Recently, the web site “Wikileaks” released over 250,000 classified U.S. State Department documents containing correspondence from diplomats and many allies. The result has been embarrassing for world politics and highlights the many reasons for maintaining tight security.

One of the most commonly ignored reasons for improving computer security is “loss of customer confidence”. But consider the effects of this exposure: foreign contacts that worked closely with the United States are now afraid that intelligence they provide will be made public thereby putting their lives at risk. This breakdown in security will have long term effects to international diplomacy due to fear of information leaks. If the United States can lose that much information, how could a smaller country prevent the theft of their classified information?

Another serious issue this leak highlights was instruction to U.S. Diplomats to “collect basic contact information about U.N. officials that included Internet passwords, credit card numbers and frequent flyer numbers.” (NBC, November 29, 2010.) Provided this is a real document, these pieces of information aren’t typically acquired by a casual conversation, so presumably cyber security has to be breached in order to accomplish this. Alternatively, this information could be attained by leaked information from other insiders. This conjures ideas of a network of individuals, all of whom may profit from releasing confidential information to governments.

This may seem too big of a problem for an individual or small organization to handle, but it concerns us all nevertheless.

By now most organizations have firewalled their networks and put intrusion prevention systems in place to monitor for attacks. However, data leaks are often caused by employees that won’t be detected by those systems, so how can an organization prevent loss of confidential data?

Full compliance with regulation is the first step. If you are handling information that is confidential and potentially hazardous to disclosure, it is probably regulated already. FISMA, PCI DSS, and HIPAA are just some examples. Standards for security have been defined by organizations such as the National Institute of Standards and Technology and are very comprehensive. Security standards have been expanding in breadth and depth so any organization that is not compliant now needs to plan not only to catch up but to stay ahead.

Tending to organizational security is as important as the computer systems, so don’t overlook the personnel, their access to sensitive information, and ensuring the company management follows the “principle of least privilege” so employees have just enough access to fulfill their responsibilities. Employees need to be trained to identify threats, report suspicious activities, and be able to properly respond to incidents.

Strong encryption prevents the wrong hands from accessing data, even if they managed to compromise the system or eavesdrop on network connections. Although management of encryption technologies is often a challenge for organizations that never used them in the past, the benefits of preventing data leaks by using encryption outweigh the cost of training employees to use it.

Security Information Event Management maintains the official record of use for the organization’s information resources. This record provides the evidence used by network forensic experts to determine the nature of an incident. Centralization also provides the most effective way to monitor anomalous activities, correlate events to spot adverse activities, and to diagnose error conditions that lead to vulnerabilities.

Fear of legal reprisal prevents most people from releasing stolen information. Hacking computer systems with the intent of committing espionage has severe consequences if the culprit is caught. If a person wouldn’t knowingly shoplift in front of a camera, they wouldn’t steal information if they were being heavily monitored by proven technology.

Data Loss Prevention is another known and proven technology that can prevent removable media from being used by a computer. By preventing flash memory, writable optical media, or other USB connected mass storage from being used, large amounts of information will not be able to leave the organization undetected. Efforts made to bypass DLP technology would raise additional alarms that signal intent to steal information, easily identified by a SIEM.

Malware Heuristics provides an alternative to signature-based malware detection. As a collection of different types of tools, anti-virus packages offer ways to locate one-off or custom malware based on behaviors, functionality, and other conditions that are highly suspicious. While anti-virus is required for most organizations, many leave heuristics turned off. If you’ve wondered how to protect against custom malware that doesn’t have an anti-virus signature, heuristics is the best solution.

Network Content Inspection is a genre of security products that can examine the contents of e-mail, web accesses, instant messaging, and peer-to-peer transfers for violation of a predetermined policy. Large e-mails can be identified and can be stopped pending management approval, communication to non-approved sites banned, or even key words can be found inside content of mail or attached documents.
Operations Risk Management is a broad set of activities that connect the security controls to the way operations are performed in your organization. Use of badges, access key codes, security cameras, guards, perimeter fences, tamper resistant locks, and other such controls will enhance the security of the computer systems by preventing unauthorized access and tracking employees.

These protections are certainly not the only techniques that can be done to protect data in your environment, but they are necessary if you are serious about preventing data leakage. All are known technologies, readily available, and have many case studies as to their effectiveness. You may not be able to stop every instance, but you can take steps to avoid suffering a breach on the scale of the Wikileaks case through preventative measures based on common sense, effective forensics and rapid response capabilities to immediate threats.