2016: Data Breach Statistics, Year until 10/19/2016

*The ITRC tracks seven categories of data loss methods: Insider Theft, Hacking, Data on the Move, Subcontractor/Third Party, Employee Error/Negligence, Accidental Web/Internet Exposure, and Physical Theft.

The ITRC tracks four types of compromised information: Social Security number, Credit/Debit Card number, Email/Password/User Name, and Protected Health Information (PHI).

Total records exposed only include records for which count is available.

Zecurion offers deeper insight into selected incidents caused either by accidental or intentional data breaches. With all such incidents, the common elements describing the impact of this growing problem are financial loss, compromised intellectual property and dwindling customer confidence. Let us see how some sectors have been impacted as of October 2016. The excerpts below only provide a glimpse of some of these incidents – the list goes on.

Government

August 26, 2016 – County of Sacramento, California, issued a statement that an unknown number of records with personal data were exposed due to an error in the online automated application for Emergency Medical Service license. The information included name, address, social security number, driver’s license, phone number, date of birth of the applicants. Although there has been no report of misuse of PII, yet the county offered one year credit monitoring services of Experian to the affected people as a precaution.

Source: California Attorney General

 Healthcare

September 26, 2016 – One worker at Yale- New Haven Hospital and her friend were arrested for illegally procuring classified personal information of at least 20 near death patients and using the stolen data to obtain credit cards, becoming beneficiaries in their insurances among other planned crimes. This had been going on for two years before they were caught. A year’s credit monitoring has been offered to the victims.

Source: Media: News 3

August 12, 2016 – Bon Secours Health System disclosed that R-C Healthcare Management, a third-party vendor managing their Medicare and Medicaid reimbursement, accidentally left patients’ files accessible over the internet while updating network settings. About 665,000 records containing patient name, health insurer’s name, health insurance identification number, social security number and some health information was exposed to the general public. A forensic investigator was hired to correctly identify people that were affected by this breach and then informed about the incident. 435,000 were from Virginia and the rest were from Kentucky and South Carolina. No misuse of the exposed data has been reported so far.

Source: Media: http://www.nbcconnecticut.com/

Business

September 22, 2016 – Premier America Credit Union, California, reported that a departing employee sent an account list containing name, address and maybe social security and/or employer Identification number to his personal email address for most likely solicitation purposes in future. The employee was reminded of his obligations and company regulations and advised not to use any of this information for any purpose. The management further offered complimentary one year credit monitoring services of Experian to the victims.

Source: California Attorney General
August 8, 2016 – 7-Eleven reported that in June 2016 during a regular maintenance cycle some of the franchisees received the records of employees other than their own franchisee’s employees. The exposed information contained name, address, phone number and social security number of 7,820 employees. The correction was completed within 5 days. 7-Eleven offered 12 months of First Watch Technologies’ professional identity monitoring service to the victims in addition to $1,000,000.00 in identity theft insurance with no deductible.

Source: California Attorney General

Keep Sensitive Data Secure on a Tight Budget

As more services move towards the cloud, it is important to establish network security so as to ensure secure data transfer. Similarly, businesses that manage critical personal data need to maintain airtight security policies and procedures. Not having such policies in place may lead to security breaches or expensive client lawsuits. According to a 2016 report from the Ponemon Institute, almost 50 percent of small organizations that were surveyed experienced a data breach in the previous year. Another research by Symantec found that almost 43 percent of cyber-attacks in 2015 were targeted towards small businesses, up from 18 percent in 2011.

Small businesses make for an enticing target as they usually do not have the necessary security controls in place to secure their financial data from internal as well as external threats. Here are some low budget tips that can help small businesses keep their financial data safe.

