All about the data

It's all about the data. Everything we strive to do in computer security is to protect the data. It's the data that has value. So it only makes sense that our computer security defense plan is data-centric.

Locate your data. Start by locating your data. It's much harder than it looks. Begin the process by searching for data on your database and file servers. Think of every location where your data can be deposited. Then think of all the ways it can be accessed, downloaded, copied, viewed, and printed. Data can be copied to removable media, including floppies (anyone have those anymore?), CD-ROMs, DVDs, USB drives, and tape. Has data been copied to local hard drives or downloaded to virtual images, laptops, and home computers? The last two locations have ended up in the media way too much lately.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

Is information leaving your company via e-mail and other networking methods? If you're not sure, consider using one of the many data leak protection tools available to sniff your traffic looking for confidential data. Every client I've talked to that has used one of these tools said they have been surprised by the amount of unauthorized confidential data leaving their networks. Last year, a CSO friend of mine said it best: "If you think you know where all your data is, you either don't understand the scope of the problem or you're clueless."

Classify data and access. Once you find the data, classify it according to sensitivity, much like the government does with Unclassified, Classified, Secret, and Top Secret classifications. I prefer general labels, such as simple numbers, 1 to 5, with 5 being the highest sensitivity. Define the various sensitivity labels so that everyone classifying data can follow some basic rules when marking the data. When you've finished classifying your data, what mechanisms do you have in place to ensure all future created data is appropriately classified? Now that the data is classified, move to issues of how users get to the information. How is the data accessed? Who is accessing the information and for what purpose? 

Threat model. Model all the possible threats to the data, from internal, unauthorized accesses to external intruders. Threats can be from human beings or malicious mobile code. Don't forget to include natural disasters and other disaster recovery events.

Identify the current state of your data. Document the current state of security controls surrounding the data. Include authentication schemes, access controls, permissions, intrusion prevention, and auditing in your documentation.

Protect the data. All the previous steps should lead to some natural conclusions about protecting the data. The more valuable and sensitive the data, the stronger and more redundant the controls should be. Access controls should be least privileged and role-based. Data protection also includes data backups, protection of those backups (such as encryption, secure storage, and so on), and enough test restorations to ensure confidence in the process. Backups should become a part of business continuity/disaster recovery plans.