According to the Irish Independent*, thousands of drivers whose cars were towed on behalf of the gardaí had details of insurance investigations, vehicle registration certs, notices of car seizures and payment card details exposed in a major IT data breach. How can such incidents be prevented?
According to the newspaper the breach was caused by a software error at a Limerick-based IT services firm, which works with 11 tow-truck companies which store records of towing for An Garda Síochána and other entities. The Data Protection Commissioner is trying to establish responsibility, as the gardaí claim they’re not to blame for the incident.
Allegedly the the breach affected over 500,000 high-resolution scans of sensitive personal documents, but it is still unclear how many were actually accessed, as the company claims it secured the vulnerability in an hour after being notified.
Data leak or data breach?
Given such huge disparities between the types of incidents that can result in data being made public, we might separate them into two distinct groups: data breaches and data leaks.
With a data breach, attackers typically need to access a server through a vulnerability, or by carrying out the kind of attack that could be prevented with the right security solution in place.
With a data leak, it’s possible that there are no obvious security holes. Instead, the data might have found its way into the wrong hands because of some irresponsible internal action, or, for instance, the malicious actions of a disgruntled employee.
The distinction between data “leaks” and “breaches” is not universal. Many experts would classify all of these types of data loss as data breaches – after all, they can all be just as damaging to a company.
Here are some tips on how to keep a company safe from data leaks and breaches:
Boost security awareness
It is often argued that a good security strategy has to start with people. After all, human error is the most common cause of data breaches, and security solutions can only go so far. Getting security right is as much a cultural challenge as a technical one.
End user security awareness training is a huge benefit, especially when it changes the culture of the company by making it more security minded. Training employees helps eliminate mistakes that could lead to a breach, as well as making them more informed (better able to notice odd behavior by malicious insiders or fraudsters, for example).
Identify sensitive and critical data
The first step, before considering protection techniques and tools, is to analyze and identify what important information must be protected. To do so, it is important to understand the logic and architecture of the database, to make it easier to determine where and how sensitive data will be stored.
We also recommend keeping an inventory of the company databases, being sure to take all departments into account. The only way to administrate and avoid losing information effectively is to know about all of the company’s instances and databases and keep a record of them.
Manage your data effectively
Businesses should keep a close eye on what information is being shared with partners, suppliers and customers, and also what their employees are doing on the network. After all, since many companies have a multitude of endpoints, it is vital to monitor the traffic on all networks.
Essentially, you need to keep a close eye on what’s happening in your environment, and this requires good data logging and skilled staff to look out for anything odd or suspicious.
Encrypt data and devices
Encryption is one of the most topical subjects in the world today. While it can certainly trigger many heated debates – it divides governments and tech organizations, for example – most people are of the opinion that it is a positive asset for organizations.
Organizations should, without hesitation, look to encrypt all sensitive information and devices. A good encryption policy that you can enforce on employee devices is also key. This is essential to helping reduce the likelihood of a possible data leak, which can, in turn, have huge repercussions on businesses.
Protect the endpoint
In today’s technological age of bring your own device (BYOD), where more employees increasingly use personal mobile devices for work purposes, endpoint management is an essential part of company security.
Endpoint security should include remote wiping, on-disk encryption and endpoint backup – after all, the data must be backed-up somewhere in the event it is lost, stolen or maliciously encrypted.
*ESET does not bear any responsibility for the accuracy of this information.
ESET Ireland 