Digital information is driving the success of many companies, but how safe is it against theft or loss? There have been many occurrences of data loss both in the government and private sector. Yaki Faitelson (CEO of Varonis Systems) argues that “better metadata–information about data– plus better authorization and controls” are the three elements to prevent unauthorized information leaks(such as WikiLeaks).

Faitelson backs up his argument in noting that every employee collaborates digitally, sharing a large number of files and e-mails on multiple platforms. The problem in all this sharing is that it is hard to control who sees what.

Faitelson believes that the key to finding whether your organization is at risk is by examining your employees(he suggests two random people) recent activities:

• What data can those two people access? (Not what groups they‘re in, what actual data—what folders, files, SharePoint sites, mailboxes, etc.)
  
• What have those two people accessed over the past week? (Not which servers; which actual files, folders and emails)
  
• Which of that data is sensitive and would cause problems if it were lost or released?
  
• How did we decide what data these users should have access to? (Not what groups they‘re in, what data)
  
• How do we decide when they should no longer have access to data? (Other than when they leave the organization)
  
• If they suddenly decided to access everything they are able to, how would we know?

If you can answer the majority of those questions, you are in good shape, if not, your company may be at risk. Faitelson offers ideas on how you can better protect your organization, if need be.

• Look beyond simple passwords. There are many technologies available to strengthen authentication methods, including one-time password tokens, smart cards and biometrics.
  
• Use metadata to answer questions about data – who has access, who does access, who should have access, who owns data, where is data exposed, and who is abusing their access.
  
• Use technology to automate the identification of data owners, authorization processes and reviews to make better authorization decisions and keep auditable records.
  
• Leverage technology to identify people that should have their access revoked, making authorization reviews (often called entitlement reviews) faster and more effective. Recommendation technologies leveraging metadata help reduce overwhelming sets of choices to manageable ones.
  
• Source technology that does not require organizations to change business process and will support an organization’s existing investment in platforms that enable collaboration.

Photo Courtesy of Jlkinsel
Photo Courtesy of adamamyl