Reasons for information leakage at an enterprise
Most often, information leaks occur through the fault of the company's employees. Employees can deliberately or accidentally give out confidential data, transfer information to competitors after dismissal. The more confidential data an enterprise has, the stronger the security system should be.
The consequences of a data leak
Leaks in an enterprise lead to loss of competitiveness, criminal or administrative liability. The leakage of classified information of national importance becomes the reason for the application of sanctions and the termination of state sponsorship.
Damage is a lost commercial profit, so information should be protected not only using technical means, but also by monitoring the work of employees. A non-disclosure agreement must be concluded with dismissed staff.
Confidential information includes data that can be used by a limited number of people. Not all employees of the enterprise have access to information, but there is a risk of theft of valuable information. There is no single method for preventing information leakage at the enterprise. The task of the security service is to apply the latest security technologies for a specific company.
Types of threats
The main classes of threats include natural, which are not related to human activity, and artificial (subjective), which are the result of human activity.
Threats of natural origin include a sudden breakdown of the device on which the information was stored, natural disasters, as a result of which a building with documents of particular importance was damaged, and so on.
Man-made threats can be unintentional or deliberate. In the first case, damage to the enterprise is caused by accident. For example, an employee may not be aware of the importance of the data and mistakenly transfer it to an attacker.
In case of deliberate leakage of confidential information, the employee is aware of the consequences of his actions. An attacker obtains the desired data in several ways:
- It is introduced into the collective of the enterprise and can work in the company for a long time. There are often cases when an attacker is promoted to a management position, and then data theft leads to colossal losses.
- Recruits staff.
- Illegally enters the territory of a company or a protected facility.
- Monitors and steals data remotely.
Threats are also divided into internal or external. Internal activities include the activities of the company's employees, the installed software and the hardware used. Data leaks are caused by malware and scripts injected by users of the enterprise network. Hardware components that have not been serviced on time can malfunction, giving attackers access to sensitive information. Any employee is considered a potential intruder, so the main condition to avoid leakage is to control the work of staff.
External threats include remote installation of spyware on your computer, natural disasters, or the activities of competing organizations and related entities.
Possible leak channels
The greatest risk of confidential data disclosure is associated with the channels through which accidental information leaks occur. This includes losing media, clicking on malicious links, discussing classified information outside the company, and so on.
Leak channels are divided into four categories:
Leakage channels of classified information, which are linked by a commercial data processing system. The attacker does not change anything in the system to obtain data.
- Leakage of classified information related to changes in security system settings or replacement / destruction of its physical components. This includes the theft and unauthorized copying of data carriers, monitoring the information processing process.
- Illegal connection of the attacker's hardware components to the technical means of the enterprise. This includes using directional microphones or devices to pick up interference from other devices, changing software functions.
- Bribery and blackmail of company employees. This type of leakage of classified information concerns not only team members, but also their relatives or acquaintances who may be privy to the secret.
The example of the typology of leakage channels shows that there is no single, universal way to solve problems, so information should be protected at all stages of use, transmission and storage. Also, the protection system must work continuously and be updated regularly to respond to the emergence of new types of threats.
How to protect an enterprise from information leakage
Before creating a protection system, there are several questions to answer.
What data is classified as confidential information of the enterprise? Do they need protection from unauthorized disclosure?
How can an attacker steal data? It is important to work out all the identified leakage channels and options for their protection. It is important that the cost of protective equipment does not exceed material damage from loss of information.
Which groups of workers get access to classified information? Which employee can intentionally or accidentally create conditions for data theft? At this stage, you should observe the workflow of everyone. Leaks are often caused by the careless actions of new employees or employees who do not know the basics of cybersecurity.
The implementation of solutions to protect sensitive information in the enterprise can slow down the company and the processing of trade secrets. Therefore, the security service must choose powerful but quick solutions.
The main way to prevent data loss is constant work with staff. Workshops, team building trainings, incentives, and payments can help. An employee is unlikely to want to share important information with a competitor if he is satisfied with the salary and working conditions. When interacting with personnel, it is recommended to adhere to the norms of the international standard ISO / IEC 17799: 2000.
Developing a company's own security policy is another step towards ensuring the protection of trade secrets and preserving confidential information. The work of an enterprise should be regulated by means of access rules, descriptions of all norms and data processing procedures.
Using security services is an effective way to differentiate access rights to data. This includes various methods of employee authentication, the use of biometrics, access control, support for encryption protocols, security auditing.
16.12.2020
