 |
Let us get this straight, even if it appears on CSI Miami, blogging at work is a vulnerability, not a threat. |
OK - another trusted insider who stole data, not nice but I'm sure if we dig deeper we will find a disgruntled employee, no security procedures in place for protecting sensitive digital assets, no monitoring of outgoing data using extrusion detection technology and no awareness training. Big deal - Du Pont are making the same mistakes as everyone else.
But - what irks me is when so-called security consultants take a case like this and try to hype it to their purposes.
Don Ulsch, technology risk management director in the Boston office of Jefferson Wells has made a big deal about blogs being a bad thing - he used the DuPont data theft case as a way to illustrate his point - even though it has nothing to do with blogging.
He noted there are approximately 100 million blogs ; many of them are used by organized criminal outfits to push gambling and pornography. When an employee does personal blogging on a company machine and corporate email account, blog databases are able to suck in a wealth of email data. He said (and I quote) "Digital miscreants can then use sophisticated data mining software to scan the blogs for proprietary information that may be sitting in some of those stored messages."
I guess he saw the same episode of CSI Miami that we did, where the perky receptionist was blogging about office relationships and insider trading using an infrared keyboard and a Pocket PC in her pocketbook under the desk. Plausible but hardly the rule.
Blogging from the office is a vulnerability that is easily mitigated with some practical threat analysis and security best practices:
1. Make a policy and tell your employees that it is not allowed. Period. They can blog on their own time.
2. Install an extrusion detection system like Fidelis XPS and track blog urls and sensitive keywords, once you have that figured out - you can start monitoring sensitive data assets and picking up employees that are posting large files.
3. Understand that blogging is not an isolated security vulnerability - you should download the free Practical Threat Analysis tool and start modeling what's happening in your office.
