Summary

Use Data Loss Prevention Tools as data theft alarms.
 
Stop breaches by eliminating the vulnerabilities that cause them. Start with Breach Avoidance Audits to detect and re-engineer web pages that allow SQL, Scripts and Insufficient Authentication. The victim list for these popular vulnerabilities include: Heartland Payment Systems Inc., BJ's Wholesale Club Inc., OfficeMax, Barnes & Noble Inc., Hannaford Bros. Co.and many others.

A safety net is needed; use an automated data lockdown.

Analysis

“But there's an ugly truth that DLP vendors don't like to talk about:
Managing DLP on a large scale can drag your staff under like a concrete
block tied to their ankles.” 

This is not true. Data Loss Prevention Tools can be made
to act as simple data theft alarms.

The following specific actions are highly recommended:

  • Use Breach Avoidance Audits to detect and repair vulnerabilities.

  • Use Perimeter DLP to detect if 'sensitive' data is escaping the network. This would have stopped Heartland Payment Systems Inc, Hannaford Bros. Co., TD Ameritrade and hundreds of other breaches in their tracks.

  • Use Endpoint DLP to restrict the actions of in-house users. For two years a mortgage loan evaluator working for Countrywide Mortgage brought home more than 5,000 different mortgage applications for “review” every weekend. Finally his partner in crime, the buyer of the mortgage applications, was arrested.

  • Secure ATM and credit card readers. Besides being tamper-proof and transmitter-free, they should encrypt the information as they read it. Sensitive information has to be initially encrypted, downstream is a different topic.
  • Use Data Loss Prevention Tools as data theft alarms.
  • A safety net is needed; use an automated data lockdown.
All this may be good news for several companies, such as Palisade Systems, Code Green Networks, Safend, GTB Technologies, CA inc . DLP, Identity Finder, Websense Data Endpoint, Trend Micro LeakProof, Indorse, Proofpoint, Vericept, Workshare, Symantec Vontu, EMC RSA, Voltage, Verdasys, McAfee, inc . DLP, Magtek MagneSafe, PGP, Fidelis Security and VeriFone Holdings VeriShield Protect.

Copyright January 2010, Michael Cherry Cherry Biometrics Inc., all rights reserved

Analyses are solely the work of the authors and have not been edited or endorsed by GLG.