Information Security Policy: Protecting Sensitive Business Data

The Challenge of Protecting Confidential Business Information

Any business of substantial size has certain information that is both vital to its successful operation and meant to be kept confidential — away from the eyes of competitors and, in some cases, consumers. Achieving proper control over this confidential information requires a variety of tools, from technical and physical limits on data accessibility to authority structures and behavioral guidelines that influence how much information is put at risk and by whom. Many businesses currently struggle with handling such sensitive information, as corporate espionage, outright theft, and even simple mistakes can potentially cost millions in reverberating damage from the unauthorized access or release of sensitive data. This reality makes effective technologies and policies more necessary than ever.

Insider Threats and the Limits of Technical Security

One of the primary problems in controlling sensitive information is maintaining the integrity of the system and ensuring that access to information is actually limited in practice as intended in planning. Research has shown that information breaches in businesses are predominantly carried out by employees of the breached company who have technical knowledge of — and often design responsibilities for — the company's information security systems (ITSP, 2005). This position allows these individuals to set up backdoor accounts or other points of access that still require proper authorization, meaning the system's security measures will not be triggered and non-repudiation efforts may ultimately prove fruitless. Data could be falsified and yet still authenticated, or it could be legitimately authenticated for the wrong people (ITSP, 2005).

Policy-Based Controls as a Necessary Complement

Because there will always be a potential technical workaround to any technical security measure, simply relying on technical controls will not suffice in addressing this problem. The issue identified above stems from the very technical capabilities of those designing these security measures; thus, any security measure could likely be overridden with relative ease by these individuals (ITSP, 2005). Human resource control must therefore also be implemented as a security measure — and this is achieved not through technology but through policy.

A comprehensive information security policy produced by the SANS Institute (2012) clearly lists the responsibilities and prohibitions of all employees with regard to information access, transmission, and utilization, covering far more than the specific issue examined here. The policy also addresses controls for information security personnel and provides guidelines for executives and managers to reduce risks arising from employee malice or self-interest (SANS Institute, 2012). Simple procedural elements — such as separating the work of various parts of the information security system — as well as more complex undertakings, such as the enforcement of strict ethical codes in other areas of operation, can work to reduce both the capability and the willingness to perform any acts involving unauthorized information access (SANS Institute, 2012).

Conclusion: Guarding the Guards

Security problems will never be eradicated. In the information age, however, they seem to multiply more rapidly than ever before. Proper safeguards — and guards for the guards — are necessary in order to maintain sensitive information appropriately and prevent enterprise risk.