protect

To state the obvious, organizations of all shapes and sizes are under constant attack in cyberspace. Some ignore the risk, hoping that it will simply go away or that they won’t suffer a breach. Others opt to weather the storm even if a breach occurs, willingly risking their critical data. Others still deny that a breach would dramatically affect their business. Is this a risk your organization is willing to take?

Take Action to Protect Critical Data

Some forward-looking organizations focus on protecting their critical data assets because they are vital to their business operations and competitive positioning. These organizations understand they must protect critical data to sustain competitiveness in today’s global economy. Assets such as intellectual property, trade secrets, customer information, information about mergers and acquisitions, health information and other sensitive data are extremely valuable to cybercriminals.

Organizations are taking action to understand the type of data they possess, the value of that data to the organization, the controls that are in place and the potential impact to business processes should the data be breached or corrupted. They are implementing the controls required to protect these sensitive assets and monitor potential risks.

Watch the on-demand webinar to learn more about protecting your critical data

A Collaborative Effort

Discussion should not solely be focused on the type of controls in place, the number of patches applied or the number of incidents detected. We need to discuss potential business disruptions due to cyberattacks and the business processes that may be affected. Risk management should be a collaborative effort between business leaders and the IT team.

Are your line-of-business (LOB) owners and executives aware of the risk to their critical data? Do they know which LOBs carry the greatest risk, what sensitive data is at risk, how valuable the data is, who owns the data and which users are putting the data at risk?

Executive boards must understand the need to protect critical data — it’s no longer just an IT issue. In turn, IT leaders must make sure business leaders have the insight they need to protect their assets.

Learn More

For more information, check out the on-demand webinar titled “Stop Playing ‘Chicken’ With Your Data-Related Business Risk — Protect Your Critical Data.”

To learn more about why traditional security metrics are irrelevant to most executives, download the Gartner report titled “Develop Key Risk Indicators and Security Metrics That Influence Business Decision-Making.”


Security Intelligence

The impact of a data breach can be disastrous for an organization and can include loss of customer confidence and...

trust, financial penalties and other consequences. The average total cost of a data breach is $ 4 million, up by 29% since 2013 according to the "2016 Cost of Data Breach Study" published by the Ponemon Institute. The average cost per record breached is $ 158, whereas the average cost per record for the healthcare and retail industries are $ 355 and $ 129, respectively. Despite the high risk of the threat, enterprises continue to fall victim to data breaches globally, and it raises significant concerns over protecting the data organizations own, process and store.

While the external threats remain a high priority, the threat to sensitive data also comes from insiders. The threats of employees stealing customer information, personally identifiable information or credit card details are real due to the fact that, in most cases, privileged users like system administrators or database administrators are given authorized access to the data. Often, the real data from the production environment is copied over to the nonproduction environment, which is less secure and not managed with same security controls as the production environment, and resulting data can be exposed or stolen.

Data obfuscation techniques offer different ways to ensure that data remains protected from falling into wrong hands, and fewer individuals can access the sensitive information while meeting business requirements.

 What is data obfuscation?

In the technology world, data obfuscation, which is also known as data masking, is the process of replacing existing sensitive information in test or development environments with the information that looks like real production information, but is of no use to anyone who might wish to misuse it. In other words, the users of test or development environments do not need to see the actual production data as long as what they are looking at looks real and is consistent. Thus, data obfuscation techniques are used to protect the data by deidentifying sensitive information contained in nonproduction environments or masking identifiable information with realistic values, enabling enterprises to mitigate the data exposure risk.

The need for data obfuscation techniques

Organizations often need to copy production data stored in production databases to nonproduction or test databases. This is done in order to realistically complete the application functionality test and cover real-time scenarios or test cases to minimize the production bugs or defects. As a result of this practice, a nonproduction environment can become easy target for cybercriminals or malicious insiders looking for sensitive data that can be exposed or stolen. Because a nonproduction environment is not as tightly controlled or managed as the production environment, it could cost millions of dollars for organizations to remediate reputation damage or brand value should a data breach incident occur. Regulatory requirements are another key driver for data obfuscation. The Payment Card Industry Data Security Standard (PCI DSS), for example, encourages merchants to enhance payment card data security with the broad adoption of consistent data security measures that provide a baseline of technical and operational requirements. PCI DSS requires that merchants' production data and information "are not used for testing and development." Inappropriate data exposure, whether by an accidental or malicious incident, could have devastating consequences and could lead to excessive fines or legal action levied for the violation of the rules.