  • Install proper network and work station controls such as properly configured firewall, anti-virus software, and updated patches for all hardware and software. Criminals usually try to exploit sensitive data such as Personally Identifiable Information (PIT), business trade secrets, financial data and other critical company information. Organizations must have restrictions in place for allowing only the least number of employees having access to sensitive information, especially financial or that related to security. Strict compliance must be ensured and employees must be trained and updated about it. This will help reduce incidents of data loss/ theft. Access to all storage, computing and online-based media like servers and databases must be restricted to only a few trusted employees.
  • Establish a culture of security by training and informing employees about accessing unsafe websites while at work that may result in major breaches. Companies may also resort to block access to certain sites for security reasons.
  • Conduct periodic testing to keep a check on vulnerabilities. The frequency of testing must depend on functional criticality and size of the company. With smartphones being used as devices for transfer of data, companies must ensure that these devices also fall under the purview of DLP policies and practices. Mobile devices must have anti-virus software installed and be up-to-date.
  • Get finance teams/ CTOs involved to understand the risks involved and get a holistic view of what can be done to mitigate these risks at the base level – without incurring too much cost.
  • Implement two-factor authentication along with strong password policy. Two-factor authentication requires use of a password plus a code or a biometric marker to access data. The additional layer of security makes access to sensitive data more difficult.
  • Set aside a small budget specifically for continuous monitoring or security-related loopholes to help ward off any attacks and threats. If utilizing the services of third party vendors for securely managing data, have a Service Level Agreement (SLA) which details security expectations and gives the right to thoroughly audit the vendor to confirm and ensure compliance with policies.

In essence, by just implementing and following certain basic tenets of security, most organizations can secure their sensitive data with bare minimum costs.

Is Cloud Storage Right for Your Business?

Storing data locally in your own data center has a number of limitations. Storage capacity and redundancy are limited by the server and drive space available in the data center. Increasing capacity to meet demand is costly and time-consuming. If demand falls off, you are left with wasted capacity sitting idle.

In the event of a hardware failure or power outage in the data center, your data will be unavailable, and could possibly end up corrupted or permanently damaged. In the event of a catastrophe, any backup data stored locally could be wiped out along with the production data, which would be devastating for most companies.

Benefits vary from vendor to vendor and depend on the service level you negotiate, but here are some of the primary benefits of storing data in the cloud:

  • Scalability―Cloud computing allows you to quickly and easily scale capacity, either increasing or decreasing available storage space to meet current demands. That means you will be able to handle unexpected spikes in capacity needs without having to over-invest in hardware that will spend most of the time idle.
  • Redundancy―Cloud storage providers generally provide multiple sites that are geographically separate, but with mirrored copies of all data. Hardware failures, power outages, or natural disasters affecting a site will be transparent to you because your data will still be accessible from the alternate sites.
  • Hardware Upgrades―Hardware changes so rapidly that your data center investment can be bordering on obsolescence when you have barely implemented it. A third-party vendor dedicated to providing hosted online storage will invest in hardware and infrastructure upgrades over time so you get the benefit of newer technology without having to constantly re-invest in new hardware.
  • Disaster Recovery/ Business Continuity―Storing data in the cloud also means that it is being stored offsite. In the event of a catastrophe or natural disaster impacting the local office, the data itself will still be protected and available online. Business will be able to continue almost seamlessly from alternate locations, and the data will be immediately available once normal operations resume at the primary office facility.
  • Cost―Considering what you get, scalable, redundant storage that also doubles as a disaster recovery and business continuity solution, the cost of cloud storage is typically quite reasonable. Consider as well that by engaging a third-party host for your data, you don’t have to hire personnel to manage data storage in-house, with their associated salaries and benefits. With the economies of scale offered by a cloud storage provider, adding additional space is a fraction of the investment that would be required for new hardware, and the power and cooling necessary to accomplish the same thing in an internal data center.

Leveraging cloud data storage provides a scalable, reliable, cost- effective storage solution. While there are multiple benefits, the type of cloud storage solution that works best for your company is based on your own specific needs.

Why is On-Demand Cloud Security Gaining Momentum?

 

Demand for cloud computing is high

Cloud computing today is the new normal. The need for cloud services is evidenced and accelerated by the growing number of organizations that are increasingly adopting cloud-based applications for communications, collaboration, business processing and storage. The use cases for the need is only strengthened by business drivers (cloud-driven innovation, user satisfaction, etc.) and technology drivers (agility, scalability, and costs).

