How the information-centric security approach can protect sensitive company information

How the DRM approach further protects company data?

The practice of protecting company data by setting up network security measures has often been proven ineffective in the light of security breaches and company data leaks. The lessons of the Société Générale’s Jerome Kerviel early this year suggests that aside from preventing outsiders from accessing sensitive data or promoting security best practices, companies should also protect individual chunks of information that move through various nodes of the enterprise.

That DRM has been the bane of illegal distribution of copyrighted works, such as movies, music and e-books suggests that it could just be one of the best approaches in protecting sensitive trade information. In a keynote address last month, Symantec’s Chief Executive, John Thompson, explained that “information centric security…is about securing the most critical information, from source code to customer records to employee data.” This approach focuses on the level of risk assigned to each chunk of information and giving it the necessary measure through metadata that identify where these information can be used or who can access them.

Even within an enterprise where employees and consultants may have access privileges to vast amounts of information, DRM can be used by tech security teams to identify who among those who work within the same network can access which data and from where, or to distribute information to certain parties within the company.

Another way to implement information-centric security is by controlling the flow of data within and outside the network. By assigning security restrictions that reflect the security policies of the enterprise to data, data encryption ensures that the flow of data is monitored from the server to the employees who are authorized to access them through e-mail, FTP, and web browsers. Encrypted data identified as highly sensitive can only remain or accessed from within the perimeters of the company’s network.

Information-centric security cannot prevent loss or inappropriate access to data, but it surely is a step in the right direction as it reduces risks, especially those that come from within the boundaries of the enterprise’s network. One must remember that outside hackers are not the only parties that pose a threat to security; employees can just as easily distribute sensitive information and trade secrets from within.

As it has been the standard practice to fortify the firewalls that protect networks from outside attacks, assigning security measures to individual pieces of data further reduces the risk of security breaches.

Source: ExecutiveBrief.
ExecutiveBrief, the technology management resource for business leaders, offers articles loaded with proven tips, techniques, and action plans that companies can use to better manage people, processes and tools – the keys to improving their business performance. For more information visit us at: www.executivebrief.com

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine