Page 55 – Encryption Consulting

Why every organization should know the key differences between HTTP and HTTPS?

HTTP and HTTPS are seen everyday when using the Internet, whether you are in the cybersecurity field or not. You have likely seen a URL that looks like this:

https://www.google.com or http://www.fakewebsite.com.

These are vital parts of how searching a URL on the Internet works, but not everyone knows how HTTP and HTTPS work. So what are HTTP and HTTPS, and what is the difference between the two?

What is HTTP?

HTTP, or Hypertext Transfer Protocol, works to transfer data across a network. Data is put into a specified format and syntax to ensure it can be read and transferred correctly. HTTP is set up to send and receive both requests and responses. HTTP requests happen when a hyperlink is clicked, or a website URL is put into the browser. The HTTP request is sent using one of the different HTTP methods to retrieve or send information to a webpage. The webserver, in turn, provides an HTTP POST response, which is an HTTP response, and that gives the user access to the desired webpage.

The majority of web pages do not use HTTP but instead use HTTPS because HTTP is not a secure way to transfer data across a network.

What is HTTPS?

HTTPS, or Hypertext Transfer Protocol Secure, is the more secure way to transfer data between a web browser and a web server, that is why most websites use HTTPS. HTTPS utilizes a TLS/SSL connection to securely transfer data between your web browser and the server of the webpage.

Requests and responses sent with HTTPS are encrypted so that any Man in the Middle attacks that may occur will be thwarted since the data can’t be read. The encryption type HTTPS uses is asymmetric encryption and symmetric encryption. The way asymmetric encryption works is that the requested server generates a public and private key pair and the public key is stored in an SSL certificate. The private key, as the name suggests, is kept private to the webserver.

When an HTTPS connection is made to the web server, the client and server complete a TLS Handshake. This Handshake provides a symmetric session key to the server, which then decrypts the session key with it’s private key. When an encrypted message is received, the message is encrypted by the session key, and the client can decrypt the session key using it’s private key. This allows the message to be encrypted in transit and authenticates that the message encrypted within is from the server, since the key pair is mathematically linked.

Comparing HTTP and HTTPS

Now that we know what HTTP and HTTPS are, let us look at the differences and similarities between the two.

HTTP is insecure, whereas HTTPS is secure

As we talked about in the HTTPS section, HTTPS is extremely secure because of its use of asymmetric encryption for data transferred over the network. Additionally, it requires that both itself and the requestor have a valid TLS/SSL certificate to identify each user and authenticate the messages sent by the user. HTTP, on the other hand, sends messages unencrypted to the requestor. This means attacks such as Man in the Middle Attacks will be successful, allowing the man in the middle to take the information transferred to the server, which could include credit card information or other Personally Identifiable Information (PII).
Data sent via ports

With HTTP, data is sent via port 80, which allows unencrypted data to be sent to requestors. HTTPS instead uses port 443, which allows encrypted communications to occur.
OSI Layers and URLS

One final difference between HTTP and HTTPS is the OSI layer they work in and how URLs are structured. The Open Systems Interconnection (OSI) model is a model that shows the seven different layers that computers communicate through.
The seven layers are:
- The Application Layer
- The Presentation Layer
- The Session Layer
- The Transport Layer
- The Network Layer
- The Data Link Layer
- The Physical Layer

HTTP works in the Application Layer, and HTTPS works in the Transport Layer.

URLs with HTTP start with http:// and have an unlocked padlock on the search bar next to the URL. Because it is secure, HTTPS URLs have a locked padlock next to the URL and start with https://.

Conclusion

Utilizing encryption and digital certificates is important for both connections across the Internet as well as within an organization’s internal network. Security systems like Public Key Infrastructures (PKIs) provide users and devices in an organization with certificates to identify them and allow encryption of messages. To learn how Encryption Consulting can help you with setting up a PKI within your organization, visit our website at www.encryptionconsulting.com.

CASB Assessment and Deployment

Challenges	Solution	Benefits
Inadequate visibility into activity in cloud applications – both sanctioned and unsanctioned	Gained understanding of both sanctioned and unsanctioned apps, rated them according to customers’ security risk, and selected those that conform to their risk tolerance.	Maximises cloud security by monitoring cloud activity.
Inability to enforce security policies on enterprise cloud services	Extended the reach of customers’ on-prem security policies to the cloud.	Ensures compliance and data privacy.
Lack of integration with other security tools and solutions	Extended coverage of on-prem DLP to the cloud	Identifies data loss channels in the organisation.
Inability to identify risky users	Helped organisation in identifying risky user behaviour such as data exfiltration and file oversharing	Analyses and disables accounts indicating malicious activity.
No defined implementation roadmap for CASB technologies.	Developed use cases and requirements for CASB solution. Performed vendor analysis. Developed a detailed implementation plan including high-level architectural diagram. Implemented the CASB solution.	Ensures the secure and compliant use of cloud apps and services.

