we are starting to do a security sweep of information and how users use company information or access to company information in an effort to see if there are any possible holes in how a company operates. is there a best practices guide, or high level security checklist, that can be used as a reference. any info would be helpful, i guess the basics are obvious but i am looking for out of the box sugggestions for monitoring and protecting. thanks.
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center. If this question can be reworded to fit the rules in the help center, please edit the question.
locked by HopelessN00b Jan 22 '15 at 18:42
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.
Read more about locked posts here.
This topic is so broad... you'll need to give us some clue as to what your goals and security requirements actually are. For instance:
Do you need to restrict the ability of the users to copy data to USB drives or other removable media?
Do you need to restrict their ability to print and/or email specific files and/or documents?
Do you need to restrict their ability to use FTP or restrict their ability to download from their web browser?
In addition, you first need to define your security goals and requirements in order to analyze whether or not your company falls short of those goals and requirements.
How will you know if there are any holes if you haven't defined what those holes are and what they mean to you in the context of your security "mandate"?
An invaluable resource I often use about security is NIST. They have good guides (The Special Publications) that go from hardening servers to policies about non-computer stuff. The checklist repository is also quite good.
It's also important to notice that most leaks aren't really related to technology, they are more related to a disgruntled employee who has legitimate access to the information. As they say "A disgruntled employee can take down a government". Using technology to fix leaks is necessary, but sometimes the problem goes far away from that into the realm of policies and even human resources.
Generally what you need to do is
- understand data leakage is unavoidable and all you can do is try to minimise it, without making life unbearable on the users
- implement company wide policies on data use and protection. for example all home dirs on all laptops must be encrypted; all outside communications must use SSL; remove cleartext FTP from all outwards facing services etc...
- Implement a DLP system, which will
not really prevent data leaks (see
1) but will keep them monitored and more or less at bay
EDIT: try to get in touch with companies that specialise on DLP, like Websense - their integration services can provide a full scale solution for you to use