Resistance to cloud adoption is gradually waning

In the near past, organizations have not been entirely comfortable with switching over to cloud computing. A big concern was (and to an extent, still is) the lack of faith in the provision of security in the cloud. Naturally, this means that organizations are not sure if data stored in the cloud is safe from incidents such as hacking and data theft. Add to this, the proliferation of bring-your-own-device (BYOD) to work―and the level of risks and concerns just shoot through the roof. A survey by HyTrust found that more than 45% of organizations identify security as a top concern when deploying cloud infrastructure.[1]

Organizations have, however, identified a mid-way through emergence of the hybrid model. The model allows organizations to leverage the benefits of cloud computing while retaining critical applications in their own data centres.  Towards this, a positive finding from the HyTrust survey is that nearly 70% of respondents believe that data breaches and other security risks are becoming less of an obstacle to cloud deployment.[2]

The shift to an on-demand cloud security model

Traditionally, organizations have deployed on-premise security controls to maintain greater control and flexibility over access and usage of data and applications. With confidence around cloud deployments growing, organizations are now extending security controls across the traditional on-premise model to an on-demand model. The drivers are the same as for any other cloud application―scalability, flexibility and cost.

The on-demand model brings in a lot more flexibility enabling organizations to deploy security agents based on usage. The benefits are immediate as the service can be deployed quickly. This allows organizations to scale their security as per business needs, without adding to costly administrative resources.

While some security controls are made available by cloud service providers, it becomes complicated and costly for organizations to keep a track of a plethora of cloud workloads. Towards this provision of an on-demand service, that gives clear visibility on all instances, streamlines security and greatly enhances operational efficiency.

As business threats are growing and getting complicated, organizations are realizing the benefits that the on-demand cloud security model can bring. While its adoption is yet to accelerate, the time is right to pause and think prudently―are you ready to do everything yourself or do you want to focus on your core business and deploy a managed service that takes care of all your vulnerabilities as well as compliance. It is time to act now.

[1] http://www.enterprisetech.com/2016/04/22/security-concerns-easing-cloud-deployment/

[2] Ibid.

How Cryptography Helps Prevent Data Theft

In a world driven by a complex network, where critical data (business or personal) can easily be accessed (stolen/ hacked), it is imperative that strict measures be taken to prevent any instances of data theft. Thankfully, there is a multitude of options available for securing your data. One such measure for securing information is Cryptography.

What is Cryptography and why is it needed?

Before we get to the how, let us take a quick peek at what Cryptography is. The word Cryptography has Greek roots where ‘kryptós’ means “hidden”, and ‘gráphein’ means “to write”. Therefore, Cryptography is the art of writing information in a hidden manner. Stating it in an even simpler manner, it means writing secret messages that can be comprehended only if the receiver knows how to decipher the code.

Cryptography played a very important role in the framing of global history and was used extensively for critical communications among heads of states, military generals, spies, and more for both planning – and curbing coups and more.

Fast forward to the present day.

In todays’ world connected via the net, securing transportation of data between different components is a major challenge – and a business critical requirement. Cryptography has become a critical tool that safeguards data such as digital cash, digital signatures, and passwords that act as the doorway for accessing business secrets of huge organizations – both in the public and private sectors.

So how does Cryptography help prevent data theft?

A cryptosystem is a suite of ciphers (-algorithms for encryption and decryption), protocols (- rules regarding how to use Ciphers), and user-prescribed actions implemented together as a system.

As long as the key to decrypt information (the Secret-key cipher) remains a secret, no one will be able to steal your sensitive data. A few specific cryptography tools and techniques that can be used to prevent data theft are:

  1. Disk encryption: This means encrypting USB and flash drives, etc. which are today a potent means of data theft.
  2. Public Key Infrastructure (PKI): The Public Key Infrastructure (PKI) helps in implementing a robust framework for securely exchanging and managing keys. The two main features of PKI are encryption of messages by means of recipients’ public key, and digital signatures that serve as non-repudiation mechanisms as defined in SOAP standards.
  3. Hide data with steganography: This is rather an interesting way to hide your data. This facilitates, for example, hiding a text message within a .JPG or an MP3 file!

Conclusion

With the number of threats increasing with regards to data theft, it is a relief to note that there are also multiple options available for encrypting and safeguarding your precious data. Organizations can encrypt data in line, or during transmission, or by using hardware devices. That said, it is imperative that an all-out effort is made so as to ensure the safety of sensitive data – especially during transit.

Why Biometrics Should be Used?

