Working with confidential information
The issues of protecting confidential information are relevant for every modern enterprise. Confidential company data must be protected from leakage, loss, and other fraudulent activities, as this can lead to critical consequences for the business. It is important to understand what data needs to be protected, to determine the ways and methods of organizing information security.
Data to be protected
Information that is extremely important for doing business should have limited access to the enterprise, its use is subject to clear regulation. Data that needs to be carefully protected include:
- trade secret;
- production documentation of a classified nature;
- know-how of the company;
- client base;
- personal data of employees;
- other data that the company considers necessary to protect against leakage.
The confidentiality of information is often violated as a result of fraudulent actions of employees, the introduction of malware, and fraudulent operations of external attackers. It doesn't matter which side the threat comes from, you need to secure confidential data in a complex consisting of several separate blocks:
- determination of the list of assets to be protected;
- development of documentation that regulates and restricts access to company data;
- determination of the circle of persons who will have access to CI;
- defining response procedures;
- risk assessment;
- introduction of technical means to protect CI.
Federal laws establish requirements for restricting access to confidential information. These requirements must be met by those who access such data. They do not have the right to transfer this data to third parties if their owner does not give his consent to this (Article 2, clause 7 of the federal law of the Russian Federation "On information, information technology and on the protection of information").
Federal laws demand to protect the foundations of the constitutional system, rights, interests, human health, moral principles, to ensure the security of the state and the country's defense capability. In this regard, it is imperative to comply with the CI, to which access is limited by federal laws. These regulations define:
- under what conditions the information is classified as an official, commercial or other secrets;
- the obligation to comply with the confidentiality conditions;
- responsibility for the disclosure of CI.
Information received by employees of companies and organizations carrying out certain types of activities should be protected under the requirements of the law on the protection of confidential information, if by the Federal Law they are assigned such duties. Data related to professional secrecy can be provided to third parties if it is prescribed by the Federal Law or there is a court decision (when considering cases on the disclosure of CI, identifying cases of theft, etc.).
Protection of confidential information in practice
In the course of the work process, the employer and the employee exchange a large amount of information, which is of a different nature, including confidential correspondence, work with internal documents (for example, personal data of an employee, company developments).
The degree of information security is directly dependent on how valuable it is for the company. The complex of legal, organizational, technical and other measures provided for these purposes consists of various means, methods and activities. They can significantly reduce the vulnerability of protected information and prevent unauthorized access to it, fix and prevent its leakage or disclosure.
Legal practices should be followed by all companies, regardless of the simplicity of the security system used. If this component is absent or is not fully observed, the company will not be able to ensure the protection of CI, will not be able to legally prosecute those responsible for its loss or disclosure. Legal protection is basically legally competent paperwork, correct work with employees of the organization. People are the backbone of a system for protecting valuable confidential information. In this case, it is necessary to select effective methods of working with employees. During the development of measures by enterprises to ensure the safety of CI, management issues should be among the priorities.
Protecting Information in the enterprise
In the event of civil and labor disputes about disclosure, theft, or other harmful actions about trade secrets, the decision on the involvement of certain persons in this will depend on the correct creation of a system for protecting this information in the organization.
Particular attention should be paid to the identification of documentation constituting a trade secret, marking it with appropriate inscriptions indicating the owner of the information, his name, location, and the circle of persons who have access to it.
When recruiting and in the process of working, employees, as the CI database is formed, should familiarize themselves with local acts regulating the use of commercial secrets, and strictly observe the requirements for handling it.
Labor contracts must specify the conditions for the use of official information that is used for use in work, and responsibility for violation of these requirements.
IT protection of information
An important place in the protection of CI is the provision of technical means in the modern high-tech information world, corporate espionage, unauthorized access to enterprises, the risks of data loss as a result of viral cyber attacks are quite common. Confidentiality of information, confidential information, protection of confidential information.
Offenders can take advantage of any mistake made in information protection, for example, if the means to ensure it was chosen incorrectly, incorrectly installed, or configured.
Hacking, theft of confidential information, which is becoming more expensive than gold today, require company owners to reliably protect it and prevent attempts to steal and damage this data. The success of the business directly depends on this.
Many companies use modern, highly effective cyber defense systems that perform complex tasks of threat detection, prevention, and protection of leaks. It is necessary to use high-quality modern and reliable nodes that are able to quickly respond to messages from information block protection systems. In large organizations, due to the complexity of interaction schemes, multilevel infrastructure, and large amounts of information, it is very difficult to track data flows and identify the facts of intrusion into the system. Here, a "smart" system can come to the rescue, which can identify, analyze, and perform other actions with threats in order to prevent their negative consequences in time.
To detect, store, identify sources, addressees, methods of information leakage, various IT technologies are used, among which it is worth highlighting DLP and SIEM systems that work in a complex and comprehensive manner.
DLP systems to prevent data loss
To prevent the theft of confidential company information, which can cause irreparable harm to the business (data on investments, customer base, expertise, etc.); it is necessary to ensure the reliability of its safety. DLP systems (Data Loss Prevention) are a reliable protector against CI theft. They protect information simultaneously through several channels, which may be vulnerable to attacks:
- USB connectors;
- locally functioning and networked printers;
- external drives;
- Internet;
- postal services;
- accounts, etc.
The main purpose of a DLP system is to monitor the situation, analyze it, and create conditions for efficient and safe operation. Its task is to analyze the system without informing company employees about using this method of tracking work nodes. At the same time, employees are not even aware of the existence of such protection.
The DLP system controls the data that is transmitted by a variety of channels. She is engaged in their actualization, identifies information according to the degree of its importance in terms of confidentiality. In simple terms, DLP filters data, and monitors its safety, evaluates each information, decides if it is possible to pass it. If a leak is detected, the system will block it.
Using this program allows you not only to save data but also to determine who sent it. If, for example, an employee of a company decides to “sell” information to a third party, the system identifies such action and sends this data to the archive for storage. This will allow you to analyze the information, at any time taking it from the archive, to find the sender, to establish where and for what purpose this data was sent.
DLP systems are complex and multifunctional programs that provide a high degree of protection of confidential information. It is advisable to use them for a variety of enterprises that need special protection of confidential information:
- private information;
- intellectual property;
- financial data;
- medical information;
- credit card data, etc.
SIEM systems
Experts consider the SIEM (Security Information and Event Management) program to be an effective way to ensure information security, which allows summarizing and combining all logs of ongoing processes on various resources and other sources (DLP systems, software, network devices, IDS, OS logs, routers, servers, AWP of users, etc.).
If the threat was not identified promptly, while the existing security system worked to repel the attack (which does not always happen), the "history" of such attacks subsequently becomes inaccessible. SIEM will collect this data across the entire network and store it for a certain length of time. This allows you to use the event log using SIEM at any time to use its data for analysis.
Also, this system allows you to use convenient built-in tools to analyze and process incidents that have occurred. It converts hard-to-read incident information formats, sorts them, selects the most significant, eliminates the insignificant.
The special SIEM rules specify the conditions for the accumulation of suspicious events. She will report them when the accumulation of such a number (three or more), which indicates a possible threat. An example is an incorrect password. If a single event of entering an incorrect password is recorded, SIEM will not report this, since cases of one-time password entry errors when entering the system occur quite often. But the registration of repeated attempts to enter an invalid password while logging into the same account may indicate unauthorized access.
Any company today needs such systems if it is important for it to maintain its information security. SIEM and DLP provide complete and reliable information protection of the company, help to avoid leakage, and allow you to identify who is trying to harm the employer by stealing, destroying, or damaging information.
23.11.2020
