Protecting the Confidentiality and Integrity of

slide1. Protecting the Confidentiality and Integrity of Corporate and Client Data When in the Hands of a Mobile Workforce Mobile Protection for Trustmark Insurance<br>
slide2. Topics<br>
slide3. External / Internal Approach External Protection – Protection of data on a device that has the potential to be externalized – Products: MDM, MDP
Internal Protection – Protection of data before it is moved to a device – Products: DLP, SIEM<br>
slide4. Proposed Approach and Tools Market Classification of Tools Laptops Data Smart
Phones Monitoring and Compliance Notes: Data Loss Prevention products are sometimes referred to as Data Leak Prevention
Mobile Data Protection is sometime referred to as Endpoint Protection because they can protect both internal and external<br>
slide5. Mobile Data Protection Mobile data protection (MDP) is a category of products for securing data on movable storage systems - laptops, smartphones, and removable media.
Provides common protection policies across multiple platforms
Provides auditable proof that data is protected.
Should entail minimal support costs
Should provide FIPS-140 certified encryption* *Federal Information Processing Standards, issued by NSIT<br>
slide6. Mobile Device Management Mobile Device Management (MDM) is a category of applications for managing smartphones. Includes the following functionality:
Software Distribution — The ability to manage and support mobile application including deploy, install, update, delete or block.
Policy Management — Development, control and operations of enterprise mobile policy.
Inventory Management — Beyond basic inventory management, this includes provisioning and support.
Security Management — The enforcement of standard device security, authentication and encryption.
Service Management — Rating of telecom services.<br>
slide7. Data Loss Protection Data loss protection (DLP) is a category of tools that protects data as it leaves the network (sometimes referred to as “Content-Aware” DLP). Includes the following functionality:
Enables the dynamic application of policy based on the classification of content
Can be applied to data in rest (storage), data in use (during an operation), and data in transit (across a network)
Can dynamically apply policies , such as log, report, classify, relocate, tag , or encrypt protections.
Helps organizations develop, educate and enforce better business practices concerning the handling and transmission of sensitive data.
Designed to:
Protect customer information, HIPPA privacy, and intellectual property
Stop data leaks to media
Provide device and port control when protected data is passed to laptops, USB drives, CDs, etc.
Provide endpoint auditing and discovery – where’s my data?<br>
slide8. SIEM – Security Information and Event Management Security Information and Event Management (SIEM) is a category of tools that aid in regulatory compliance and threat management. Includes the following functionality:
Supports the real-time collection and analysis of events from host systems, security devices and network devices combined with contextual information for users, assets and data
Provides long-term event and context data storage and analytics
Not limited to mobile data<br>
slide9. Functions<br>
slide10. Steps in the Mobile Protection Program RISK Education<br>
slide11. Justifying Costs to Management Explaining to senior management the costs of doing nothing and making a case for mobile protection<br>
slide12. Project Phases and Estimated Costs Total Cost of Program: 576K – 631K
Software: 136K – 191K
Consulting: 120K
Internal Costs: 320K
Estimated Duration: 4 mos. Phase 1 Assumptions: 2 implementation consultants for 3 weeks at $1600/day;
4 hours of security and tool training per employee at internal cost of $40/hour

Phase 2 Assumptions: 1 implementation consultant for 4 weeks at $1600/day
4 hours of security and tool training per employee at internal cost of $40/hour

Phase 3 Assumptions: 1 implementation consultant for 8 weeks at $1600/day
8 hours of security and tool training per employee at internal cost of $40/hour