Why does Every Organization Need Artificial Intelligence?

Why-does-Every-Organization-Needs-Artificial-Intelligence

As humans learn more about Artificial Intelligence (AI) and develop what it can do, more and more organizations are implementing AI into their processes. The increase into the development of AI has helped it become affordable to use in most, if not all, organizations.Companies are learning that now is the perfect time to implement AI into their repetitive processes to create a level of automation that increases productivity and allows the individuals within organizations to focus on more detailed work that cannot be done by AI. But before we discuss how to implement AI into your organization, we should first look at the steps a company should take before beginning with AI.

Steps an Organization Should Take Before Implementing AI

The first step any organization should take before implementing AI into their processes is to get familiar with Artificial Intelligence. Learning more about AI will help in later steps of the implementation, and help you determine the places in your organization that will benefit the most from an AI implementation.There are many free resources to learn about AI, including YouTube videos, university lectures, and open-source libraries and kits that will help you develop a better understanding of what goes into implementing an AI solution.
Once you’ve familiarized yourself with the basics of AI, you should identify the problems you want Artificial Intelligence to solve and how much that may cost. AI can be implemented in an organization’s existing products and services, or it can be something as simple as a chatbot on the main website.

If your organization is looking for something simple, a chatbot would be a good first step. They are very easy to set up, and they take care of users asking many of the same, repetitive, questions. This will free up your support teams to focus on other projects and only be needed if the chatbot does not already have an answer.
After identifying current processes that would benefit from AI, or discovering gaps that AI would fill, it is time to start designing your solution. It is always best, for the first few AI projects, to utilize external and internal teams to complete these solutions. In this way, you have both experts who already know how to implement an AI solution, and internal team members who can learn for future AI projects.

Starting small with your first project is important, as you don’t want to take on too much at once with an AI implementation. A simple month-long project could turn into a six-month project if careful planning is not done. Now that you know some of the steps an organization should take before implementing Artificial Intelligence, let us discuss the different models of AI implementation that an organization may take.

AI Implementation Models

There are three different implementation methods that an organization will take when deciding to implement AI into their organization.

The first model is the “hub” model. The “hub” model, as the name suggests, focuses all AI and analytics systems into a central hub. A central hub for Artificial Intelligence is perfect when deploying new AI systems, as it provides a fully centralized team to handle every step of the implementation. A “hub” model should be gradually developed over time, as the task of developing such a large unit of the business would be very complicated and time consuming all at once.

The way the “hub” model is set up is that the systems and teams involved in AI are in a centralized location, loaning out their experience to the different business units whenever necessary. The development of the hub should be driven by the different AI tasks that the organization has determined are needed within the company. This allows the hub to grow slowly over time, as opposed to all at once.
Another implementation model of AI within an organization is the “spoke” model. This model is the opposite of the “hub” model, instead focusing on spreading the different AI team members and systems throughout the different business units of the company.

This model offers the different business units the ability to have a support team on deck for any AI tools they have implemented into their section of the business. This also allows the different business units to develop their own AI tools and systems for their specific use, as opposed to deploying them organization-wide.
The final model is a “hybrid” model, called a “hub-and-spoke” model. This takes the components of a “hub” model and the components of a “spoke” model and creates the ideal model. This method allows the central hub to handle a small handful of responsibilities with the AI team lead at the center.

The spokes then work within the different departments to create business unit-specific tools that can help the business unit. The spokes focus on execution team oversight, adopting AI solutions, and performance tracking, while the hub deals with hiring for AI team members, performance management, and AI governance.

Ways of Using AI within your Organization

There are several different ways to use Artificial Intelligence within your organization that are simple to implement and don’t involve high costs. A centralized knowledge center is a great initial way to start using AI in your organization. Having a central knowledge base offers users the ability to quickly find and parse through documents relating to their questions, without having to use the time of an employee to answer the same questions over and over.

Like the centralized knowledge center, you can also setup an automated live chat, like a chatbot, that will answer questions for users. Additionally, you can integrate with popular applications, like Salesforce or Jira, and automate processes within those applications. This allows employees to save time and increase their productivity.

Build A Secure Incident Response Plan For Your Organization

Incident Response is a process by which an organization handles and manages the cyber-attack or data breach so that the damage or consequences of the attack become minimal. In other words, the processes used to prepare for, detect, contain, and recover from a data breach are known as an incident response (IR).

