It looks like the British Government can’t help but loose personal data. This time it’s names and addresses of 160,000 children. In most of these cases the incidents are has a result of poor data handling practices. I’ve never been a believer in over-securing data inside the firewall. I agree that sometimes you do need to encrypt transactional data – but this is the exception rather than the rule. However once your data leaves the firewall (typically while in transport) to a third party then encryption is essential.
The challenge faced by organizations is how to actually manage the operational aspect of the encryption. Since CRM systems are ‘ripe targets’ for theft of personal data – lets examine a few techniques you might want to consider.
Scenario: The Lost Laptop
This is the easiest situation to secure yourself against. Consider using a whole disk encryption technology (like Bitlocker in Windows Vista). There are also a number of proven third party solutions out there. Whole disk encryption secures all the information on the laptop – so it doesn’t matter where the personal info is (email, spreadsheets, offline databases etc etc). There is no excuse nowadays for having personal information on an unencrypted laptop. No excuses.
Scenario: Man in the Middle
Many companies use the Internet to send files between their office locations. If you send files over unencrypted channels you are at risk to Man in the Middle attacks. Remember that Internet email is insanely vulnerable to this type of attack. I suggest using a secure filesharing website on your extranet to facilitate filesharing. An Internet facing SharePoint using HTTPS is a great example of this. Using such a share is also a good way of sending files to your business partners – however you can’t be sure what they will do with them.
Scenario: Outside the Firewall
Assuming you can get your file to a third party safely (https or encrypted sneaker net) then you are faced with significant operational challenge of overseeing the security behaviors of a third party organization. Many organizations simply throw their hands in the air and say ‘urh – it’s too hard!’. This is no silver bullet when solving this problem – however consider the following:
- Use Information Rights Management (IRM) in Office Docs. Give your third parties some limited credentials so they can view/edit documents secured in this fashion.
- Contractual obligations regarding IT and Physical Security. If your third parties as a good (or better) than you and your transport is secure then you are good shape. These types of arrangements are becoming increasingly popular.
- Give third parties access to your network. Careful here as they might be downloading data onto unsecured PCs.
Before implementing any security strategy you should consult with your IT and Physical security experts in your organization. You should also try and calculate a ‘cost’ of personal data. This is very helpful when ‘re-educating’ employees. Your people will be less likely to email CDs of customer lists when they realize they could be worth $500,000 each.
I always view the ‘goal’ of protecting personal information with the above things in mine: to give your people the tools to do the right thing (don’t forget to actually tell them about those tools) and make them truly understand why they need to do it.
