Miss the boat on the next wave in information security and you’re likely
to sink the corporate ship.
Reducing the business risk that results when data leaves the enterprise
network should be on the radar screen of every administrator, according
to industry watchers.
”Information security, or the lack thereof, affects the reputation,
reliability and trustworthiness of every company. And, once you lose it,
you lose it forever,” says Larry Ponemon, founder of the Ponemon
Institute, a think tank that studies privacy data protection and
information security policy.
Industry participants predict that increasing numbers of companies will
be poised to address data leakage in 2005, followed by product
implementations through 2007. Why? Because the problem is growing
exponentially and no one wants to be tomorrow’s headline news because of
it.
The time is now
To grasp the scope of a problem, a recent study by the Ponemon Institute
looked at 163 Fortune 1,000 companies. The study revealed that 75 percent
of them reported a security breach in the prior 12 months. The leaks may
have involved personal information about customers, personal information
about employees, involved confidential business information, and
intellectual property, including software source code.
”What we’re seeing is that many companies have poor access controls over
who gets data and no way of controlling the outflow of data,” says
Ponemon.
According to Gartner Inc., more than 80 percent of high-cost security
incidents occur when data from inside the organization gets out. Most
data leakage occurs by accident or because of poor business processes,
says Rich Mogull, a research director at Gartner. Whether accidental or
malicious, security breaches from inside the company aren’t addressed by
the bulk of security dollars spent on technology that addresses the
perimeter of the network.
While the problem of information exiting the company has always been
around, the depth and breadth of the problem has changed dramatically in
the past few years.
First off, information is more valuable and there’s more of it in
electronic form. For instance, there is more electronic communication,
such as email, and instant messaging. More people work remotely. Hackers
are evolving into professional criminals, and outsourcing is reaching a
fevered pitch.
Up until recently, most corporate security policy focused on keeping the
bad guys out. But now, says Jim Nisbet, chief technology officer at
Tablus Inc., ”The danger in what leaves the organization exceeds the
damage of what comes in.”
It’s the law
What’s really turned up the heat on stopping data leakage is a relatively
new patchwork of laws that make businesses liable for privacy and data
protection, and governance: California SB 1386 and A.D.1950,
Gramm-Leach-Bliley, Health Insurance Portability and Accountability Act
(HIPAA), The Patriot Act, and Sarbanes Oxley Act (SOX), to name several.
The DeKalb Medical Center is a Decatur, Ga.-based hospital with multiple
facilities and a variety of network traffic that includes standard
business data, and local and Internet communications, as well as private
patient health information. Up until January 2004, it had no network
monitoring tools to prevent data leakage.
”Being a hospital, HIPAA put the issue on the forefront,” says Sharon
Finney, information security administrator at DeKalb, adding that with
regulation in place, noncompliance becomes actionable and public. The
deadline for HIPAA compliance is April, 2005. The hospital began
addressing HIPAA requirements three years ago.
With a clear-cut path for what it needed to do, the hospital conducted a
risk analysis, identified problem areas, established policies and
searched for a technology solution. ”We knew from the start, that we
needed a tool that could identify protected health care information out
of the box,” says Finney.
With only three monitoring products available, at the time, only Vericept
Corp. was able to meet the medical center’s turnkey requirements. DeKalb
uses the vendor’s Healthcare Compliance Solution, and Filter for HIPAA.
Not only are business being forced to comply with compliance regulations
or risk paying fines, they’re also aware of the cost of damage to the
company’s reputation. ”For DeKalb, or any organization that handles
confidential information, the damage to our reputation could be
staggering,” says Finney.
In addition to implementing a security solution to prevent data from
leaving the organization and establishing policy, education was key to a
successful outcome. DeKalb’s user population includes employees, vendors,
contractors, temporary workers, and off-site physicians and their staff.
”We had to bring users to a level where everyone was reading off of the
same page when it came to security policy and procedures,” she says.
DeKalb is currently upping the ante on data security, and is looking at
implementing a second layer of protection via an email encryption tool.
Sorting through solutions
While some tools, such as encryption or PKI, have been available for a
number of years, they tended to be difficult to manage.
”Most companies opted to focus on higher priority projects and wrote off
the cost of data loss as part of doing business,” says Paul Proctor,
vice president of security and risk strategies at Meta Group.
Currently, there are more than a dozen vendors offering solutions that
address data leakage. A fractured market, products use a variety of
techniques to identify whether data should be stopped or let through the
network. Some content monitoring and filtering solutions are application
specific, or, for example, watch email traffic, IM, or FTP. Other
products are more general and work below the application layer and look
at multiple channels.
An early Reconnex Inc,.customer, Extreme Networks, a worldwide vendor of
network infrastructure solutions, is concerned about insider threats or
the loss of high-value intellectual property.
”Depending on the size of the company and the data lost, the
ramifications can be crippling,” says Paul Hooper, CIO at Extreme. For
the high-tech company, the Reconnex inSight platform for data protection
security is viewed as an insurance policy.
In addition to help meeting regulatory compliance requirements, security
solutions that help companies protect data from leaving the corporate
network, also can help protect brand loss and a company’s competitive
stance in the market.
Like most security solutions, this next layer of security protection is
not going to help companies make money. ”What we’re selling is risk
reduction,” says Joseph Ansanelli, CEO and cofounder of Vontu Inc. He
says it’s also about saving money by preventing future events.
According to Gartner’s Mogull, limited product deployments begin at
between $20,000-$50,000 and can immediately cut down on data leakage.
”Limited product deployments may not protect everything, but if a
company has data stores that are more important than others, begin
there,” he says. Mogull suggests that companies start with small
implementations and grow from there, prioritizing where it’s important to
spend money.
Industry participants are quick to point out that preventing data leakage
is not about technology alone — it’s about people, processes and
technology. ”Companies must have a written policy and there must be
consequences for not adhering to that policy,” says Ponemon.
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
FEATURE | By Samuel Greengard,
November 05, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
FEATURE | By Cynthia Harvey,
October 07, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
Top 10 Machine Learning Companies 2020
FEATURE | By Cynthia Harvey,
September 22, 2020
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020
Anticipating The Coming Wave Of AI Enhanced PCs
FEATURE | By Rob Enderle,
September 05, 2020
The Critical Nature Of IBM’s NLP (Natural Language Processing) Effort
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
August 14, 2020
Datamation is the leading industry resource for B2B data professionals and technology buyers. Datamation's focus is on providing insight into the latest trends and innovation in AI, data security, big data, and more, along with in-depth product recommendations and comparisons. More than 1.7M users gain insight and guidance from Datamation every year.
Advertise with TechnologyAdvice on Datamation and our other data and technology-focused platforms.
Advertise with Us
Property of TechnologyAdvice.
© 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this
site are from companies from which TechnologyAdvice receives
compensation. This compensation may impact how and where products
appear on this site including, for example, the order in which
they appear. TechnologyAdvice does not include all companies
or all types of products available in the marketplace.