Incident Response is usually handled by the Incident response team (IR Team), which consists of a staff of Security and IT and the legal, human resources, and public relations departments.

Incident Response Plan (IRP)

Cybersecurity incident response plan document should ideally be a crisp, concise, to-the-point document that describes the precautionary measures to be taken by the incident response team (IR team) and the information security team. For avoiding confusion, roles and responsibilities standards, communication plans, and defined response methods should be included and clearly explained in the document.

Phases of Cyber Incident Response

There are six steps involved in the Incident Response process.

Preparation

As the name says, preparation is the first and most essential phase of the whole process, which is carried out before the incident. So, it is the most crucial step as it will determine whether your organization will sustain the attack or not.In this phase, we conduct a risk assessment and determine where the most significant vulnerabilities are, which assets are most likely to be targeted, and what the company will do if they are damaged.

This is when organizations either refine existing rules and procedures or create new ones if they don’t have any. This phase includes the communication plans, roles, and responsibilities in IRT, access controls, and training.
Identification

This phase comes after the incident has occurred. It is critical to figure out the breach in golden hours so that the situation doesn’t go out of hand. This phase starts with identifying the type of threat, what consequences it can possess, its extent, and the goals of the intruder.

IT personnel gathers events from log files, monitoring tools, error messages, intrusion detection systems, and firewalls to discover and determine issues and their scope in this step of effective incident response. After an incident has been confirmed, communication planning is also started during this phase.
Containment

Containing an issue once it has been recognized or identified is a high priority. Erasing everything is never the best answer because you might lose necessary evidence in the process. This phase should cover topics like which systems will be taken offline in a breach and what backup procedures are in place.

Usually, Containment takes place in two subparts:
- Short Term Containment
  
  It reduces the extent of the harm before it worsens, traditionally done by isolating network segments.
- Long Term Containment
  
  It is referred to as temporary fixes to allow production systems to be restarted.
Eradication

The purpose of this phase in incident response is to eliminate the source of the breach. By this step, organizations can remove the threat and restore the affected systems to their original state by ejecting malware and preventing attackers while minimizing the loss. This phase will last until all traces of the attack have been eliminated. This phase also focuses on patching vulnerabilities and updating old versions of software, in addition to securely removing malware.
Recovery

After the vulnerabilities have been patched, the malware has been removed, or the reason for the attack has been resolved, the next step is recovery or restoration. Organizations want the systems to recover fully and go up again in this phase. The recovery process includes:
- Monitoring
- Testing and verifying
- Defining date and time, when to restore services
Learnings

It is the final and can be considered the critical step in the Incident Response process. It gives us the overall understanding and helps the organizations improve for future efforts. Organizations can use this step to implement/update their Incident Response process with the things that might have been missed during the incident. Overall, it provides us the experience to learn and implement new techniques.

Why is Incident Response Plan Important?

When an organization’s reputation, income, and customer trust are on the line, the ability to detect and respond to security incidents and events is vital. Organizations must have an incident response strategy, whether the breach is small or large. Here are the essential points regarding why you need Incident Response Plan today-

In data breaches or cyber-attacks, the customers’ trust decreases, so having a solid IR Team will eventually regain confidence.
For preserving the company’s reputation, IRP is essential.

Conclusion

The process by which an organization addresses and manages a cyber-attack or data breach is known as incident response. This process is usually carried out with the help of an incident response team (IR team) which comprises security and IT members. The process of Incident response is done in six phases, such as Preparation, Identification, Containment, Eradication, Recovery, and Learning. Having a solid IR team is essential, to overcome the effects of data breaches or cyber-attacks.

Does your organization have an Encryption Backdoor?

Before we look at Encryption Backdoor as a whole, let’s have a brief rundown of these two separately. Encryption is a method of scrambling information so only approved keyholders can comprehend the data. In other words, encryption takes decipherable information and adjusts it, so it seems arbitrary.

On the other hand, the backdoor is a means to access a system or encrypted data by avoiding the standard method of authentication. It is typically inserted into a program or algorithm before being widely distributed. It is frequently hidden in the design of the program or algorithm.

What is an Encryption Backdoor?

An encryption backdoor is a method of bypassing authentication and accessing encrypted data in certain services. It can also be defined as a deliberate weakness created by the service provider to allow for easy access to encrypted data. An encryption backdoor would either allow the intruder to guess the access key based on the context of the message or to present a skeleton key that would always grant him access.

Encryption backdoors and vulnerabilities are quite similar theoretically as they both provide an unconventional way for someone to enter a system. However, the difference is that backdoors are created on purpose, whereas vulnerabilities are unintentional.