Biometrics is a way of making sure that the user is who he or she claims to be, thus eliminating unauthorized access to information and safeguarding it from internal threats. With data breaches becoming more complicated and impacting all sectors, organizations are gradually complementing traditional authentication techniques, especially passwords, with biometric technology. To fully understand the potential that biometrics offers towards enhancing data security, let us first understand what biometric identifies are, how they can be deployed and advantages that the technology offers.

Biometric Identifiers

The term “Biometrics” is coined with two words “bio” and “metric” meaning life and measure respectively. The underlying meaning is that every human is unique and can be recognized/ identified by his or her intrinsic physical or behavioral traits.

Fingerprints, face, retina, voice, ear features, typing rhythm, gait and gestures constitute as biometric identifiers. For security, a single or a composition of multiple identifiers can be used. Research and development is actively underway to encompass brainwave signals, electronic tattoos and microchips under biometric identifiers.

Biometrics Deployment

Fingerprint scanners, face recognition software and biometric hand reader are some of the platforms that are based on biometric technologies. Adoption of biometrics at various access points and endpoints is greatly beneficial in preventing unauthorized access and hence data loss either accidently or on purpose.

A study by ABI Research states that consumer and enterprise spending on biometrics is growing at a rate of 29% per year, with market size expected to reach $36.8 billion by 2020. Retail and banking sectors are leading in the adoption of biometric technologies because of the sheer volume of sensitive data they process.

Biometrics Advantages

While biometrics is gradually becoming a part of our daily lives – common examples being checks at international airports and fingerprint recognition on mobile devices – a number of organizations are yet to fully realize the capability that the technology offers. There are many advantages of deploying biometric technologies. These are:

  • Biometrics are extremely accurate, though not 100%, as the identifiers are unique to each user.
  • While passwords can be replicated making the system vulnerable to unauthorized users, biometric identifiers are difficult to break and thus offer very reliable data security mechanism.
  • Automated biometric verification is a very quick process.
  • Biometrics do not require multi-layer authentication. They are user friendly and lift up the burden from the user to remember various complex passwords. This saves time without compromising the security of sensitive data.

Conclusion

Organizations can enhance traditional authentication methods that they use by introducing biometrics – an additional security layer that answers “Who I am”. While barriers to adoption remain high, mainly being cost and privacy, the number of real-word applications for biometrics has been increasing. It remains to be seen if biometrics will emerge as the answer to most data theft problems or if it will only continue to act as an additional assurance to prevent data loss.

Why Mobile DLP is an Essential Security Tool for Enterprises


With increasing enterprise mobility, organizations are increasingly making effort to secure their data on mobile devices. The bigger question IT managers are worried about is, “Do we have any single solution that is employee friendly and delivers strong security while preventing data loss on a real-time basis?” The answer is affirmative. The comprehensive approach of certain DLP solutions makes them ideal solutions because:

DLP allows prevention of data leakage and safeguards unencrypted information.

Users send and receive email from corporate and personal accounts, upload information to cloud services and send files to social networking sites. According to industry reports, the majority of data loss is generated by well-meaning insiders using standard information-sharing tools (email, Web upload, etc.) since the information is not sent in an encrypted format through mobile devices. A DLP solution acts as a gatekeeper to control confidential information from compromised and unauthorized access by routing the traffic through a corporate virtual private network (VPN) server.

DLP allows access restriction for applications.

Information access privileges are usually 100 percent for each mobile device user. A DLP solution can help enforce a restriction on usage of select applications by blacklisting them or exceptionally allowing some applications to users by whitelisting them based on user business requirements and approvals.

DLP allows protection of real-time data and FSS.

Most data loss from mobile devices occurs through emails, multiple third-party apps allowing data exchange and Internet tools for file sharing and synchronization (FSS). DLP solutions offer data routing and information scanning through corporate VPN to ensure no confidential information leaves the corporate network.

DLP allows monitoring of chat (messages and voice).

Mobile devices connected to the corporate network can be monitored for voice chat activities through control of HTTP/HTTPS and can also log all outgoing text as well as multimedia messages to prevent data leakage. DLP solutions act like control centers for sensitive data, user profiles and device information. With careful definition of these three areas, they can offer lots of security and business flexibility—a perfect combination for mobile devices.

Using Zecurion Mobile DLP Solution

The Zecurion Mobile DLP provides a unique security approach to prevent data leakage from a device in or outside a corporate network.

