It is an interesting time to be in IT security today. PRISM and Edward Snowden taught many lessons about how companies should secure their data. There’s been a lot of discussion about the surveillance aspect of this, but consider this whole affair from the side of the NSA.
To the NSA, this was a data breach of unprecedented proportions. All indications are that Snowden was able to exfiltrate a significant amount of classified data; what has been published so far represents a relatively small portion of what he was able to access. Consider that Snowden technically wasn’t even an employee – he was a contractor. How did he do this? How could a contractor access this much information?
Some companies may think – “if it can happen to a spy agency, there’s nothing we could do. We should just give up and not protect our data anymore.” Others may say: “let’s build a bigger wall around our data.” Both approaches are incorrect. Obviously, you have to protect your data. However, neither can enterprises just try and protect everything with the same rigor. A truly determined attacker can get in if he wants to get in.
What an enterprise needs to focus on is what really needs to be protected. Which sets of data, if stolen, can ruin a business? Are they the trade secrets? Or maybe customer data? This will differ for each company – what may be vital for one organization may be trivial for another. Each organization has to decide for itself. Some examples of what a company can consider core data would be: trade secrets, research and development documents, and partner information. Each of these would represent millions of dollars in losses, not just in monetary terms, but in trust and confidence as well.
Once these core data have been selected and identified, the next step is: defend these strongly. How? That would depend on what the data is, how it is stored, and who needs to access it. Is it something that can be locked in a vault and kept offline for years on end, or is it something that needs to be accessed on a daily basis? For each organization, the challenges will be different, and so will the solutions.
We must not forget one other component of security: end users. Difficult as it is, end users should be educated to not fall for simple scams. Examples include, “If the administrator asks you for your user credential and password, maybe you should ask another one instead. If you receive an email, which sounds too good to be true, don’t click on it.”
All in all, it’s a combination of identifying what’s most important, deploying the right technologies, and educating users. It is everybody’s job – not just those of IT professionals – to ensure that the company’s core data stays safe.
For more details on various targeted attacks, as well as best practices for enterprises, you may visit our Threat Intelligence Resources on Targeted Attacks.