Stop! Thief
When it comes to protecting data, traditional methonds might fall short in total protection
ADVANCEMENTS in removable media, online storage and file sharing have empowered end users to transmit, collect and access data from virtually any location both inside and outside the corporate network. While these advancements have had a positive impact on the ease of data sharing, the methods present a major liability for businesses that must protect proprietary data from internal and external security threats. Laws and regulations concerning the protection of data are growing increasingly stringent, and organizations must be vigilant in protecting sensitive data or risk severe penalties.
Laws and regulations concerning the protection of data are growing increasingly stringent, and organizations must be vigilant in protecting sensitive data or risk severe penalties.
According to the most recent Annual Computer Crime and Security survey conducted by the Computer Security Institute and FBI, the top four security loss categories -- which accounted for almost three-fourths of the total percent of losses -- are viruses, unauthorized access, laptop theft and theft of proprietary information. The same survey suggests more than one-third of the 537 participants believe at least 20 percent of the overall losses are due to insider threats.
Both companies and employees must be aware of the potential risks that increasingly flexible computing practices pose towards the organization and the employees. By taking proactive measures and instituting best security practices, businesses can fight off most vulnerabilities associated with the multitude of data sharing applications and techniques.
Downloading Disaster
Downloading data to removable media devices, such as flash memory cards and USB drives, is easier than ever, as devices have become smaller while the data-storage capacity has increased. Removable media has paved the way for a new set of security threats beyond data loss such as introducing malcode into an organization's network. The ease with which malicious employees can store and transport data using memory sticks or even iPods, coupled with the lack of security associated with these devices, creates a threat similar to peer-to-peer (P2P) file sharing. Also, because of the small size, many portable devices can easily be lost or stolen while loaded with sensitive company data.
To combat some of the risks associated with removable media devices, businesses should establish corporate policies defining what type of data can be stored on removable devices and what must remain on secure file servers. By instituting a critical end-point security layer, system administrators can prevent devices such as flash drives, CD/DVD burners, floppy drives and external hard drives from being used on client workstations. Additionally, employers can use identity management tools -- including biometrics -- to allow administrators to grant or deny individual employee access to confidential data. The measures not only help mitigate data loss, but if a breach were to occur, it can be traced back to a specific device and desktop.
|
Technicians Gone Wild
Ways to grow your business, manage employees and increase customer retention
By Veeral P. Lakhani
Employees are the primary resources a company has to increase profitability. To efficiently manage them, managers need to keep all on the same page. This can easily be done by using software and business processes. The essential problem with some employees is that they may unintentionally misuse inventory, time and references. Here are a few answers to typical, recurring issues that many companies face.
Issue: I am having trouble with my inventory. Actual counts seem to always come in lower than my reports state. How can I change my business practices to help this situation?
Solution: Do spot checks. Conduct spot checks of your trucks and warehouses. Every week or every two weeks, check one or two trucks. Make a list of 10 to 12 items, and search these items on your trucks. This will build awareness throughout your team that items must be properly managed at all times.
Item pick lists. If your current software allows for it, print out a copy of the work order pick list. At the end of the day or the next time the technician calls in, have the office manager cross-check the items from the work order. When the technicians come back to the office, have the office manager check off all items on the list.
As you go distribution. Distribute items to your trucks as they apply to work orders only. Do not store more inventory than is necessary on installation trucks. (This option is impractical for service trucks)
Issue: Lately, jobs seem to be taking longer than I budgeted. What can I do to prevent that from happening?
Solution: To finish jobs quicker, you should create incentives. Enforce piece pay and assign points. In addition to their regular salary, generate incentives for technicians as you do with your sales force to complete jobs on or before scheduled time.
Assign points to the installation of pieces of equipment. This process should be based on the difficulty factor and profitability. For example, you can assign two points for the installation of a keypad and four points for the installation of a CCTV.
Monitor how many points your technicians acquire on a weekly basis. This gives you an idea of which technicians are the most productive. Reward bonuses to technicians who surpass a pre-determined average point.
Issue: I want higher customer retention, how can I accomplish this?
Solution: You need to polish your sales techniques. Follow up with customers before, during and after the job to ensure satisfaction. Follow ups at the end of a job can result in additional sales. It may seem simplistic to follow up, but if you formalize this technique and make it a part of your sales and customer service process, it increases customer retention immediately.
To efficiently manage employees, you should set up internal systems -- ideally software that keeps everyone on the same page.
Veeral P. Lakhani is the vice president of operations at AlarmKey.
|
According to the SANS Institute, P2P file sharing applications are one of the top 20, most crucial Internet security vulnerabilities. But its not just P2P applications that are dangerous. Any kind of unsanctioned application downloaded by an employee is a threat because it can house malicious code, not to mention the legal implications of hosting (unknowingly or not) file-sharing applications. While companies are educating employees on the dangers of P2P applications, employees continue to use them at work. Even though employees may know that file-sharing applications can propagate data loss and open the door to spyware and other malicious code, most believe that their firewall and anti-virus software will protect them. While these tools work on a basic level, the software doesn't protect against new Web-based threats. At Websense, research labs log thousands of new crimeware exploits, such as Trojan downloaders, screen scrapers and keystroke logging programs-each month. No matter how good traditional security products are, the software simply can't keep up with the volume and increased complexity of new Web-based threats.
Instant messaging, free e-mail services and online storage sites also are vectors of data loss. Collectively, companies spend millions of dollars a year securing e-mail systems. But, by using Web-based e-mail and instant messaging services, employees are circumventing the security precautions put in place by companies, and ultimately placing their own machines and their company's entire network at risk to data theft. Online storage Web sites can be particularly risky and harmful because of a lack of security. In fact, many cyber criminals have begun to store malcode on them. There also is the danger of blatant data theft. Disgruntled employees or guests with temporary access to company networks can easily access and dispatch data to Web-based e-mail or just store it directly on a storage site, where it can be accessed from another location.
Proactive Prevention
A best practice for businesses is to avoid the use of online storage facilities to store critical data. End users should investigate the service's security policies before storing anything on the site. Companies can mitigate the risk posed by online e-mail and storage services by using a Web-filtering tool to manage access to Web mail or storage sites from the network.
In addition to blocking inbound malicious content, businesses also must take a proactive approach to monitoring and preventing data from leaking out via P2P file sharing, e-mail or other ways by implementing a content-filtering solution. Content-filtering solutions monitor not only P2P, but also e-mail, IM and more by examining the content of the material being sent to determine if it is in violation of a policy or a danger to corporate security, or in some cases, federal law. For example, if an employee working for a bank were to copy and paste bank account and Social Security numbers or content from a restricted Word document into e-mail or Web mail, the content filtering solution can block the action and instantly alert the IT manger or appropriate manager, effectively preventing the data from leaking out.
Ultimately, employers want to foster an environment of trust and empowerment among employees, but one can never underestimate the cost of employee error or malicious intent. Furthermore, with the evolution of cybercrime as a lucrative business for hackers, companies must become aggressive in protecting data. Criminals are proving to be more organized and assertive in their tactics. By investing in training along with Web and data security technology, organizations can mitigate most security risks without damaging employee productivity or investing in more IT staff.
This article originally appeared in the November 2006 issue of Security Products, pgs. 50-53.