Varonis: Data Governance Critical to Preventing Data Loss Associated with Today’s Wave of ‘Insider’ Security Breaches
August 2011 by Varonis
With many of the country’s most trusted and widely-known organizations recently struck by hacker attacks resulting in leaks of sensitive data, Varonis Systems has stressed the importance of data governance for managing and securing structured and unstructured data, which account for 80 percent of organizational data (source: Gartner).
In many of the security breaches over these recent weeks, employees or contractors were able to delete or download thousands of files without raising concerns because often no one was able to determine what sensitive data they had access to and secure it before any information could be stolen, or audit data use and alert on anomalous behavior.
“These recent attacks and breaches demonstrate how critical it is that organizations be able to answer the following questions: ‘Who has and should have access to data, who is using their access, who is abusing their access, who owns the data, and what data is sensitive?’” said David Gibson, Director of Strategic Accounts and Technical Marketing at Varonis.
Much of the data accessed and leaked in recent breaches was composed of unstructured or semi-structured data – documents, spreadsheets, images, presentations, video and more – that resided on file shares accessible throughout organizations.
According to Varonis, more than half of the files and data that employees can access within any organization are not relevant to them. Stale, excessive permissions are rarely revoked. In many cases an organization’s data is open to global access groups (everyone, authenticated users, etc.) with no reliable way of remediating access without impacting the business via traditional processes. Further, more than half of the data on file systems, NAS devices, SharePoint sites and email systems lacks an owner.
“It is a profound operational failure of many organizations that they are unable to perform the most basic management and protection tasks to secure their critical business assets,” said Gibson. “Organizations must ensure that controls are in place to mitigate the risks of data leakage, theft and loss arising from excessive access rights and permissions and non-existent audit trails.”
Automated data governance is fundamental in securing an organization’s intellectual property and competitive edge. Manual permissions and group changes are unreliable and often error prone. In many cases, the IT group is unable to reliably identify business owners of data sets or involve data owners in the governance process. Determining who has access to a data set, which folders a user or group can access and identifying unneeded permissions can be a challenge, and often IT is completely unable to answer questions such as, “Who accessed or deleted my data?"
The Varonis Data Governance Software Suite enables organizations to automate unstructured and semi-structured data protection and management on their file systems, NAS devices, SharePoint sites and Exchange mailboxes with the Varonis® Metadata Framework™ technology that forms the foundation of Varonis software. Organizations can effectively and automatically manage data access control, access auditing, ownership, classification, entitlements and authorization processes on the platforms that host unstructured and semi-structured data. The Varonis® Metadata Framework™ enables organizations to expand digital collaboration boundaries safely while significantly increasing IT workforce productivity for daily data protection and management tasks.