生成式知識的安全防禦

Know in depth the CIS Security Control 3 v8, a set of security safeguards to help organizations on data protection, the new changes compared to v7, all the safeguards and how to implement CIS Control 3 effectively.

A brief background about data breaches

IBM and the Ponemon institute released a report on the cost of a data breach in 2022, surveying 550 breaches with data gathered from over 3,600 interviews across 17 countries, and the result was mind-blowing. The results show that the average data breach cost US$4.35 million in 2022, indicating that the figures have further risen from the $4.24 million recorded in 2021.

Every year, IBM statistics for the cost of data breaches indicates that the figures keep rising by at least 2.6 per cent, and numbers are expected to shoot up in the coming years.
However, in the US, the figures and drastically different, as the average cost of a data breach was found to be $9.44M, more than double the global average. Know how is the Data Breach loss cost estimate obtained?

The IBM report also showed the causes of most breaches, with stolen or compromised credentials accounting for 19% of breaches, phishing being responsible for 16%, and Cloud misconfiguration causing 15% of breaches.

It’s essential for organizations to deploy a robust data protection strategy to reduce the possibility of a data breach or data leakage, which often leads to financial loss. The CIS Controls is a collection of the best data and computer security practices to mitigate attacks on cyber systems and networks.

CIS Security Controls v8, Data Protection

The CIS Critical Security Controls (CIS Controls) is a set of security Safeguards to help organizations mitigate the most prevalent cyber-attacks against computer systems and networks. These Controls are improved from time to time to address constantly evolving cyber threats and keep up with modern systems and technologies.

More specifically, CIS Control 3 focuses on ensuring data protection both in storage and when transmitted through data management for mobile devices and computers. The Controls map out processes and techniques to identify, classify, safely handle, retain, and dispose of data in a way that minimizes the risks of a data breach.

It’s no news that an organization’s data is no longer restricted to its borders. Some data are now stored in the cloud, shared with partners, transferred over portable end-user devices, and so on. This diverse handling of data opens it to more risks of attack, making data protection a great concern for organizations.

Although encryption offers a lot of protection to data, it doesn’t offer much help in the face of malicious actors with deep-rooted knowledge of bypassing encrypted data. As a result, organizations need to incorporate a holistic data protection strategy outlined by CIS Control 3 to strengthen their security and mitigate cyber-attacks.

Changes compared to v7 where Data Protection is now the Control 3

CIS Control 3v8 is a comprehensive revision of the 3v7 and contains safeguard updates to improve data security and reduce the risks of a breach. Some of the changes include:

– the addition of Service Provider Management Control: a new control that tackles the sensitivity of data in SaaS platforms, including their storage and processing.

– moving Data Protection from the number 13 spot to number 3 and adding five new Safeguards to this Control. These five new Safeguards are focused on managing and identifying data in a more secure approach to minimize vulnerabilities.

Other changes involved Controls, such as Controls 4,5,6,14, and so on.

What data protection safeguards does CIS Control 3 include?

Below are the safeguards of CIS Control 3

3.1: Establish and Maintain a Data Management Process

Organizations should put in place an effective data management process that handles data sensitivity, ownership, storage, retention, backup, and disposal. The data management process should align with the regulations of your specific organization and be reviewed annually or wherever there’s a major policy change.

3.2: Establish and Maintain a Data Inventory

Your inventory outlines the type of data your organization produces, the degree of sensitivity, and how they’re retained and consumed. Typically, your inventory should reflect both structured data (e.g., data stored in databases) and unstructured data (e.g., documents and photos) to ensure a comprehensive data protection policy.

3.3: Configure Data Access Control Lists

Restricting each user’s access is a crucial part of data security, and each user should only have access to the data, applications, and systems on the organization’s network that they require to do their job. Having access to other than what they need (especially sensitive data) increases the risk of a data breach and security compromise, either deliberately or accidentally.

Regular review of access control lists should be done to detect and swiftly remove any unauthorized permissions that a user has, such as when they move to a new department, branch, or role.

3.4: Enforce Data Retention

Data should have minimum and maximum timeframes to control the extent to which different types of data should be retained. To ensure full compliance, you should consider automating the data retention process so that certain types of data do not stay beyond their expiry period due to forgetfulness.