Unique Security Approach

Zecurion Mobile DLP helps protect your organization from accidental and deliberate data leakage. It acts like a traffic controller and routes all data flow to the network DLP (i.e., Zgate) for analysis and action. This includes analysis and protection of sensitive data sent from email clients, Web browsers and applications such as Facebook, Twitter, Dropbox, etc. In the event of an incident, the user is notified of the violation of security policies.

Mobile DLP Security Model

Zecurion Mobile DLP offers an end-to-end solution to ensure data traveling between smart devices is fully protected from the start to end points. The Zecurion security model has two key elements:

  1. Data Protection—It segregates personal data from corporate data and ensures personal data is protected from monitoring and corporate data is protected from leakage or loss.
  1. Securing Network Access—It ensures data that travels in the network is secure, based on analysis of the content of the messages and file sharing on Google Talk, Yahoo Mail, etc. It also keeps tab on the information uploaded to cloud services, covering all information flow on HTTP/HTTPS.

Best Practices for Enhancing Mobile Data Security

Data loss, whether intentional or unintentional, not only leads to financial loss but also leaves a lasting impact on goodwill of the organization. With increased enterprise mobility, organizations need to implement strict regulations and safeguard confidential resources from falling into wrong hands.

BYOD, the key driver for enterprise mobility, has increased productivity and reduced costs as employees can now access corporate emails, messages, text and work files from their own personal device. They can be virtually anywhere while still being productive.

The stereotype work culture of commuting to the office or working from one fixed desktop is already a thing of the past. According to Fliplet, worldwide more than 1.3 billion workers use various mobile devices for work. Studies have also shown that usage of smart phones by mobile workforce results in increased productivity of work – a six weeks’ worth equivalent to almost 240 more hours per employee annually. BYOD is therefore here to stay and is being recognized as a megatrend impacting small and big enterprises.

However, the flip side to it is that it has also resulted in increased vulnerability of mobile data. Towards this, Zecurion recommends 10 best practices to enhance mobile data security.

  1. Classify, Tag and Analyze Data

Classifying and digitally tagging data will prevent data loss in case it falls into wrong hands. Classification of data is compulsory in order to correctly deploy the tool to thwart the loss.  Once classification of data is completed by a team of experts – comprising business process managers, legal and compliance specialists – it is easier to choose a DLP tool that best suits the need. These tools are essentially automated controls protecting data at rest, data in transit and data in use.

  1. Integrate with Mobile Device Management

Mobile Device Management (MDM), a content- aware solution, simply lets the administrator define roles and authorizations for users. This way only selected users have access to all the information and DLP can be better managed. MDM also offers jailbreaking/ rooting detection feature. Until the device is deemed safe, the mobile device will not be able to access anything on the company’s server. MDM can also block specified applications.

  1. Encryption of Data

Encryption should be a rule of thumb for any wireless mobile communication – be it cloud-based or over virtual private network. To access the encrypted data, an encryption key is required. An unauthorized interceptor can therefore not access data without this key.

  1. Authenticate Identity of the User

Multiple forms of authentication, a.k.a. biometrics, should be used for mobile devices. These include fingerprint, facial, retina and voice recognition. Biometrics is a way of making sure that the user is who he or she claims to be, thus eliminating chances of unauthorized access and preventing data loss.

  1. Test for Vulnerability of Mobile Data Periodically

Penetration testing on mobile devices must be undertaken on a regular basis. Accordingly, organizations must come up with mitigation plans in case of a breach.

  1. Train Staff Regularly

Conduct periodic training on mobile DLP to educate corporate mobile users about access policies and usage behavior.

  1. Deploy Endpoint Security

Implementing endpoint security just as in other non-mobile environments. With endpoint protection, unauthorized users or devices that do not comply with the security program cannot access, copy, share or store confidential information either accidentally or on purpose.

  1. Implement COPE – Company Owned Personally Enabled Mobile Devices

Depending on the nature of business, organizations should implement COPE – antidote to vulnerabilities arising from BYOD. COPE enables the IT department to maintain control on devices connected to enterprise networks while offering work flexibility to employees. Also in case the device is stolen or lost, the organization will have the ability to wipe out the entire data remotely. Further, COPE allows IT to control the installation of third party software and prevent any malicious software from being installed on mobile devices.