Benefits of Encryption Backdoors

An encryption backdoor would aid law enforcement and intelligence agencies in their efforts to combat and prevent crime. This would also expedite investigations because agencies would be able to intercept communications and search suspects’ electronic devices to gather data. Officials claim that a backdoor would greatly benefit investigations of terrorism and hate crimes.
It can be used to restore user access when there is no other option. It can also be utilized for troubleshooting purposes.
It can help uncover child sexual abuse material (CSAM) hidden in encrypted messaging applications.

Drawbacks of Encryption Backdoors

While an encryption backdoor may seem like a boon to solve crimes, it may eventually leave numerous applications and services vulnerable. The same backdoor that the law enforcement agencies and governments are making a strong case for, can be exploited by hackers which would ultimately lead to rise in cybercrime.
Intelligence agencies could misuse a backdoor to spy on people without a warrant and collect maximum data.
IT organizations would be forced to store decryption keys in their databases which would give an opportunity to cybercriminals to steal the keys and extract sensitive information from billions of people.
In the case of IoT devices, the backdoor to one will lead to exposing all other devices connected to the network.
The threats of encryption backdoors increase when enterprises use multiuser and networking operating systems.

Are Encryption Backdoors necessary?

Global tech giants have expressed their displeasure over the inclusion of encryption backdoors. Encryption protects everything from networks and devices to email and banking transactions. Law enforcement agencies might have the best intentions, but it is important to understand that without trusted encryption, the internet would be a more fertile place for hackers.

With privacy experts advising constantly on maintaining the strongest possible encryption standards, and on the other hand, law enforcement agencies willing to have a backdoor in order to nab criminals, clearly shows that no middle ground has been found yet and this debate will only intensify over the time. The only thing we can do presently is protected our data to the best ability.

Conclusion

Encryption backdoors can both be useful and harmful at the same time. At present, there isn’t any well-defined policy for backdoors, however, we hope whatever decision is taken, it’s in the best interest of all, keeping in mind the privacy and data security of citizens as well as the concerns of government apprehending criminals for maintaining public safety.

DLP Assessment and Deployment

Challenges	Solution	Benefits
No documented data loss prevention requirements No identification of data loss channels within the organization Users capable to access, copy and send sensitive data outside of the company, including across borders No defined implementation roadmap for DLP technologies	Gained understanding in the sensitive data flow around data management platforms and integrated customer data sources Developed use cases and requirements for DLP solution. Performed vendor analysis. Developed a detailed implementation plan including high-level architectural diagram. Implementation of the DLP solution.	A well-documented and consolidated data loss prevention requirements Defining governance and technology to manage DLP program. Periodic re-assessment process for DLP program (data classification, DLP policy review/refresh, DLP process, etc.)

Why Every Organization Needs Data Loss Prevention?

What is Data Loss Prevention?

Data Loss Prevention (DLP) is a set of processes used to ensure an the organization’s sensitive data is not lost, misused, leaked, breached, or accessed by unauthorized users. Organizations use DLP to protect and secure data and comply with regulations. Organizations pass their sensitive data to partners, customers, remote employees, and other legitimate users through their network, and sometimes it may get intercepted by an unauthorized user.

Many organizations find it challenging to keep track of their data and lack effective data loss prevention best practices. This results in a lack of visibility into what data leaves the organization and obfuscates data loss prevention.

Why do you need Data Loss Prevention?

Data loss can be damaging for businesses of all sizes. The primary purpose of data loss prevention is to secure sensitive data and prevent data leakage /data breaches. Data loss prevention solutions are designed to monitor and filter data constantly. In addition to dealing with the data being used, stored, and transmitted within the network, data loss prevention applications ensure no harmful outside information enters the company network and that no sensitive information leaves the company network via an unauthorized user.

Organizations typically use DLP to

Protect personal Identifiable Information (PII) data and comply with relevant regulations.
Protect intellectual property, which is critical for the organization.
Secure data on remote cloud systems or storage.
Enforce security in a BYOD environment.
Achieve data visibility.

Reasons why Data Loss Prevention is necessary for business

Outside threats and attacks are increasing daily; hackers have become more sophisticated with time and finding new ways to access networks and sensitive data occurs very frequently. Organizations should actively look for new threats.
Insider threats are also a prime reason to use DLP. Disgruntled employees deliberately cause harm to the company by sharing the company’s sensitive data with unauthorized users or by trying to find assistance from outside to carry out the attacks. The Verizon 2021 Data Breach Investigations Report revealed that more than 20% of security incidents involved insiders.
Data loss can impact the financial health of your business. Data loss can also lead to loss of productivity, revenue, client trust and damage the company’s brand name and reputation. According to the IBM Cost of a Data Breach Report 2021, the global average data breach costs increased from $3.86 million to $4.2 million in 2021.
Organizations have welcomed the Bring Your Own Device (BYOD) approach on an immense scale. However, some industries or organizations have poorly deployed and maintained BYOD solutions. In this case, it is easier for employees to inadvertently share sensitive information through their personal devices.

