By Debra Littlejohn Shinder
March 29, 2010
Unfortunately, the same security precautions that prevent DoS attacks, viruses and worms, and other high profile attacks may not be addressing a much more insidious problem: theft of company data for corporate espionage or other purposes. Yet the disclosure of your trade secrets to a competitor or the release of private company information to the media could, in some cases, result in a much greater loss than network downtime.
1: Practice the principle of least privilege and put policies in writing
Two opposing philosophies regarding network access policies:
1. All Open Policy, presumes that all data is available, unless explicitly restrict access.
2. Least Privilege Policy, operates on the assumption that all data is off-limits to a given user unless that user is explicitly given access to it. LPP is like the "need to know" policies of government intelligence agencies: Unless a user has a demonstrated need to have access to a particular file, that user can't access it.
Your policies should be specific and give examples of what's prohibited. Workers may not understand, unless you spell it out, that emailing a company document as an attachment to someone outside the network (or even to their own home account) is just as much a violation of policy as copying that document to a USB drive and physically taking it out the door.
2: Set restrictive permissions and audit access