  1. Monitor Outflow and Inflow of Mobile Data

Install mobile DLP solution that successfully monitors the data that the mobile device accesses or downloads from the organization’s server. Personal and business emails can easily be bifurcated and chances of sensitive information being leaked from mobile devices are drastically reduced.

  1. Destroy Obsolete Hardware

Make sure that unused or discarded mobile devices are wiped clean of any sensitive data. Have strict well defined policies in place for proper disposal of mobile devices. Installing customized firewalls will give limited access to organization’s data to mobile users and prevent sensitive data loss.

How Zecurion Can Help

Zecurion offers Mobile DLP which is a full data prevention solution that offers content analysis for Android devices and contains all the necessary functionality for data protection. It provides complete monitoring of corporate information on employees’ mobile devices, preventing data leaks at various stages of information processing, storage, and transfer.

Zecurion Mobile DLP can help ensure data traveling between mobile devices is not compromised and provides monitoring of connecting mobile devices to computers and other devices. Zecurion Mobile DLP finds copies of confidential documents on users’ mobile devices and blocks their transfer via unsecured open networks. All traffic is channeled through a protected corporate network. In the event of theft or loss, the device can be blocked by a security officer. The solution also stores shadow copies of SMS and MMS, as well as monitors the running of applications. Its key features include file scan, application control, monitoring, SMS/ MMS logging, allow / disable certain Wi-Fi networks, remote blocking /cleaning of the device and logging of geo location.

Growing Workplace Collaboration Necessitates Mobile DLP

According to Fliplet, by end of 2016, there will be more than 1.3 billion workers globally using mobile devices at the workplace. Sales of mobile devices will touch 3 billion by 2017. The stereotype work culture of commuting to the office or working from one fixed desktop will be a thing of the past. Abundant use of smart phones by mobile workforce will result in increased productivity of work – a six weeks’ worth equivalent to almost 240 more hours per employee annually.

Similarly, bring-your-own-device (BYOD), is being given proper recognition in all small and big enterprises. As BYOD has been consistently fueling mobility, this growing trend of “consumerization of IT” has increased productivity and reduced costs. This is because employees can now access corporate emails, messages, text, work-related communication over their own personal device, enabling them to be virtually anywhere while still being productive. Customer responsiveness has increased and newer engagement models are emerging that are enabling mobile devices to be used as sales tools.

But the question is “How Secure is Mobile Collaboration?” Are we implementing enough measures for Mobile DLP? How can corporates be assured that the threat of data loss over mobile devices has been mitigated?

Data loss prevention (DLP) solutions help address these challenges in a mobile environment just as they would in a workstation environment. The comprehensive approach of mobile DLP solutions makes them ideal because:

Mobile DLP allows prevention of data leakage and safeguards unencrypted information

Users send and receive email from corporate and personal accounts, upload information to cloud services and send files to social networking sites. According to industry reports, the majority of data loss is generated by well-meaning insiders using standard information-sharing tools (email, Web upload, etc.) since the information is not sent in an encrypted format through mobile devices. A mobile DLP solution acts as a gatekeeper to control confidential information from compromised and unauthorized access by routing the traffic through a corporate virtual private network (VPN) server.

Mobile DLP allows access restriction for applications

Information access privileges are usually 100 percent for each mobile device user. A mobile DLP solution can help enforce a restriction on usage of select applications by blacklisting them or exceptionally allowing some applications to users by whitelisting them based on user business requirements and approvals.

Mobile DLP allows protection of real-time data and FSS

A Gartner study reported that most data loss from mobile devices occurs through emails, multiple third-party apps allowing data exchange and Internet tools for file sharing and synchronization (FSS). Mobile DLP solutions offer data routing and information scanning through corporate VPN to ensure no confidential information leaves the corporate network.

Mobile DLP allows monitoring of chat (messages and voice)

Mobile devices connected to the corporate network can be monitored for voice chat activities through control of HTTP/HTTPS and can also log all outgoing text as well as multimedia messages to prevent data leakage.

Mobile DLP solutions act like control centers for sensitive data, user profiles and device information. With careful definition of these three areas, they can offer lots of security and business flexibility—a perfect combination for mobile devices.

