Data Sharing – What policies should be in place?

At the end of November, Information Security Magazine online did a news article about current data sharing.  According to a survey about the costs of data breaches, there has been a 43% rise of cost since 2005.  This is a huge increase and should be taken into account when gauging the costs of security and what actions or additons should be made for security.  TJX, who I blogged about yesterday, had a major breach and they are paying the cost for damages through banks of over 40 million.  This is just one example of current breach costs.

 But back to the main point of the post, data sharing.  The article talks about how companies are sharing intellectual property to their suppliers, customers, and clients without policies in place to monitor or restrict that sharing.  This can lead to some information “donations” to people outside the company that are not wanted by the executives.  Most times, people are trustworthy but it only takes one bad apple to lead to a security breach or costs for the company in intellectual property leaks, bad publicity, and lost business. However, you don’t want to over-regulate data sharing in a company because it does lead to cost savings.  If a company over regulates, the employees start to find ways to get around the regulations, working under the radar and that leads to sometimes even larger security problems. 

 As the article states, companies need to have security audits and make sure to educate their employees about what information is vital to the company and should be guarded and what information can be used to pave the way with clients and other outside entities.  Policies should be written and IT solutions should be investigated that help to aid ease of complience with employees.  Risks and solutions should be evaluated.  Knowledge of risks help to decrease being blindsided by a breach.

Security Risk Introduced by Temporary Users

I stumbled upon a great article today about the risks associated with temporary employees. This is expecially important information during the christmas season due to the large increase in temporary employees.  The article outlines three main issues faced with the addition of temporary employees.

1. Information Leakage
2. Lack of Basic Data Security Management
3. Exposure to External Threats

The article outlines the results from a survey given to temporary employees about their behavior and policies at these jobs.  There are some pretty interesting statistics in the article.  Here are just a few of them.

• 87.7% of respondents were able to access documents from the company network drive or electronic folders that permanent staff use on a day to day basis
• 52% used someone else’s e-mail account or a general company e-mail address
• 78.9% of temporary workers said they did not have to sign a PC or Internet use policy
• 97% said they either didn’t understand or had never heard of the Computer Misuse Act
• 25.5% accessed download sites during work hours
• 67% of temporary workers used social networking sites like Facebook during working hours

The complete set of statistics and article can be found at the following link. 
Businesses are ill-prepared for the security risk introduced by temporary workers

As hackers find new and different ways to use the information found on the internet at sites such as Facebook and Myspace, we will start seeing a whole different arena of ways to gain information that we must know about and be caution.

 Salesforce.com just ran into some trouble in October. On Oct. 19, Security Fix reported that payroll giant Automatic Data Processing (ADP) and several banks — including Suntrust — were among a number of institutions that were victimized by a series of highly-targeted phishing scams.  This was done through a spoofed email that asked employees to download a file which was most likely malware to gain passwords and usernames.  More Info

This is just one of the risks of which temporary employees and full-time employees  must be aware. Management must be aware of these threats and take steps to mitigate these risks.