Therefore, a data loss prevention strategy is crucial to secure your data, protect intellectual property, and comply with regulations. DLP systems ensure that your company’s sensitive data is not lost, mishandled, or accessed by unauthorized users.

Data Loss Prevention (DLP) best practices:

Determine your data protection objective
Define what you are trying to achieve with your data loss prevention program. So you want to protect your intellectual property, better visibility, or meet regulatory and compliance requirements. Having a clear objective will help you/the organization determine the appropriate DLP solution to include your DLP strategy.
Data classification and identification
Identify the critical data for your business, such as client information, financial records, source codes, etc, and classify them based on their criticality level.
Data Security policies
Define comprehensive data security rules and policies and establish them across your company’s network. DLP technologies help block sensitive data/information/files from being shared via unsecured sources.
Access Management
Access to and use of critical or sensitive data should be restricted or limited based on users’ roles and responsibilities. The DLP solution helps the system administrators assign the appropriate authorization controls to users depending upon the type of data users handle and their access level.
Evaluate internal resources
To execute the DLP strategy/program successfully, an organization needs personnel with DLP expertise, who can help the organization to implement the appropriate DLP solution, including DLP risk analysis, reporting, data breach response, and DLP training and awareness.
Conduct an assessment
Evaluating the types of data and their value to the organization is an essential step in implementing a DLP program. This includes identifying relevant data, wherever the data is stored, and if it is sensitive data—intellectual property, confidential information etc.

Some DLP solutions can identify information assets by scanning the metadata of files and cataloging the result, or if necessary, analyze the content by opening the files. The next step is to evaluate the risk associated with each type of data if the data is leaked.

Losing information about employee benefits programs carries a different level of risk than the loss of 1,000 patient medical files or 100,000 bank account numbers and passwords. Additional considerations include data exit points and the likely cost to the organization if the data is lost.
Research for DLP vendors
Establish your evaluation criteria while researching for a DLP vendor for your organization, such as:
- Type of deployment architecture offered by the vendor.
- Operating systems (Windows, Linux, etc.) the solution supports.
- Does the vendor provide managed services?
- Protecting structured or unstructured data, what’s your concern?
- How do you plan to enforce data movement?(e.g., based on policies, events, or users)
- Regulatory and Compliance requirement for your organization.
- What is the timeline to deploy DLP solution?
- Will you need additional staff/ experts to manage DLP? Etc.
Define Roles and Responsibilities
Define the roles and responsibilities of individuals involved in the DLP program. This will provide checks and balances during the deployment of the program.
Define use cases
Organizations often try to solve all the use cases simultaneously. Define the initial approach and set fast and measurable objectives, or choose an approach to narrow your focus on specific data types.

Conclusion

DLP solutions classify regulated, confidential, and business critical data, it additionally identifies any violations of policies specified by organizations or within a predefined policy set, usually driven by regulatory compliance such as PCI-DSS, HIPAA, or GDPR. In case violations are identified, DLP enforces remediation with alerts to prevent end users from accidentally or delibartely sharing data that could put the organization at risk. DLP solutions monitor and control endpoint activities, protect data-at-rest, data-in-motion, and data-in-use, and also has a reporting feature to meet compliance and auditing requirements.

Your DLP Solution For Data Leaks

The average cost of a data breach in the US rose to $4.24 million in 2021. Remote work due to the COVID-19 pandemic was a major factor in increasing this cost. For large organizations, this cost could be even higher. The cost of the data breach was highest in the Healthcare industry. Many organizations face a challenge of keeping track of all their data. One of the reasons for this is that employees now use multiple devices and store data at different locations such as desktops, laptops, smartphones, notebooks, file servers, and on the cloud. They also use multiple communication channels such as email, shared online folders, social media, and collaborative software to send and share data. Due to these reasons, many organizations are unable to track sensitive data leaving the organization and prevent data loss.

Organizations need to protect sensitive data due to multiple industry and government regulations such as HIPAA and PCI-DSS.

Data Leak Causes

The main causes of data leaks within an organization are:

Data exfiltration by cyber criminals

Cybercriminals target sensitive data and use multiple techniques like phishing, malware, social engineering, and injection attacks to gain access to the organization’s sensitive data and exfiltrate it.
Unintentional data exposure
Some of the data leaks happen due to human errors. An employee might misconfigure access to sensitive data in the cloud or expose secrets in code repositories.
Malicious insiders

A disgruntled employee might compromise privileged user accounts to exfiltrate sensitive data outside the organization.

