Oil Geeks

I’m sure everyone’s aware of the words ‘Most Confidential’ but in reality most organisations don’t actually give much thought beyond storing in a file share somewhere with the words ‘Most Confidential’ being part of the title.  I have seen this in massive enterprises. Its really a grey area even from a technical standpoint.

And that’s all well and good in one little organization but how does that stop data leakage and more importantly the risks which it involves.

For example:

In the past I was witness to an organization which found out that an employ had a serious medical condition.  The  Management took steps to remove the person for what I can only describe as ‘alternative grounds’.  Six months later, a colleague in the same department found a word document on a shared drive with the real reason in it.

OK the document was supposed to be on a ‘secure area’ and the whole issue of account lifecycle management is a separate post (users having the ability to give other users access.

The colleague in turn forwarded via email the offending document to the now ex Employee – who rightly had cause for a lengthy and expensive legal case.   The legal ambiguity of HR policy aside.  What I noticed was how thin the real governance and policies and technical solutions for dealing with document classification and Most Confidentiality.

Where to start to put some controls in place?

The is some sort of standard i.e. ISO 27001 but it does not prescribe to the levels what are the classifications. This of course should be down to your organization or even better industry standard.

i.e.

• Confidential – Highest confidentiality level
• Restricted – Medium confidentiality level
• Internal use – Lowest level of confidentiality
• Public  – Everyone can see / view the information

Once we have that information policy in place we have to look how we can use technology to implement a usable and secure Solution.

For instance using Active Directory Rights Management Service (ADRMS).

Some nasty gotcha’s.

If you are dealing with Most Confidential have a think about the following conditions:-

Is the data on the same database server? i.e. your default SharePoint Server Farm? This opens us a potential threat that users can get to the data. I.e. using Data Extraction Techniques  / Data Recovery tools.  For example:-

https://spdbfextractor.codeplex.com/

What about Isolation? Should there be a completely separate Server Farm?

Who has access to the servers? Does Support have access? How is this governed?

Who has access to the Service Accounts?

How is that Server Supported and Patched?

What I am trying to say is, it’s a bit like anti theft devices on your car.  You cannot really stop someone breaking into your car, but hopefully you can make the process more difficult so has not to be easy.