Additional servers can be created through virtualization at minimal cost<br>
slide13. Justifying Costs to Management Leakage of personally identifiable information (PII) and personal health information (PHI), direct costs:
The average cost per record associated with a leak to make affected parties whole
Fees for legal representation
Engaging a PR firm to minimize damage and restore reputation to the extent possible
Consumer credit monitoring for all customers (not necessarily only those affected by the leak)
Up to five years of system and process audits conducted by an independent third party
Forrester estimates $218 per leaked record, so a leak of 100,000 records would cost $21.8M Source: Trends: Calculating the Cost of a Security Breach. Forrester Research, Inc. April 10, 2007.<br>
slide14. Justifying Costs to Management Intellectual property, direct costs:
Fees for legal recourse to address who leaked the data and discover if it is being used inappropriately
Short-term impact to R&D cost recuperation
Long-term impact to profitability/revenue projections
System and process audits to identify and correct the source of the leak
Forrester estimates the average leak results in $1.5M loss Most IP data losses go unreported because there are no public disclosure laws that apply to intellectual property and the impact on valuation from a publicized loss would likely be tremendous.<br>
slide15. Justifying Costs to Management Total economic impact in one lost laptop: $49,256 (incl. replacement cost, detection, forensics, data breach, lost intellectual property costs, lost productivity and legal, consulting and regulatory expenses)
Occurrence of data breach represents 80 % of cost; intellectual property loss is 59% of cost
If the company discovers the loss in one day, it is $8,950. After one week, it is $115,849
Average cost for senior management is $28,449. For a manager or director it is about $61,000
Productivity loss is only about 1% of the cost
Loss if laptop is encrypted: $29,256 (> $20,000 less)
Loss varies by industry – financial services: $112, 853, healthcare: $67,873, manufacturing: $2,184
Loss of intellectual property for healthcare is quite high - $17,999 Source: The Cost of a Lost Laptop, Ponemon Institute (sponsored by Intel), February 9, 2009<br>
slide16. Justifying Costs to Management Source: The Cost of a Lost Laptop, Ponemon Institute (sponsored by Intel), February 9, 2009<br>
slide17. Current Trustmark Security Profile Data Loss Protection<br>
slide18. User View of Situation<br>
slide19. Vision for What to Accomplish<br>
slide20. Key Questions Since we are not starting from a clean slate:
How is the organization using McAfee and will the mobile security products we select be compatible with McAfee?
Utimaco SafeGuard is being used to manage laptop hard drive encryption, lock down, and auditability:
How is it being used specifically?
Are there other products that may be better choices?<br>
slide21. Phase 1 Product Selection Identifying vendor products, comparing features, developing final selection pros and cons<br>
slide22. Phase 1 – MDP Selection McAfee
Sophos
Symantec
Check Point Software Technologies MDP – Gartner Magic Quadrant<br>
slide23. MDP Product Comparison  - meets criteria; + - exceeds criteria; ++ greatly exceeds criteria<br>
slide24. Phase 1 – DLP Selection Symantec
McAfee
Websense
Verdasys DLP – Gartner Magic Quadrant<br>
slide25. DLP Product Comparison  - meets criteria; + - exceeds criteria; ++ greatly exceeds criteria<br>
slide26. Most Suitable Product - MDP Winner of MDP Category – Sophos
Pros
Content-aware, integrated DLP to help decide when to enforce encryption on information being written to external devices.
Platform support is provided for Windows 2000 through 64-bit Windows 7, Mac OS X, and Linux.
Embedded system support includes TPM, TCG encrypting drives, Intel vPro and UEFI.
Smaller mobile devices to be separately supported under an MDM product include iPhone, iPad, and Android.
Cons
North American penetration and brand recognition needs to improve<br>
slide27. Most Feature-Rich Product - DLP Winner of feature-Rich DLP Category – Verdasys
Pros
Offers strongest controls for the protection of sensitive information.
Has strong workflow and case management
Simple and easy-to-use process for creating custom dashboards and reports.
Can audit every access to (and control the movement of) files that contain sensitive data (sought after by IP firms and organizations fearing WikiLeaks-type data disclosures)
Sensitive files are encrypted when copied to mobile media and devices.
Cons
High-end controls and complexity
Priced at premium market
Limited RBAC (role-based access control) capabilities
Offers just endpoint DLP<br>
slide28. Best DLP for Trustmark Best DLP for Trustmark – Websense
Pros
Less costly
Easier to implement
“Fast, effective security leak prevention without a lot of hassle” (Forrester)
Offers both network and endpoint DLP
Cons
Less robust solution for complex business processes<br>
slide29. Question and Answer<br>
slide30. Extra Slides NOT IN PRESENTATION<br>
slide31. Mobile Data VulnerabilitiesOriginal Scope Confidentiality and Integrity Authentication & Availability<br>
slide32. Mobile Data Vulnerabilities:Is that everything?<br>
slide33. User View of Situation Presenting ‘as is’ and ‘to be’ situations and a vision for the future D<br>
slide34. Vision for What to Accomplish<br>
slide35. Mobile Security Program Management Defining solution categories and putting the initiative within a project framework<br>
slide36. Tool Descriptions Mobile Device Protection
(Endpoint Protection) Data Loss Protection
(Endpoint Protection)<br>
slide37. Preparing the Users and Infrastructure Putting it all together:
How do we select compatible products and vendors?
What will it cost to buy and implement?
How should we roll it out to the organization?
How do we justify the costs to management?<br>
slide38. Selecting Potential Products # of vendors:
25 Source: Gartner Group # of vendors:
13 # of vendors:
14 # of vendors:
23 Classifications of Products<br>
slide39. Selecting the Best Products Data Loss Protection – DLP

