Datasheet

ManualsBrandsFor Dummies Manualsbooks978-0-470-38843-3

Chapter 1

Defining Data Loss

In This Chapter

▶ Understanding how the world of data has changed

▶ Identifying IT risk as a big part of your business

▶ Getting The Big Picture

▶ Discovering the biggest threat to the twenty-first century

▶ Taking a holistic approach to data loss

hy worry about losing data — there’s always more where it came

from, right? Well, that’s part of the problem. Like other kinds of stuff,

data accumulates. By 2010, we’ll have a vast pile of that electronic stuff, more

than if we had a Ph.D. in Having Lots of Stuff: the most extreme an estimate

up to 988 billion gigabytes of information. Where will we put it all?

In addition, how we handle all that stuff is speeding up. How are we to keep

up? A recent educational estimate from a North American teacher illustrates

this change: For students starting studies in technology at the university

level in September, over half of what they learn in their first year will be out

of date by the time they get to their third year — and all of it will be out of

date by the time they start work. The Department of Trade and Industry

in the U.S. estimates that in 2010, the top ten technical jobs that will be in

demand won’t even have existed in 2004.

Meanwhile, computer circuitry has crept into nearly everything you use —

and many of those things now gather information from you and about you.

If your kids know how to program every electrical device in the house, and

you gave up on that about 15 years ago, it’s an indicator of what’s happen-

ing. If you’ve been shopping for cell phones recently (“mobile phones” if

you’re in Europe), you’ve probably seen a sales pitch that points out all the

“features” of the phone — especially the ways it can send, receive, and juggle

information in various forms. If you’re tempted to interrupt with a practi-

cal question (“But can I make and receive telephone calls with this thing?”),

consider asking one more: “How does this thing keep my data safe?” Don’t be

surprised if you get a blank look.

05_388433-ch01.indd 905_388433-ch01.indd 9 1/23/09 9:36:07 PM1/23/09 9:36:07 PM

COPYRIGHTED MATERIAL

Summary of content (20 pages)

