Can Data Protection Systems Prevent Data At Rest Leakage?

Protection against insider risks works when the process involves
controlling the data transfer channels or examining data
sources.

One approach involves preventing USB flash drives from being
copied or sending them over email. The second one concerns
preventing leakage or fraud in which an insider accesses files or
databases with harmful intentions.

What’s the best way to protect your data?

It seems obvious that prevention is the best way to solve any
problem. In most cases, DCAP (data-centric audit and protection)
and DAM (database activity monitoring) is sufficient. Both serve
the purpose of protecting data at rest.

The following example illustrates the approach we found in the
Russian legal system.

In order to prevent this incident from happening, it was enough
for the manager to observe the employee accessing the database and
performing unauthorized operations. A DAM solution would be
helpful. Here you can browse^[1]
more information about the DAM system tactics.

As an example of how the DCAP system detected fraud, here is a
customer’s case from SearchInform:

The price column was typed in white, which made the price list
appear like it was normal. In spite of this, FileAuditor acknowledged^[2] that the purchase price
was definitely included in the document. Investigating the case
using the DLP system, the cybersecurity specialist discovered that
employees had forwarded these price lists to external email
addresses. A subsequent investigation confirmed that there was
collusion between the buyers and sellers.

This was classic scheming: the seller’s manager agreed to a
large discount for the buyer on any pretext he could think of. The
buyer representative agreed to repay a portion of the difference to
the seller’s manager, who negotiated the discount.

So, both the seller and manager benefited, while the company
selling lost money. In the event of a violation, it can take up to
a year for the damage to be identified; depending on the size of
the business, this damage can range from thousands up to millions
of dollars.

It turns out that control of information sources enables an
information security expert to detect an incident at its earliest
stage – intention, rather than following up after it occurs. Tight
control on such matters prohibits a more detailed investigation,
which would allow evidence to be collected and conclusions drawn so
that the incident wouldn’t repeat itself. Here, the information
security specialist has tightened DLP security policies on
documents that include purchase prices.

Which is the best approach to data protection?

A complex approach. It’s not possible to solve everything with
DLP. Not everything is really dependent on control of the source.
However, when combined, these approaches give a super-effect. When
the DCAP system detects a potential violation, the DLP system
gathers evidence and allows conclusions to be drawn on how to
improve business processes and make them more transparent.

What are DCAP and DAM?

DCAP and DAM solutions are already on the market in mass
quantities due to the need for data at rest protection. In
addition, this software is easy to use and integrates with already
popular security solutions.

You can use SearchInform FileAuditor to determine:

• which documents contain business-critical information,
• how much of this information is stored by the company and where
  it is located,
• who has access to them and can modify them.

It is possible for the IT department to take on such tasks. For
instance, DCAP makes the file system less messy since each document
is assigned a category (contracts, prices, personal data, research,
etc.).

Probably not the most important feature, but shadow copying is a
useful feature, which lets you restore documents without any
problems if something goes wrong. As a first step, however, the
software is intended for information security specialists.

Here’s how FileAuditor works:

• searches for a file
• assesses its compliance with the rules and labels it (“personal
  data,” “agreement,” etc.)
• if necessary, copy a file to the repository.
• keeps track of all actions with files and folders
• reads permissions on files and folders
• at subsequent checks, only newly added or changed files are
  scanned.

This year, SearchInform also released its own database
monitoring solution – SearchInform Database Monitor. A database is
the main information asset of businesses, so it plays a critical
role in their operations. Fraudsters are interested in both the
entire array and specific access points to data. This threat can be
handled using the DAM system; for example, the Database Monitor
sees:

• Who is accessing the databases, and for what purpose?
• What information is requested from the database, and how much
  of it.
• What changes are being made to the databases?

In spite of the belief by many companies that they have
sufficient control over their file systems and are certain that
their users will adhere to corporate policies, our experience shows
that some companies can treat sensitive information poorly, and
some documents can be found at nonconforming locations.

Try the file audit^[3]
solution for^[4] 30 days for free, and
you’ll probably change your mind and learn more about data misuse
incidents within your company.