Symantec
McAfee
Verdasys
Websense
RSA (EMC)
CA Technologies Market Leaders or Visionaries Security Information Event Mgmt - SIEM

HP/ArcSight
Q1 Labs
RSA (RMC)
Symantec
NitroSecurity (McAfee)
LogLogic
Novell Mobile Device Management - MDM

Good Technology
Sybase
AirWatch
MobileIron Mobile Data Protection - MDP

McAfee
Sophos*
CheckPoint Software Technologies
Symantec *Trustmark uses Utimaco SafeGuard Enterprise, which was purchased by Sophos<br>
slide40. Selecting the Best Products For everything except MDM, trend is for vendor consolidation in the marketplace, so that vendor can be “one-stop shop”. Example:
McAfee bought NitroSecurity
Sophos bought Utimaco
Symantec already has products in MDP, DLP, and SIEM categories
Selection should follow a disciplined process for evaluation examining comparative features, ease of configuration, price, and vendor support<br>
slide41. Scope of Vision<br>
slide42. Mobile Data ProtectionSecurity Features Desired security features for a MDP product:
Central console features:
Controls client activations
Pushes data protection policies
Interfaces with the help desk
Acts as a key management facility
Generates alerts and compliance reports.
Endpoint device features:
Encryption management
Device lockouts, i.e. “Poison Pill”
Vendors
Several niche vendors, but just a few market leaders
Trustmark’s current product, Utimaco SafeGuard Enterprise, is now owned by Sophos<br>
slide43. Causes of Security Breaches<br>
slide44. The Mobile Workforce 75% of US workers are mobile; One billion mobile workers worldwide*
12,000 laptop were lost in US airports**; 10,000 cell phones are left in London taxis per month***
62% of mobile devices that were lost or stolen contained sensitive or confidential information**
35% of organizations report that a lost or stolen mobile device caused the data breach they experienced** Sources:
* IDC
** Ponemon Institute
*** The Register<br>
slide45. Data Loss ProtectionSecurity Features Desired security features for a LDP product:
Content-aware
Advanced content inspection and analysis techniques
Ability to define data policies
What data is governed?
How it can be moved outside the network to external media?
Ability take action when a policy violate is detected
Log, block, encrypt, etc.
Can also be triggered based on data quantity
Vendors
Several well-known vendors are considered market leaders<br>
slide46. Mobile Device ManagementSecurity Features Desired security features for a MDM product:
Enforced password
Device wipe
Remote lock
Audit trail/logging
"Jailbreak" detection
Vendors:
Very crowded marketplace, but most vendors are considered niche players<br>
slide47. SEIM Compliance/Security Features Desired compliance/security features for a SEIM product:
Security information management (SIM) — log management and compliance reporting
Security event management (SEM) — real-time monitoring and incident management for security-related events from networks, security devices, systems, and applications
Primary uses:
Compliance — log management and regulatory compliance reporting
External Threat management — real-time monitoring of user activity, data access, and application activity and incident management
Internal Threat Management - authorized user misuses of electronic health records (employee, partners, contractors). Medical record snooping, internal identity theft, internal medical identity theft
Vendors
Many vendors to choose from; healthcare specialized features may limit the field<br>