PAGE 1
Chapter 1 AL Defining Data Loss ▶ Understanding how the world of data has changed ▶ Identifying IT risk as a big part of your business TE ▶ Getting The Big Picture RI In This Chapter ▶ Discovering the biggest threat to the twenty-first century D W MA ▶ Taking a holistic approach to data loss GH TE hy worry about losing data — there’s always more where it came from, right? Well, that’s part of the problem. Like other kinds of stuff, data accumulates.
PAGE 2
10 Part I: Building the Background In effect, we’re sending our children to school to prepare them for jobs that don’t yet exist, using technologies that haven’t yet been invented, to solve problems that we don’t yet know are problems. All we know for sure is that this future will be hip-deep in copious quantities of data. Which must be stored somewhere — and (more important) protected.
PAGE 3
Chapter 1: Defining Data Loss to commit their crimes). So the more data you have, the bigger the security risk — and these days all that data requires vast amounts of storage. Unfortunately, IT is losing control of the storage — and control of the data. When desktop external storage drives reach terabyte (thousand-gigabyte) capacity and are as easy to use as a little USB storage device, the walls of the data center might as well come tumbling down. Data isn’t always stored in the data center.
PAGE 4
12 Part I: Building the Background Okay, that might be understandable if you’re distracted by a real, live, good-looking member of the opposite sex. One of your authors (we won’t say which one) did that once, and then apologized to the lamppost. But at least he wasn’t generating personal data the whole time. ✓ The development of the Internet has seen a rapid increase in its use for everyday purposes — and a lot of that use is careless, which makes it a great target.
PAGE 5
Chapter 1: Defining Data Loss Although user and operator errors account for more than 32 percent of permanent data loss, cyber-crime and computer-virus attacks are the fastestgrowing cause of business disruption. Organizations put challenging demands on their information — not only integrity, but rapid, secure, and continual availability.
PAGE 6
14 Part I: Building the Background Integrated ﬁrewall, virtual private network, intrusion detection & prevention, content ﬁltering, anti-virus Branch Ofﬁce Branch Ofﬁce / Regional Site Local Users Anti-virus, host-based intrusion detection File server’s anti-virus Anti-spam & email anti-virus Data Center (Servers) Intrusion detection and prevention system IT Operations The Internet Firewall & virtual private network – secure sockets layer VPN & SSL Figure 1-1: Data-loss proliferation in a maze of
PAGE 7
Chapter 1: Defining Data Loss The amount of information created, captured, or replicated in 2007 exceeded available storage for the first time. Suppose that currently the amount of new technical information is doubling every year. If all things remain equal (and they won’t), those growth numbers tell us that by the end of 2010, the amount of information will be doubling every 72 hours. Which is amazing or ridiculous, depending on your perspective.
PAGE 8
16 Part I: Building the Background Information and Communication: Risky Business Information is our most valuable asset, and yet is coming under continual, increasingly sophisticated attack from cyber-criminals who target it for financial gain. The situation has been exacerbated recently with in widespread investment in new, more efficient communication technologies. Communication is essential to business; no argument here.
PAGE 9
Chapter 1: Defining Data Loss that use them aren’t receiving as much security auditing as traditional client-based applications and services. Furthermore, the policies and procedures for using these new services haven’t kept up with the technology and the working practices that go along with it. As a result, threats to confidential information are on the rise. But even before Web 2.0 is fully implemented, the IT risks that go along with it are entrenched.
PAGE 10
18 Part I: Building the Background There is an underground economy where servers are used by criminals to sell stolen information, usually for later use in identity theft. This data can include government-issued identity numbers, Social Security Numbers, national insurance numbers, credit cards, bank cards, personal identification numbers (PINs), user accounts, and e-mail address lists. And the bad guys are selling it all, at bargain-basement prices, to other bad guys.
PAGE 11
Chapter 1: Defining Data Loss ✓ More social engineering: This is an older, non-technical means of compromising security; it shifts the attack activity away from computer networks and operating systems and toward the end-user as the weak link in the security chain. ✓ Smishing and/or SMS (text) phishing: In this new variant of phishing, the phisher uses SMS (Short Message Service — that is, texting) messages to tell victims they’re being charged for services they didn’t actually sign up for.
PAGE 12
20 Part I: Building the Background ✓ Identify all steps taken to contact and warn consumers that their information may have been compromised. ✓ Provide an outline of the plan that will prevent the recurrence of such a data breach — and your timeline for implementing it. The extent to which they can’t provide these answers is a clue to how much control they’ve lost over their data.
PAGE 13
Chapter 1: Defining Data Loss normally consider IT as a major component of risk. But the world has changed since then. Businesses can’t run without IT — and IT is under attack, so the risk needs to be broken out and examined carefully. Figure 1-3 shows how IT risk is a component part of the overall risk to the business. Business Risk Financial Risks Operational Risks Non- IT Risks Figure 1-3: IT risk is a big part of business risk.
PAGE 14
22 Part I: Building the Background All organizations could benefit from a greater appreciation of the mounting risks to IT — a firmer, more practical understanding of the risks we’re likely to be subjected to. Three areas of consideration stand out: ✓ How risk manifests itself to information technology and users (including employees, partners, and suppliers). ✓ How organizations should assess and address their level of exposure to risk.
PAGE 15
Chapter 1: Defining Data Loss ✓ Identify issues that may cause loss of information confidentiality, integrity, or availability ✓ Provide management with appropriate strategies and controls for the management of information assets. Although getting this juggernaut underway looks like a daunting process, it isn’t rocket science.
PAGE 16
24 Part I: Building the Background get a handle on data loss, leakage, breaches, all the places data is wandering away into the wrong hands. It’s out of control and growing, but hard to put in front of a CIO who’s looking to trim costs, migrate to Linux (or to Windows) or not, drag the company into virtualization, develop new services or applications, reconsider managed services versus in-house operations, and the rest of the standard IT brouhaha.
PAGE 17
Chapter 1: Defining Data Loss Getting the Whole Picture So how do you get the holistic (big-picture, everything-accounted-for) perspective you need if you’re going to bring your data under control? You could get hold of a risk-assessment tool to identify your assets (as well as the risks to those assets), to estimate the likelihood of security failures, and to identify appropriate controls for protecting your assets and resources.
PAGE 18
26 Part I: Building the Background you’ve considered all the options.
PAGE 19
Chapter 1: Defining Data Loss Laptop/Desktop Piggybacking Dumpster (Skip) Diving Server Social Contractors Trojan Targetting Accounts Payable iPod USB Engineering CD/DVD Eavesdropping Memory Stick Memory Card Readers Impersonation Endpoint Simple Phone Call Databases PCMCIA Communication File Systems File Servers Data-At-Rest NAS Virtual Machine SANs/iSCSI Storage Bluetooth Infrared Firewire Serial/Parallel Ports Modem Voice Mail Video Surveillance E-Mail Other Threat Vectors Data Lo
PAGE 20
28 Part I: Building the Background