WikiLeaks and Data Governance

WikiLeaks has spotlighted the susceptibility of public and private sector entities to fall victim to disclosures of confidential information. The fact of the matter is, if WikiLeaks gets shut down tomorrow, there are thousands of others like them.

The only way to address risks of this nature is to understand and lock down the permissions on the file system and other shared data repositories within companies and agencies. However, a typical file system at a Fortune 100 financial institution can contain trillions of permissions. As a result, the “Who? What? Where? and When?” are particularly difficult questions to answer due to 20+ years of file system management, migrations, natural organizational turnover, mergers and acquisitions, domain consolidations, and the sheer volume of data.

All of these situations cause massive permission sprawl in the file system, leaving organizations exposed to unauthorized access and disclosure.

Yesterday, in response to WikiLeaks, President Obama mandated that all agencies ensure that workers have access exclusively to what is necessary for their jobs. OMB Director Jack Lew said there is a zero tolerance policy under the new directive. There are ways to mitigate the associated risks of leakage of sensitive, confidential, or proprietary data; an essential first step is to understand who has access to the data, who is accessing the data, and who no longer needs privileges to specific data repositories.

Enforcing least privilege access is a daunting task at any sized organization, but taking a few initial steps to clean up and enforce permission standardization across all data repositories goes a long way towards reducing exposure of data to internal threats. Simple steps towards securing the infrastructure include controlling high risk or open repositories, removing individualized access in favor of alignment with group / role-based access, reducing permissions sprawl, and enforcing ethical walls.

Don’t miss a post! Subscribe to The Insider Threat Security Blog here:

Name

Email*