“Don’t Become the Poster Child for Data Loss” Says Nigel Hawthorn From Blue Coat Systems

Dubai, United Arab Emirates, 3rd August 2010: More than two thirds of over 2,000 SMBs surveyed in the Europe, Middle East and Africa ranked data loss to be their top business risk, according to a latest SMB Information Protection Survey conducted by Symantec. Data leaks cost small and medium-sized businesses (SMBs) an average of US$ 316,000 each during the past year, the research shows.

At present, data loss to an organisation in the UAE can vary from 5 to 30 per cent of overall revenue. This covers largely the private sector - mainly financial, media, oil and gas, real estate and construction, among others. It is difficult to quantify data loss occurring in the public sector at present.

Legislation in the Middle East with regards to data protection is still lagging behind the US and Europe. This region needs to develop a holistic approach to security and the reporting of data breaches. This will provide more focus on the serious issue and give direction to companies lagging behind in the security battle.

Data loss prevention (DLP) technology can play a significant role in minimising security threats. Organizations in the Middle East can benefit from the lessons learned by their peers in other countries.

Priortize the Need
There are many things an organization can do with a DLP solution, and they should do most of them. Eventually. If they to do everything at once, the project will grow to an unmanageable size and become significant burden for IT.

It is crucial that organizations understand and prioritize the key issues that are driving their deployment of a DLP solution, whether they be compliance, proprietary information concerns or some other issue. Organizations should determine the top priority items and create a deployment plan that reflects those priorities. The goal should be to claim initial success without requiring a full DLP deployment.

Understanding the key drivers of the deployment will also help select the appropriate solution. Not all DLP solutions provide the same functionality, and understanding those drivers will help determine which products an organization should consider.

A global organization or even a regional organization will need a solution that supports multi-byte characters so that it can match content in Arabic, Japanese, Chinese and many other languages. Without that support, a business will have to deploy local solutions in each country, creating a multi-vendor policy, management and reporting headache.

Carefully analyzing how a solution catches sensitive content is equally important. The lack of advanced data recognition technologies, for example, could result in high false positives or overblocking that impedes productivity. Organizations that are concerned about overblocking content should be sure their solution has fingerprinting technology in addition to keyword matches.

Using fingerprinting to accurately register content helps reduce false positives, which can be high when keyword or pattern-based matching is used alone. Fingerprinting enables organizations to create signature-like profiles of proprietary and sensitive data that is then matched against traffic running on the network. It also eliminates the need to manually maintain white lists or other resource-intensive workarounds.

DLP Is Not Enough
While the right DLP solution can be effective at preventing the loss of sensitive, personal or confidential data, it is not foolproof and should not be deployed as a standalone solution. It works best when it is deployed in tandem with pro-active user education program and a security architecture that features other layers of defense.

Most leaks are accidental, and DLP solutions are most effective if they can inform the employee when they are attempting to do something that violates policy. A solution that provides real-time feedback to the user, can help them become more aware of their responsibilities and the risk involved with seemingly innocent activities. This type of education heightens user awareness and results in self policing of policy.

DLP systems should both directly enforce policy and re-enforce education efforts through context-sensitive messaging to the user. Employee education can take many forms, such as written policies that are propagated through the organization or even coaching pages that pop up when an employee tries to send sensitive information via webmail. These pages allow organizations to educate employees about the types of data that cannot leave the corporate network, and they can even point the employee to the appropriate policy documentation. This constant reinforcement has proven highly effective in reducing unintentional employee data leaks. It also serves to create an awareness of the defenses that are in place to help prevent malicious data breaches.

Integrating DLP into an existing security framework that provides multiple layers of defense is also critical to successfully preventing data loss. In this framework, DLP can work with other defenses like anti-virus and web filtering solutions to ensure that sensitive data doesn’t leave the network. For example, if a user is infected with malware that collects personal identification information to send back to a server, a web filtering solution could identify that link as malicious and block it, preventing the data from leaving the corporate network.

The bottom line is that DLP solutions offer organizations an effective way to prevent data breaches, particular in the context of a strong multi-layer security architecture. In countries that already have data notification regulations and where DLP adoption is up, data breaches are clearly down. For Middle East organizations, the lessons from these earlier deployments are plentiful and provide a good map for how to successfully deploy DLP technology without the pitfalls.

About Blue Coat Systems
Blue Coat Systems is the technology leader in Application Delivery Networking. Blue Coat offers an Application Delivery Network Infrastructure that provides the visibility, acceleration and security required to optimize and secure the flow of information to any user, on any network, anywhere. This application intelligence enables enterprises to tightly align network investments with business requirements, speed decision making and secure business applications for long-term competitive advantage. For additional information, please visit www.bluecoat.com.

# # #

Blue Coat, PacketShaper and the Blue Coat logo are registered trademarks or trademarks of Blue Coat Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document are the property of their respective owners.

Manal Abi Rafeh
Regional Marketing Manager ME & Turkey
Blue Coat Systems ME
Telephone: +971 4 3911620
Fax: +971 4 3911635
Email: manal.abirafeh@bluecoat.com

Media Contact:

Colin Saldanha
PR Consultant
Procre8
PO BOX 78835
Dubai - UAE
GSM: +971 (50) 6400762
Email: colin@oakconsulting.biz

This release was published on openPR.