The growing volume of unstructured data stored by companies is creating a security hole, according to new research from the Ponemon Institute. Unstructured data, such as information stored in spreadsheets, documents, presentations, multi-media files and blueprints, can make up a majority of digital business assets. Eighty-nine per cent (89%) of respondents to the survey admitted that controlling access to unstructured data remained a major challenge. Eighty-four per cent (84%) indicated that controlling unstructured data access will remain important or become more important within their company in the next two years.
The report found that the rate at which unstructured data is being created makes the challenge of managing and protecting the information “exponentially” more difficult. This study exposes a serious flaw in the unstructured data security processes of many companies. Inadequate data governance may afford improper access to sensitive information by unauthorized individuals. The research consistently shows that insiders present a huge threat to unstructured data integrity. It also highlights that without proper governance mechanisms in place, it is impossible to prevent these insiders from accessing unstructured information inappropriately.
So how do you manage unstructured files such as Word documents, Excel spreadsheets, text files, PDF files or flat-file databases? A large percentage of these files that contain sensitive information are strewn across your network on every storage device imaginable.
Clearly, access controls are needed to keep roving unstructured data secure. Here are some issues to consider about the use of unstructured data in your organization (Note: This list was adapted from a piece written by David Linthicum (Approaching Cloudsizing).)
1. Impact to business of a data loss
2. Access the culture to comply with systems and policies
3. Access the value of the data
4. Understand your data – its use, lifecycle mobility, etc.
5. Understand your IT services
6. Understand your IT processes
7. Understand your existing IT resources
8. Identify candidate unstructured data
9. Identify candidate IT services
10. Identify candidate IT processes
11. Create a governance strategy
12. Create a security strategy
13. Bind candidate services to data and processes
14. Relocate services, processes, and information
15. Implement security
16. Implement governance
17. Implement operations
Until recently, the unstructured data file dilemma has not been the central focus of most security vendors and IT professionals. Perimeter security controls using firewalls and intrusion detection systems have had a prime focus. The idea was that if you keep the bad guys off our network, especially the storage area network (SAN), nothing bad could happen. This simply isn’t reality. Consider:
- Applications that leave temporary unstructured data files in common drives such as temp directories, the root of the C: drive, and program installation folders
- Laptop computers that travel the world with important unstructured data files can be stolen, accessed or lost
- Users copying unstructured data files from the server to their local Windows desktop so that they can work while travelling
- Users habitually saving sensitive information
It is fine to have your SAN or network attached storage (NAS) environment “locked down.” Sensitive information spread across your network must be managed accountably. Storage security is coming of age and it is critical to rein in your sensitive files both inside and outside of your traditional storage boundaries. Written policies will not get your users to store sensitive information in the proper places. Users generally go down the path of highest convenience, pushing security aside if it gets in the way of getting their jobs done.
The Infinidrive™ by EsoteraS3® is an enterprise-scale SaaS platform that renders highly sensitive unstructured files as indistinguishable fragments to unauthorized viewers, yet makes them accessible to the owner worldwide. It is a robust solution for companies struggling with managing unstructured files.
Tags: cloudcomputing, esoreras3, infinidrive, ponemon, SaaS, unstructuredfiles