Data Loss Prevention

Data Loss Prevention is a set of tools and processes that are used to detect and prevent unwanted destruction, unauthorized access, and exfiltration of sensitive data. Organizations use DLP to protect their sensitive data and to comply with regulatory compliances such as HIPAA, GDPR, PCI-DSS, etc. DLP solutions use rules to classify and protect sensitive data so that users cannot accidentally or maliciously exfiltrate sensitive data from the organization. DLP solutions monitor endpoints and networks to protect data-at-rest, in-motion and in-use.

Use Cases for DLP

The main use cases for DLP in an organization are:

Compliance

The organizations that collect and store Personally Identifiable information (PII), payment card information or protected health information (PHI) need to adhere to compliance regulations such as GDPR, HIPAA and PCI-DSS. A DLP solution helps the organization to follow these regulations by identifying, classifying, and monitoring sensitive data.
IP protection

A DLP solution also helps an organization classify its intellectual property and protect against unauthorized access and exfiltration of trade secrets.
Data visibility
A DLP solution can also help an organization track data-at-rest and in-motion on endpoints, networks, and cloud. This provides organizations with more visibility into the types of data stored on the endpoints and in the cloud.

Types of DLP Solutions

There are multiple ways to steal data from an organization. The DLP solution should be able to detect the many ways the sensitive data could be exfiltrated from an organization. The different types of DLP solutions are:

Endpoint DLP

An endpoint DLP solution monitors data on the devices in the network. This solution is installed on endpoints like laptops, servers, smartphones, printers, etc, to monitor and protect the data residing on them. Endpoint DLP protects data on these endpoints even if the endpoint is offline or connected to a public network. This solution also prevents transferring of sensitive data to USBs.
Network DLP

This DLP solution is implemented on the network and monitors data-in-transit. All the incoming and outgoing data can be monitored, protected, and blocked from any device connected to the network. The DLP policies can be enforced on all the devices connected to the network. This solution can only protect data on the devices connected to the network and cannot protect data on offline devices.
Email DLP

The email DLP solution monitors and filters emails based on certain keywords. This solution can reduce the data leakage through emails.
Cloud DLP

A cloud DLP solution monitors and protects the data stored in the cloud. The solution can protect and monitor emails, documents, and other types of files.

DLP Best Practices

To develop an effective DLP program, the recommended best practices are:

Determine the primary data protection objective in order to determine the appropriate DLP solution for the organization.
Implement a centralized DLP program and work together with different business units and departments to define consistent DLP policies that govern the organization’s data. This will increase data visibility across the organization.
Conduct an assessment on the types of data and its value to the organization. Identify the data, whether it is sensitive data and its storage locations. Evaluate the data exit points. Then evaluate the risk to the organization for each type of data if it is leaked.
Create a data classification system for both structured and unstructured data. Data classifications might include internal, confidential, public, personally identifiable information (PII), intellectual property, and others.
Create data handling and remediation policies for different types of data. DLP solutions have pre-configured rules based on various regulations such as GDPR, HIPAA, etc. These rules can be customized as per the organization’s needs. Develop controls for reducing data risk. Organizations should develop granular, fine-tuned controls to reduce the specific data risks.
Educate employees to reduce the risk of accidental data loss by insiders. Employee awareness and understanding of security policies is very important for a successful data loss prevention program. Awareness programs and trainings such as posters, emails, online trainings, and workshops can help in improving the employee understanding and adherence to data security policies and best practices.

Conclusion

Organizations need to protect sensitive data-at-rest, in-transit and in-use. They also need to ensure that data is protected on all devices and on the network, considering the different data exit points. A robust DLP solution can help organizations ensure data protection on all devices and in different stages of the data lifecycle. Encryption Consulting is a customer-focused cyber security consulting firm providing services to various clients on implementing and managing DLP in their environments. To see how we can help your organization, visit our website at www.encryptionconsulting.com

Prepare Your Organization For Data Breaches

What is Breach?

Data Breach is when any information is stolen from the system without the administrator’s knowledge. Anyone can face a data breach, whether an organization or an individual. Targeted data can be confidential, personal, sensitive, or proprietary such as business plans, credit card details, personal information, or matters of national security and trades.

A data breach can result in financial loss as well as reputational damage. A data leak could be deliberate or unintentional. An attacker enters into the company’s infrastructure and steals data, or inadvertently, a firm employee discloses Personal Information over the Internet. All fall into the category of Data Breach as it can help the attackers for their profit.