Data obfuscation use cases

A typical use case for data obfuscation techniques could be when a development environment database is handled and managed by a third-party vendor or outsourcer; data obfuscation becomes extremely important to enable the third-party vendor to be able to perform its duties and functions as needed. By applying data obfuscation techniques, an enterprise can replace the sensitive information with similar values in the database and not have to worry about the third-party vendor exposing that information during development.

Another typical use case could be in the retail industry, where a retailer needs to share customer point-of-sale data with a market research company to apply advanced analytics algorithms and analyze the customers' buying patterns and trends. But instead of providing the real customer data to the research firm, the retailer provides a substitute that looks similar to the real customer data. This approach helps enterprises minimize the risk of data exposure or leakage through a business partner or other type of third-party organization.

Stay tuned for part two of this series on data obfuscation techniques.

Next Steps

Read more on building an information security risk management program

Learn about how cyberattacks use obfuscation techniques

Discover why threat monitoring on the dark web can help enterprises

This was last published in November 2016

PRO+

Content

Find more PRO+ content and other member only offers, here.


SearchSecurity: Security Wire Daily News

A malware lab in the Cybercrime Center on Microsoft's campus lets members of the company's Digital Crimes Unit work on malicious software in a controlled environment.

One of the biggest security risks for computer users is their web browser. According to Microsoft, 90 percent of phishing emails use the browser to initiate attacks, which can then be used to help attackers establish a beachhead inside a company.

Microsoft is aiming to better protect users and organizations from the threats that they face with a new feature called Windows Defender Application Guard. It's designed to isolate Microsoft Edge from the rest of the files and processes running on a user's computer and prevent computer exploits from taking hold.

[ The essentials for Windows 10 installation: Download the Windows 10 Installation Superguide today. | Stay up on key Microsoft technologies with the Windows Report newsletter. ]

This is a move that could drive greater adoption of Microsoft's browser in the enterprise, at a time when the company is fiercely competing with Google in that space. Security of company assets is a big problem for enterprises, and Microsoft is offering them another way to help protect their users without requiring those users to be security experts.

Here's how it works: when users navigate to untrusted websites in Edge with the feature enabled, Microsoft's browser launches new sessions that run in virtualized containers on their Windows 10 PCs and tablets.

In the event there's malicious code on those sites that tries to deploy on users' machines, it gets deployed into the container, isolated from the operating system and everything else.

When users quit their Edge sessions, the container is destroyed, and the malicious code is supposed to go along with it, thereby protecting users from whatever payload they may have been exposed to.

According to Rob Lefferts, Microsoft's director of program management for Windows Enterprise and Security, the other key thing about the feature is that the container's isolation is enforced using a secure root of trust that runs on the computer's processor itself.  

While Application Guard is a powerful capability, that comes at a cost. Because the container is destroyed whenever a user quits Edge, any cookies or cached items accumulated during that time go with it. In other words, even if users check the "Remember Me" button on a website, they'll have to log back in next time they open Edge. Virtualizing Microsoft's browser will also lead to some loss of performance.

IT administrators will be able to set the service up to whitelist certain trusted sites which will run in a traditional, non-containerized form, so users can get the same sort of browsing experience they're used to from those sites.

Lefferts cautioned that the feature won't be right for every organization, or even every employee.

"It is really [for] environments that want to run locked-down browsers," he said in an interview. "Finance organizations, healthcare organizations, a whole slew of military organizations that I talk to."

Microsoft is still in the process of building the feature, and will be rolling it out to Windows Insiders in the coming months. The company expects Windows Defender Application Guard to be generally available some time in 2017, for organizations that are subscribed to the Windows 10 Enterprise E3 and E5 plans.

That means there are still some questions left unanswered about what Windows 10 Application Guard will mean for users. For example, the company isn't saying yet what sort of impact running Edge in a container will have on its performance.

Lefferts said that the company is still working on getting the performance right, and wants to make both the Edge startup experience and the browsing experience feel good to users.

Looking forward, Microsoft may make the same containerization technology available to other applications, Matt Barlow, the corporate vice president for Windows Marketing, said during a press conference. But right now, the company is working to ship the first version of the feature.

Windows Defender Application Guard is one of a number of security-focused announcements that the company made at its Ignite conference in Atlanta, Georgia on Monday. It also announced that Windows Defender Advanced Threat Protection and Office 365 Advanced Threat Protection will share intelligence across both services to provide IT administrators with an easier way to manage threats.  

The company is also releasing a new Secure Productive Enterprise service, which gives companies an easy way to buy a suite of its advanced security capabilities across Office, Windows and its Enterprise Mobility + Security suite.


InfoWorld Security