Personal data protection

Efficiency in safeguarding personal data is procured when
a company introduces a method which:

 

ensures compliance with personal data protection regulations (PCI DSS, Basel, HIPAA and full GDPR compliance support

 

controls access rights differentiation and delimits roles of users authorized to work with particular data

 

manages and examines newly created and current accounts in order to discover identity theft as early as possible

 

guarantees personal data privacy, confidentiality and responsible use of customer nonpublic information and PHI (Protected Health Information)

 

shapes behavior of users accessing and processing personal data and detects any discrepancy or deviation

 

ensures data privacy, excludes risks concerning legal issues during personal data collection, analysis and storage

 

Personal data – such information as names, dates, addresses, credit card numbers, etc. – is structured data. Automated recognition of such data is fast, structured information is easily searched and managed. As this type of information is stored in databases, it is clear that most of the personal data is a target for indexing and malicious manipulation.

GDPR privacy policy concerns many countries, as there are many European companies’ branches all over the world or European citizens working abroad.

GDPR deadline is strict (report a breach within 72 hours).

Data protection demands that all the collected personal data is used transparently for the data owners and processed in accordance with the personal data protection act.

Learn more about how SearchInform helps companies comply with GDPR.

Get White Paper

What can happen?

  1. A user can send a request to a database in order to obtain some personal data

  2. The requested personal data can be exported to a file stored on a user's PC or in the local network

  3. The file can be sent outside a company’s perimeter via various communication channels:
    email, messengers, social media, printer, web forms, external storage devices and flash drives

 

What can be done?

SearchInform product provides your personal data with 4 levels of information protection

Level 1 – Database Monitor

The solution audits operations on databases and detects any information modification within them. In case someone tries to change a client’s details in CRM or unload a large amount of data, the software alerts to the attempt.

Database Monitor logs queries and responses and identifies users who access a database and manipulate information in them.

All user queries and SQL server responses are indexed automatically and become available for analysis. Specialists are provided with reports for various time intervals showing:

  • Activity of application accounts which have access to a database
  • Suspicious account activity – abnormal usage of databases
  • Relevant list of databases
  • Database queries
  • Query statistics

Database Monitor

Level 2 – FileAuditor

FileAuditor allows you to see the processes in a file system and monitor operations on your documents.

The DCAP solution audits information storages automatically for data criticality classification and assessment of changes made to files.

FileAuditor will let you know where your critical information resides and will make shadow copies of sensitive files saving the history of their revisions. Critical documents archiving ensures that the lost data is recovered.

The software simplifies personal data protection processes as it monitors open resources, files available to a specific user or group and privileged accounts. The solution audits operations on documents in a file system and reports any change made to them, such as creating, editing, moving, deleting.

FileAuditor

Level 3 – DLP

A DLP system controls information at the level of data transfer and communication channels protecting personal data, sensitive details from leaking outside a network perimeter.

The software safeguards confidential information and prevents breaches during storage, usage and transit. It can encrypt data to make it unreadable on any external unauthorized device. The software ensures that remote access is safe and conforms to internal regulations.

Information sent via messengers, including Skype or desktop version of popular IM, social networks (Facebook, Twitter, etc.), corporate email, uploaded to flash drives or printed is controlled and analyzed. The system reports irregular and suspicious events, such as data copying by an unauthorized user or sending files to a large number of email addresses.

DLP

Level 4 – Risk Monitor

Risk Monitor provides you with instruments for internal threat mitigation combining investigation capabilities and tools for creating risk management and compliance program (learn more about how SearchInform helps companies comply with GDPR). Its mix of predictive and inquisitive analytics allows you to learn about malicious activities and points out sources and purposes which might cause a data leak.

Even if a breach occurs, an investigation should be launched. The system responsible for internal threat mitigation comprises an extended range of search and detection techniques. The solution facilitates incident investigation, identifying all those involved, revealing reasons for and ways of exposure.

The software shapes an intelligent risk management program by altering policies and enhancing its mechanisms. It processes incidents, memorizes details and correlations so that similar threats would be recognized and neutralized.

Risk Monitor

 
85%

of specialists are convinced that human errors, social engineering and employee malicious activity inflict major damage*

of specialists are convinced that human errors, social engineering and employee malicious activity inflict major damage*

 
91%

of respondents claim that security measures are not sufficient and should be reconsidered in their companies

of respondents claim that security measures are not sufficient and should be reconsidered in their companies

 
52%

of employees who were reassigned to other jobs still have access to the data which isn’t related to their new tasks

of employees who were reassigned to other jobs still have access to the data which isn’t related to their new tasks

 
78%

of security leaders including those who have a standard DLP integrated are convinced that this solution working as a standalone is not sufficient when minimizing internal threats**

of security leaders including those who have a standard DLP integrated are convinced that this solution working as a standalone is not sufficient when minimizing internal threats**

*According to the Cyber Insecurity: Managing Threats From Within study

**Global Data Exposure Report 2019

Sign up for a free trial