I just started watching the new mini-series, Timeless where the bad guys go back in time to rewrite history and the good guys go after them to keep history intact. As I read the recent news on a nuclear facility in Japan losing 59K files pertaining to lab research on Tritium, a key component of hydrogen bombs, I’m thinking, maybe the bad guys in Timeless have it right. The US Election is another interesting scenario where a presidential candidate is being investigated for government classified information on a personal server only weeks before the big election.
It would certainly be nice to change the past. I’m sure both presidential candidates would like that option given the exposure of private emails or past media being hacked or leaked. But breaches like a nuclear facility losing sensitive files could have serious and life-threatening consequences. We need to approach security of highly sensitive data in a new way – at the file level. So let’s dive into why it’s “mission critical” to implement persistent, file-centric security that defies time and place.
Thwarting Attackers a New Way
As a global economy, we collaborate with contractors, partners and vendors around the world as part of doing business. This leaves companies and governments vulnerable to how sensitive information such as drawings, financials, personal emails, etc., is being distributed, used and by whom. In a recent survey by Enterprise Strategy Group (ESG) “Enterprise Strategy Group“ 56% of respondents said it’s very or somewhat likely that files had been stolen by partners, contractors or customers, as well as 58% saying the same about files being stolen by employees and malicious software (60%). These percentages reflect an alarming rate in which data is being lost or stolen. Companies need to shift to a data-centric strategy that stands as a watch guard around files or emails wherever they are shared or stored.
Most of the breaches whether they are from an insider threat such as an employee, a third- party contractor or partner, or from an outside threat such as bad actors, malware or ransomware, can be prevented if the file or email is protected with persistent access and usage controls from an enterprise digital rights management (EDRM) solution. For instance, if files are stolen without anyone noticing for an extended length of time, such as the case with the Japanese nuclear plant, bad actors may have ‘possession’ of the files but they would be unable to open or use them if the files were protected with EDRM.
With employees and contractors, they need access to information to do their jobs. With EDRM, usage controls policies will control what the recipient is allowed to do with the file (view, print, re-share, screen capture, cut/paste, etc.), where they can access the file (from which device/location), and for what length of time. EDRM enables secure collaboration, controlling exactly what happens with information even while it is being used, to limit a company’s exposure and liability to misuse.
Ransomware is unique in that data is kidnapped by a hacker who adds encryption to the file to prevent access to the rightful owner. However, in order to add encryption, the hacker must be able to open the file. With persistent protection at the file-level, the hacker is unable to open the file to add the ransomware if EDRM is in place.
Additionally being able to track files or emails for usage and patterns of unauthorized attempts can help quickly alert an organization to an attempted attack and what information is being pursued. And in the event that an employee leaves, a sub-contractor has completed a project, or a mobile device is lost, a company can respond quickly by removing access to the files.
Security that Never Rests
As I wait for the 2016 Presidential Election in the US, a part of me wonders if there will be another bombshell announcement from a “leaked” source. Or maybe another country will “rig” our election process (we won’t know unless Trump loses though!). The challenge with Cybercrime, it that it can take years to discover if it happened. But wouldn’t it be nice to know that you’re in control of your files and they are protected no matter whose hands they fall into? No need to travel back in time.