Recent Data Breaches

Last year, Various data breaches were reported. Some were minor, whereas some cost huge to the victims. Some examples of these includes

LinkedIn recently faced a massive data breach scenario. Personal information of 700 million LinkedIn users, or almost 93 percent of the company’s members, was available for purchase on the internet. The data was claimed to be recent; though it didn’t include the login credentials, it contains basic personal information like Name, Phone number, Addresses, Gender, Email, Geographical Locations, etc.
Facebook also faced the same situation when a security researcher uncovered a Facebook database that contained 533 million accounts that had been leaked. Personal information of the users was compromised, consisting of 32+ Million records of users from the US, 10+ Million users from the UK, and 7 Million users from India. Facebook faced a lot of troubles regarding this database leak.
Another incident happened with Raychat, an Iranian commercial and social messaging app. A cyberattack employing a bot revealed millions of user records to the internet, eventually erased.

What is Identity Theft?

Identity theft is a cyber-fraud that includes someone stealing your identity, specifically online, to commit theft. Attackers usually get your information by data breaches or by public information access. This kind of fraud can damage you socially as well as financially.

Reasons behind a Breach

Unpatched and outdated security vulnerabilities

Using an old security patch invites the attackers to enter and steal. Hackers unknowingly use the information gathered by security researchers for their use. However, any unfixed vulnerabilities are being exploited by hackers for their personal use. To identify them for future reference, these exploits are categorized into hundreds of Common Vulnerabilities and Exposures (CVEs).
Human Error

Unfortunately, many breaches are not due to automation failure or unknown error but are expected to be human error. According to a study, 50% of breaches happen due to some human error. The reason maybe
- Due to the use of weak passwords
- Sharing of accounts/passwords
- Being a victim of phishing and the list goes on and on.
Malware and phishing

Malware and phishing don’t only affect your personal computer, but they can also be a threat to your company’s system. According to a report, every 5 seconds, a malware event occurs worldwide. By making minor modifications, hackers can still enter your system without being noticed by antivirus.
Theft of a Data-Transporting Device

If devices with sensitive information and your organizations’ trade secrets are being stolen, it can lead to breaches. The seriousness of the violation depends upon the type of data stored in the device that has been stolen.

Effects of Data Breaches

As already stated, the effects of data breaches can be hazardous. Some of the results are listed below.

Financial and Reputational Damage

Data breaches can harm a lot regarding the trust and reputation of a company. Recovering from a Breach also costs a lot to the organizations. Customers will think twice about giving their data to a company that has been a victim of a Data Breach.
Downtime in Company

The recovery process includes many things like investigation, re-development, etc. During this time, the company had to keep its operations shut down, leading to Operational Downtime. This duration is entirely dependent upon the time taken during the whole investigation.
Loss of Sensitive Data

In a data breach, we lose our personal and professional data, which can have disastrous effects. Any information directly or indirectly related to an individual is essential, and no one likes to compromise with those.
Legal Actions

Organizations are legally required to demonstrate that they have taken all necessary precautions to secure personal data under data protection legislation. Any data breach can drag organizations into legal consequences too.

Best Practices to Avoid Data Breaches

For Enterprises

Proper Implementation of Security Measures.
Preparing an effective disaster recovery plan before.
Use latest and updated security patches.
Provide regular security training for employees to make sure that they know about recently introduced policies.
Keep regular Security audits. A security audit will examine your security policies more than vulnerability assessments or penetration testing.

For Individuals

Always enable two-factor Authentication.
It is advised to change your password regularly, but it’s especially crucial to change your passwords to something substantial, safe, and unique after a data breach.
Keep a record of all of your financial receipts.
If you receive any mail from suspicious-looking emails, don’t open it without proper investigation. Before opening any attachment, be sure you know who the sender is and what the email contains.

Conclusion

Data Breach is a type of attack in which sensitive and vital information gets compromised without the administrator’s knowledge, and the attacker uses it for their benefit. Several MNC companies recently faced these kinds of Data Breaches. Several reasons are behind a data breach consisting of Human Error, Outdated Security Patches, etc. These types of attacks have very disastrous effects on individuals and organizations. However, by following certain practices, we can prevent these Breaches from happening.

Are your organization’s certificate policies updated?

Certificate Policy (CP)

A certificate policy describes the measures taken to validate a certificate’s subject prior to certificate issuance and the intended purposes of the certificate. For many organizations, the certificate-issuance policy determines whether the presented certificate will be trusted. The CP also lets users and PKI maintainers know how to apply for a certificate, the naming standards for certificates, and more. The Certificate Practice Statement (CPS) follows the standards set forth in the CP.