3.5: Securely Dispose of Data

Whether you need to dispose of data because it’s old and irrelevant or due to standard regulations, ensuring secure disposal is crucial to preventing unauthorized access to the data. You should dispose of data according to their sensitivity, making sure that sensitive data are entirely eliminated in a way that no user can access.

3.6: Encrypt Data on End-User Devices

In certain scenarios, company devices get compromised by internal or external threats. Encrypting data on end-user devices helps prevent data misuse when such scenarios arise, adding an extra layer of security to your organization. Typical examples of encryption tools are Windows BitLocker, Linux dm-crypt, and Apple FileVault.

3.7: Establish and Maintain a Data Classification Scheme

Not all the data in your organization are on the same level. Some are sensitive, while others aren’t. Establishing and maintaining a data classification scheme helps you to distinguish sensitive data from non-sensitive data, so you can provide more protection for sensitive ones. Even non-sensitive data can also be further classified as private or public to enhance data protection.

Organizations should review their data classification scheme annually or whenever there’s a significant policy change.

3.8: Document Data Flows

Organizations should keep tabs on the movement and flow of data in and out of the enterprise in order for timely detection of vulnerabilities that could weaken their cybersecurity. You should review documentation annually and apply necessary updates whenever a significant change that could potentially impact this safeguard occurs.

3.9: Encrypt Data on Removable Media

Organizations should prepare for scenarios of device theft by encrypting the data on external hard drives, flash drives, and other removable media. These devices may also be misplaced and eventually land in the wrong hands, but with encryption, you can rest assured that the data will not be misused or exploited.

3.10: Encrypt Sensitive Data in Transit

Organizations should encrypt critical data in transit to ensure optimal protection wherever the data goes. Popular encryption options for companies are Open Secure Shell (OpenSSH) and Transport Layer Security (TLS). All encryptions must also be adequately authenticated. For example, OpenSSH validates host keys and investigates any connection warnings, while TLS uses valid DNS identifiers with certificates signed by a trusted and valid certification authority.

3.11: Encrypt Sensitive Data At Rest

Sensitive data at rest either on servers, databases, or applications, should be encrypted with at least Storage-layer encryption. Additional encryption methods can be deployed to ensure that only authorized users can view and use the data, even if the storage device gets into the wrong hands.

3.12: Segment Data Processing and Storage Based on Sensitivity

Data processing and storage should be segmented based on data classification to ensure that sensitive data is treated with more caution than less sensitive data. Avoid processing sensitive data on enterprise assets that manage less sensitive data at the same time. Doing this will prevent a hacker from automatically accessing all company data once they gain access to some less sensitive data.

3.13: Deploy a Data Loss Prevention Solution

Data loss protection (DLP) is a powerful automated system for protecting on-site and remote data from accidental loss and exfiltration. The tool identifies all sensitive data processed, stored, or transmitted through enterprise assets and updates the data inventory. Know more about DLP vs IRM here.

3.14: Log Sensitive Data Access

All sensitive data actions should be logged, including access, modification, and disposal, as this is essential for timely detection and response to malicious activity. Post-attack investigations and detection of breach culprits for appropriate accountability also require data access logs to be fully carried out.

How a data-centric security approach can help you to implement CIS Control 3

Organizations deploying data-centric security can better implement CIS Control 3 because their technologies, processes, and policies are concerned with the lifecycle of data, including its location, collection, transfer, storage, and visibility.

Key Elements And Benefits of a Data-Centric Security Approach

The key elements of an effective data-centric security system include the following:

1. Identification, discovery, and classification of sensitive information

An internal or external attacker’s primary target is to access the most sensitive company information since they carry the highest benefits. They may as well go after other data, e.g., regulation data like EU-GDPR, PCI, or others. Often, these data are stored in specific repositories known to only the company’s team; however, they can be shared, putting the data at risk. Organizations interested in implementing data-centric security controls need tools and technologies that help to identify where their data is at all times to prevent unauthorized access. Know the Advantages of Data Classification boosted by AI and Machine Learning.

2. Data-centric protection

Data-centric security controls focus on monitoring and securing an organization’s sensitive information to prevent unauthorized access due to cloud, network, or data leakage. You know where your data is and where it goes while having absolute control over it, regardless of how far it travels.

