Do you Have a Complete Data Security Plan? Think Again…

Today more than ever there are countless data points that employees have access to edit, download or share with others. Most employees that have access to company critical information will use it for its intended purpose (to benefit the company), but there are also some that will use it for nefarious purposes. We conducted a survey in partnership with CUNA Strategic Services and identified that 77% of all respondents do not believe, or are not confident if they have adequate protection against insider threats. It was also discovered that 62% of those polled also said they already have security controls in place. Clearly the type of tools that many companies are investing in do not give them the warm fuzzy feeling they are protected from rouge employees seeking to gain from company data.
What is the best method to get this type of threat under control?

1. Who Has Access to Data and Do They Really Need It?
   1. This should be done on a routine basis. Executives, Management, and HR should participate in the creation of “rules of engagement” with respect to employee data access and how that may use it. Be clear on what employees can and can’t do with company data and make sure that you document what the repercussions will be if they violate any data policies.Creating data access groups also makes sense. Meaning, companies do not usually have a flat structure and employees at an Entry Level should not have the same access to the same privileged information a CEO would. That said, it makes sense to consider data access grouping to ensure that the right people have access to the right data they need to do their job and nothing more.After the policies have been worked out and a definitive version has been created, you should review this information with the employees and have them sign a document that they acknowledge it.
2. What Security Tools Do You Have and Do You Enough Protection? 
   1. Remember the statistic mentioned earlier? (77% don’t believe, or are not confident they have adequate protection against insider threats…) This is the time to spend carefully reviewing what security tools you are using and if they provide your organization with enough protection that is in alignment with your needs, but also your newly adopted security policy. Most people think getting an anti-virus software and having malware protection is enough protection. While that is enough protection it is mostly designed to protect against external threats, but predominantly ignores the internal threats. DLP tools should be considered and will protect a good bit of internal file access, but it will not fill all gaps. DLP typically protects against things like USB or Outlook with respect to files being sent outside of the organization, but employees seeking to steal data will likely use things like webmail, or an internet based file sharing application like dropbox, or even a chat program. Anti-virus, Malware protection, and DLP have no way of stopping these kinds of events. Employee monitoring software (like InterGuard) will fill the gaps that DLP simply cannot do and protect the inside of the perimeter because it is constantly monitoring all employee activity.
3. Can Personal Issues Cause Behavior Issues That Cause Data Issues?
   1. Yes… This is an often-overlooked aspect of most security plans because companies simply do not want to seem invasive to an employee’s personal life, but personal lives change. People can change, become jaded and bitter in the workplace. These types of events can and do happen all the time. When you see this kind of behavior, you should realize that the risks of nefarious activity increase.This group of employees are more likely to commit a workplace crime because they are on their way out the door and think they have nothing to lose. While we recommend that everyone in your organization be monitored during their shift, it is critical that this group be closely monitored. You will want to know the second anything that even comes close to being a suspect event such as taking a customer list they have access to and sending it via webmail. InterGuard takes things a step beyond simple activity monitoring. Behavioral reporting can detect when someone is outside of the standard baseline of employee activity and is sophisticate enough to notify you when it happens and what the details are. While you cannot stop someone from behaving poorly in the workplace, you should at least want to know that they could be stealing company confidential information.
4. Record, Automate and Review Data
   1. Just because you spent time creating a security policy and have invested in the right tools does not mean you are safe. You need to invest time to review recorded activity on a regular basis to pinpoint anomalies in employee behaviors. This is usually a burden that many companies never anticipated would be some time consuming. Employee monitoring software records a lot of information and it can be a tedious process to sift through all this data to find out if people are using the files they have access to according to the company data security policy. InterGuard alleviates the amount of time and resources associated with having to go over all the recorded data by way of automation. You can set InterGuard up to send you alerts, notifications, and reports of the data that you find most important. For example, you can receive an alert with details every time an employee takes an excel file and adds it as a webmail attachment.Automation is not something that comes with most employee monitoring software, so be careful when making your selections.
5. What Else Can InterGuard Do?
   1. Architected at the endpoint, InterGuard has 5 technologies including Employee Monitoring, DLP (Data Loss Prevention), Web Filtering, Remote Data/Laptop Recovery, and Mobile Monitoring through one agent download and one control console.
   2. The Employee Monitoring module records and blocks all activity on Windows and Mac OS computers on or off the network. You can also receive automated reports and alerts via email.
   3. The leader in Data Loss Prevention software, Datalock will allow you to view and block data from leaving via email, web forms and removable media (such as USB drives) as well as data saved on local drives (even remote laptops). Best of all be notified when someone violates a policy you create and manage override requests all from one location.
   4. The Web Filtering module is deployed at the endpoint and is a powerful web recording and blocking tool (works on remote employee computers too) that is priced to meet any budget.
   5. Laptop Cop is an invisible piece of software that provides secret access to your computer remotely over the Internet no matter where the thief takes your computer. You can geolocate the location of the computer and retrieve/delete data from anywhere in the world.
   6. The Mobile Monitoring module records a broad array of cell phone and tablet activity (see features below). Mobile Monitor never requires jail breaking or rooting and installs quickly. All recorded data is sent to a secure web based location which allows you to review employee activity from any internet connected computer.

About InterGuard

Awareness Technologies develops award winning monitoring software that records and controls all end user activity on all PC, Mac, iPhone, iPad, iPod, Android phones and tablets, and blackberry mobile devices.

As the pioneer for Unified Insider Threat Prevention, Awareness Technologies‘ SaaS-based service is easily available and affordable for businesses of any size – especially the SMB market. Architected at the endpoint, clients can access 4 technologies including DLP (Data Loss Prevention), Web Filtering, Employee Monitoring and Laptop Recovery, through one agent download and one control console.

Awareness Technologies has over 10,000 businesses world-wide currently depending on its solutions to protect their data from insider threats, and has been named on the Deloitte Technology Fast 500, Inc. 5000 and Software 500. In addition to running seamlessly in a local OS environment, Awareness Technologies’ products are also Citrix and VMware ready.

Our solutions allow businesses insight and provide details regarding employee activities on and off the network to make certain they are staying in alignment with the guidelines of company policies and procedures in a comprehensive, yet easy to manage cloud based environment.