Adopting a Unique Security Approach through Zecurion Mobile DLP Solution

The Zecurion Mobile DLP provides a unique security approach to prevent data leakage from a device in or outside a corporate network. Zecurion Mobile DLP helps protect the organization from accidental and deliberate data leakage. It acts like a traffic controller and routes all data flow to the network DLP (i.e., Zgate) for analysis and action. This includes analysis and protection of sensitive data sent from email clients, Web browsers and applications such as Facebook, Twitter, Dropbox, etc. In the event of an incident, the user is notified of the violation of security policies.

Zecurion Mobile DLP Security Model

Zecurion Mobile DLP offers an end-to-end solution to ensure data traveling between smart devices is fully protected from the start to end points. The Zecurion security model has two key elements:

  1. Data Protection

It segregates personal data from corporate data and ensures personal data is protected from monitoring and corporate data is protected from leakage or loss.

  1. Securing Network Access

It ensures data that travels in the network is secure, based on analysis of the content of the messages and file sharing on Google Talk, Yahoo Mail, etc. It also keeps tab on the information uploaded to cloud services, covering all information flow on HTTP/HTTPS.

How Zecurion Mobile DLP Works

Zecurion Mobile DLP works in conjunction with mobile solutions to configure and manage VPN. It also relies on a DLP server deployed in the corporate network and, in conjunction with a Web proxy, analyzes all outgoing network traffic, including SSL-encrypted content.

Benefits of Zecurion Mobile DLPZecurion Mobile DLP Benefits

Major Insider Data Breaches in Government Sector in 2015-16

In our last post, we talked about insider threats being faced by government organizations.

Today, we are sharing examples of data loss incidents that have affected government sector because of insiders. Though sporadic in nature, they give a deeper insight on how vulnerable the government is.

  • In June 2016, The Washington State Liquor and Cannabis Board stated that the personal information of marijuana license applicants was released in response to a public record request. The exposed information included social security numbers, tax and financial information, attorney-client privileged information for an unknown number of records. The License Control Board had accidentally sent in the PII along with the requested information.
  • Virginia State Corporation Commission suspects that a former contractor made copies of PII for an unknown number of people whose license had either expired or lapsed between 1979 and 2004. This came into light in June 2016.
  • In April 2016, the FDIC, Washington, DC notified that 44,000 records of customers were exposed when an authorized employee unknowingly downloaded the classified information of affected people on a personal portable device. When the breach was detected, the employee was contacted, who immediately returned the device and signed an affidavit stating that the information was not used for any purpose.
  • In February 2016, Washington State Health Authority (HCA) notified that 91,000 records of Apple Health (Medicaid) clients were accessed without proper authorization by an employee. Social security numbers, dates of birth, Apple health client ID numbers and private health information was passed to another state agency’s employee. After internal investigation, it has been established that the classified information did not get beyond these two employees but as a precaution, free year-long credit monitoring has been offered to the affected people. Both the employees have been fired since the incident happened.
  • County of San Diego confirmed in January 2016 that the classified records of all employees were sent to Wells Fargo as opposed to only those records who were set up for health savings accounts, HSA. Consequently, the bank set up HAS for all the employees. The county and Wells Fargo are working together to delete unwanted records. A free year-long credit monitoring has been offered to the affected people. The breach is being deemed as an accidental error due to incorrect program code for data transfer by Hewlett- Packard Enterprise Services.
  • In October 2015, the Vacaville Housing Authority (VHA) notified affected individuals that one of their employees unintentionally sent an email to a person with an attachment containing their names and social security numbers. The receiver immediately informed VHA about the lapse and they deleted the email from the person’s computer. As a precaution, VHA has offered free credit monitoring service to affected customers for 12 months.

A 2016 U.S. Government Cybersecurity Report by SecurityScorecard reported the following:

  • Government sector has the lowest security score as compared to retail, transportation, healthcare and other sectors
  • NASA is at the bottom of 600 government organizations, followed by US Department of State, IT systems of Connecticut, Pennsylvania, and Washington.
  • Three areas where government organizations struggle with security are – Malware Infections, Network Security and Software Patching

While government organizations are enhancing their cyber security strategies, there are still many risks that they need to address. A wholistic view of their strengths and weaknesses will enable them to implement the right solution and take proactive measures aimed at addressing the risks posed by internal threats.