and Encryption Trends”, Doc # 211109, March 2008, Last accessed August 24, 2010 [9] www.networkworld.com/news/2009/011409. Encryption-told-to-stop-ignoring.html? fsrc=rsssecurity, Last accessed August 24, 2010. 95
  • 10. This academic article was published by The International Institute for Science, Technology and Education (IISTE). The IISTE is a pioneer in the Open Access Publishing service based in the U.S. and Europe. The aim of the institute is Accelerating Global Knowledge Sharing. More information about the publisher can be found in the IISTE’s homepage: http://www.iiste.org CALL FOR JOURNAL PAPERS The IISTE is currently hosting more than 30 peer-reviewed academic journals and collaborating with academic institutions around the world. There’s no deadline for submission. Prospective authors of IISTE journals can find the submission instruction on the following page: http://www.iiste.org/journals/ The IISTE editorial team promises to the review and publish all the qualified submissions in a fast manner. All the journals articles are available online to the readers all over the world without financial, legal, or technical barriers other than those inseparable from gaining access to the internet itself. Printed version of the journals is also available upon request of readers and authors. MORE RESOURCES Book publication information: http://www.iiste.org/book/ Recent conferences: http://www.iiste.org/conference/ IISTE Knowledge Sharing Partners EBSCO, Index Copernicus, Ulrich's Periodicals Directory, JournalTOCS, PKP Open Archives Harvester, Bielefeld Academic Search Engine, Elektronische Zeitschriftenbibliothek EZB, Open J-Gate, OCLC WorldCat, Universe Digtial Library , NewJour, Google Scholar