3. Audit and monitoring of access to data

Organizations must analyze data use and determine if users’ behavioural patterns are within the acceptable standard so as to know the level of risk associated with the data at any time.

4. Administration and management of data policies

Employees come and go, but company data remain relevant at all times. A data-centric security approach allows organizations to determine who should or shouldn’t have access to certain data, depending on their policies. So when you stop collaborating with someone or find out they’re at risk, you immediately revoke access to the data, destroy it, or prevent it from leaving the corporate network.

How can SealPath help?

When it comes to improving your organization’s data protection strategy, SealPath can offer a data-centric security system that effectively monitors your data at rest, in transit, and in use. Thus, regardless of how far your data travels, you are not only aware of its journey, but you still have absolute control over it and can destroy it in case of a breach risk.

SealPath offers you Information Rights Management (IRM) / Enterprise Digital Rights Management (E-DRM) / Enterprise Information Protection and Control (IPC) over all your data, preventing a breach incident.

Information Rights Management (IRM)/Enterprise Digital Rights Management (E-DRM)/Enterprise Information Protection and Control (IPC) solution

The IPC (Information Protection and Control), or IRM / E-DRM (Information Rights Management / Enterprise Digital Rights Management) technologies give you the power to control information wherever they are, even if it’s outside the cloud. It combines identity control + encryption + auditing + remote control and takes them beyond the sphere of traditional encryption.

Some of the capabilities of this technology include the ability to:
• provide protection that travels with the information
• monitor access to information and limit the permissions on the documentation (Only View, Edit, Print, etc.).
• revoke access, no matter where the files are stored

A data-centric approach to security makes protection user-driven or managed by the administrator in order to secure certain folders. In the cloud, folders or documentation repositories are automatically protected by encrypting them in systems with O365, Box, etc.

These technologies can be integrated with classification tools so that classified data within or outside the corporate network or cloud are automatically protected, depending on their level of confidentiality, DLP, or CASB.

5 tools to prevent data exfiltration when sharing files from mobile devices are analyzed to help you take the best steps to protect the business information. Learn how to improve security, make informed decisions and understand the effectiveness of each option based on our more than 10 years of experience helping organizations with their data security.

1. Limitations of secure file sharing from mobile devices

Although we come from a security mindset where everything is perimeter-focused and every action is blocked, the reality is that business professionals often need to share sensitive documents with others. And if they have blocking measures in place, they may even bypass them in order to be productive, agile, and meet business objectives. It is therefore undeniable that the secure sharing of sensitive documents with others is a gap.

And of course, the fastest and most convenient way to share documents is via mobile devices. There may be several reasons for this: not having a PC at hand, not being in a good location to access a PC, or simply not having much time because you are traveling, at a business lunch, or away from the office. But at the same time, you need to send a document right away, you need to share it urgently. We take risks when we send sensitive files without any security measures. We sacrifice security for convenience and speed.

The risks run are not only when storing sensitive documents on the mobile device but also when sharing this information with third parties. Nor do you have any guarantee that the person you send sensitive files to will apply effective security measures to prevent your sensitive information from being exfiltrated. Mobile devices are one of the main risk vectors for companies, where less security is applied, as detailed in this Security Intelligence article.

Therefore, it’s crucial for organizations to recognize that data exfiltration from mobile devices is a far more serious threat than it appears. Businesses must strike a balance between the necessity for mobile productivity and the imperative to protect sensitive data from unauthorized access. Related Article: 9 tools to prevent data theft in your organization.

2. Real-World Use Case

Busy executives traveling

Imagine the life of a busy executive, Sarah, who is always on the move, traveling between cities for high-stakes meetings. One afternoon, while waiting for her next flight in a bustling airport lounge, she receives an urgent message on Microsoft Teams from her company’s internal channel. It’s a sensitive document outlining the latest corporate strategy, meant only for top-tier management.

The urgency of the situation presses Sarah to act swiftly; she contemplates sharing it with a few key colleagues via WhatsApp for immediate input. Unbeknownst to her, this seemingly simple act of convenience could expose the company’s sensitive data to unauthorized access, compromising corporate confidentiality and security.

Sales representatives on the road

Now consider Alex, a dedicated sales representative who spends his days maneuvering through endless hours of travel between client meetings. His effectiveness depends on agility and the ability to instantly respond to clients’ needs.