Contents of a Certificate Policy

A certificate policy should include the following information:

The method through which user’s identity is validated during certificate enrolment

The procedure of identifying a genuine user must be defined. It may be via an account and password combination or other different forms of identification which requestors/users must present for validation.
The certificate’s intended purpose

The purpose for which certificate has been requested must be mentioned clearly in the policy. For e.g. Is the certificate used for authentication on the network or for signing purchase orders? If the certificate is used for signing purchase orders, is there a maximum value allowed? Such questions should be addressed in the certificate policy.
The type of device in which the certificate’s private key is stored

The private key stored on the computer’s local disk in the user’s profile, or on a hardware device such as a smart card. Other measures, such as implementing strong private key protection or requiring a password to access the private key, can be included in this information.
The subject’s responsibility for the private key associated with the certificate if the private key is compromised or lost

Is the user responsible for any actions performed using the acquired private key if the private key is compromised or a backup of the private key is lost? This decision can lead to preventing the archival or export of the private key associated with the certificate.
Revocation policies, procedures, and responsibilities

It consists of the actions or events which will lead to the revocation of a certificate, how the revocation process will be initiated, and who will perform the actual revocation procedure.

Certificate Practice Statement (CPS)

A certification practice statement (CPS) defines the measures taken to secure CA operations and the management of CA-issued certificates. You can consider a CPS to be an agreement between the organization managing the CA and the people relying on the certificates issued by the CA. While the CP tells a user or maintainer what to do, the CPS tells them how to do it.CA’s CPS is a public document that should be readily available to all the participants so that a relying party can determine whether the certificates issued by that CA meet its security requirements or not. The CPS can contain the following information:

How the CA will enforce the measures necessary to validate the certificate’s subject, as required by the certificate policy.
The liability of the organization if an act of fraud is performed against the service protected by the certificate and the fault is found to be associated with the certificate.
The circumstances under which a certificate can be revoked before its expiration.

RFC 3647 recommends a standard CPS format which includes the following nine sections:

Introduction

The introduction of a CPS provides an overview of the CA, as well as the types of users, computers, network devices, or services that will receive certificates. It also includes information on certificate usage.
Publication and Repository Responsibilities

This section contains details regarding who operates the components of the public key infrastructure and the responsibilities for publishing the CP or CPS.
Identification and Authentication (I&A)

This section describes the name formats assigned and used in certificates issued by the CA. It also describes the certificate policy and assurance levels implemented at the CA and details identification procedures for.
Initial registration for a certificate

The measures taken to validate the identity of the certificate requestor.
Renewal of a certificate

Are the measures used for initial registration repeated when a certificate is renewed? In some cases, possession of an existing certificate and private key is sufficient proof of identity to receive a new certificate at renewal time.
Requests for revocation

When a certificate must be revoked, what measures will be taken to ensure that the requestor is authorized to request revocation of a certificate?
Certificate Life-Cycle Operational Requirements

This section defines the operating procedures for CA management, issuance of certificates, and management of issued certificates.
Facility, Management, and Operational Controls

It describes physical, procedural, and personnel controls implemented at the CA for key generation, subject authentication, certificate issuance, certificate revocation, auditing, and archiving. These controls can range from limiting which personnel can physically access the CA to ensuring that an employee is assigned only a single PKI management role
Technical Security Controls

This contains the security measures taken by the CA to protect its cryptographic keys and activation data.
Certificate, CRL, and OCSP Profiles
It is used to specify three types of information:
- Information about the types of certificates issued by the CA For example, are CA issued certificates for user authentication, EFS, or code signing?
- Information about CRL contents This should provide information about the version numbers supported for CRLs and what extensions are populated in the CRL objects.
- OCSP profiles This section should provide information on what versions of Online Certificate Status Protocol (OCSP) are used (for example, what RFCs are supported by the OCSP implementation) and what OCSP extensions are populated in issued certificates.
Compliance Audit and Other Assessment

The section details what is checked during a compliance audit, how often the compliance audit must be performed, who will perform the audit (is the audit performed by internal team or by a third party?), what actions must be taken if the CA fails the audit, and who is allowed to inspect the final audit report.
Other Business and Legal Matters

It specifies general business and legal matters regarding the CP and CPS. The business matters include fees for services and the financial responsibilities of the participants in the PKI. The legal matters include privacy of personal information recorded by the PKI, intellectual property rights, warranties, disclaimers, limitations on liabilities, and indemnities.

Conclusion

The Certificate Policy is a document which defines standards of the PKI, and the Certificate Practice Statement sets forth the procedures used in the PKI.