1
vote

we are starting to do a security sweep of information and how users use company information or access to company information in an effort to see if there are any possible holes in how a company operates. is there a best practices guide, or high level security checklist, that can be used as a reference. any info would be helpful, i guess the basics are obvious but i am looking for out of the box sugggestions for monitoring and protecting. thanks.

3 Answers 3

1
vote

This topic is so broad... you'll need to give us some clue as to what your goals and security requirements actually are. For instance:

  1. Do you need to restrict the ability of the users to copy data to USB drives or other removable media?

  2. Do you need to restrict their ability to print and/or email specific files and/or documents?

  3. Do you need to restrict their ability to use FTP or restrict their ability to download from their web browser?

Etc., etc.

Edit:

In addition, you first need to define your security goals and requirements in order to analyze whether or not your company falls short of those goals and requirements.

How will you know if there are any holes if you haven't defined what those holes are and what they mean to you in the context of your security "mandate"?

2
votes

An invaluable resource I often use about security is NIST. They have good guides (The Special Publications) that go from hardening servers to policies about non-computer stuff. The checklist repository is also quite good.

It's also important to notice that most leaks aren't really related to technology, they are more related to a disgruntled employee who has legitimate access to the information. As they say "A disgruntled employee can take down a government". Using technology to fix leaks is necessary, but sometimes the problem goes far away from that into the realm of policies and even human resources.

1
vote

Generally what you need to do is

  1. understand data leakage is unavoidable and all you can do is try to minimise it, without making life unbearable on the users
  2. implement company wide policies on data use and protection. for example all home dirs on all laptops must be encrypted; all outside communications must use SSL; remove cleartext FTP from all outwards facing services etc...
  3. Implement a DLP system, which will not really prevent data leaks (see

    1) but will keep them monitored and more or less at bay

EDIT: try to get in touch with companies that specialise on DLP, like Websense - their integration services can provide a full scale solution for you to use

Not the answer you're looking for? Browse other questions tagged .