While on the road, Alex receives a personalized technical guide through Slack, crafted specifically for a high-profile client. Time is of the essence, so Alex decides to forward the guide to the client using Outlook on his smartphone. While his intention is to offer exemplary service, this act of expedience could potentially bypass security protocols and put proprietary company information at risk.

These scenarios underscore the pervasive threat of data exfiltration from mobile devices in the enterprise world. The need for a balance between efficiency and data protection has never been more critical, as data exfiltration incidents can occur at any moment. This highlights the necessity for businesses to establish comprehensive mobile security strategies that safeguard sensitive information, even amidst the constant urgency and demands of corporate operations.

3. File Sharing Options and Tools

Preventing data loss in organizations requires a multifaceted approach, leveraging various tools and methods designed to address specific use cases and contexts. Each tool offers unique strengths and capabilities, aimed at minimizing the risk of data exfiltration and ensuring the secure sharing of files across mobile devices. Let’s take a look at what our options are:

Password Protection

It’s as simple as creating a password for your document or folder with documents and sending that password through another channel to the recipient so that only the person with the password can access it. File encryption tools such as AxCrypt, SecureZIP, or GnuPG are a good option.

Pros:

• Useful for very ocasional sends: It’s useful if you need to send sensitive documents a very small number of times. Password encryption is simple and can be fast.

Cons:

• You have no control over the document: There is a risk that unauthorized persons can access it. Either because the password and file was obtained (or stolen) or because the authorized person shared the password and file with others.
• Manage and remember passwords: It is not safe to send documents always with the same password, so you will have to manage the different ones you create, store them securely and/or remember them.
• It is not an agile method for everyday use: Every time you want to send sensitive documents, you have to create new passwords, store them, and send them securely through a different channel.

Virtual Private Networks (VPNs)

VPNs create a secure tunnel between the user’s device and the internet or a remote network. They provide an encrypted connection. This helps protect data transmitted over public or unsecured networks by ensuring that the data remains private and concealed from unauthorized access or interception. Commonly Used VPN Services are Palo Alto GlobalProtect, Cisco AnyConnect, OpenVPN and NordVPN.

Pros:

• A good choice for securing data in transit: This option is good to make sure that no one intercepts the files while they are being sent, while they are in transit.

Cons:

• The data is not protected once downloaded or at rest: They do not provide protection for data once it has been downloaded. If the recipient does not follow security best practices, the data could still be compromised.

Upload the files to a Repository, Cloud Storage or File Sharing Service

These tools make collaborating easy by allowing users to access files from any Internet-connected device. Commonly Used Services are Google Drive, Dropbox, OneDrive, SharePoint and Box. Users can upload documents, images, or videos to the platform. These files can then be shared with others via direct sharing invitations or private links. To learn more about how to secure business documents in file servers, cloud repositories, or on-premises document storage systems, read this article.

Pros:

• A great choice for collaboration: They are a great way to store files or collaborate on the same document.

Cons:

• It requires that the documents be uploaded first: This is an essential step that can be a hindrance to the user, making them less agile, adding an extra step and taking more time.
• You lose control once they are downloaded: Even if you only give access to authorized people who have to log in, once they download the file, you run the risk of exfiltration again. And it is not always enough to simply allow viewing of documents and block downloads.

Email Encryption Services

Email encryption services are designed to protect the content of email from being read by unauthorized parties. These tools ensure that only the intended recipient can access and read email content by encrypting it during transmission and storage. Commonly Used Email Encryption Services are ProtonMail, Microsoft Purview Message Encryption or Zix. Learn about the 3 common types of encryption in our in-depth article.

Pros:

• This is a good way to send secure e-mails: They are a good option when only sending sensitive documents via email.

Cons:

• It limits the channels of secure communication: Nowadays we communicate through different channels such as Teams, WhatsApp, Slack… Limiting it to email only can present obstacles for users and they may decide to skip it. Or, the conversation with the recipient may be on a different communication channel.
• Large Attachments: Sending very large files as email attachments can be cumbersome and might not be supported by all email encryption services.
• You lose control once they are decrypted: The document is sent securely but once the recipient has decrypted the document and downloaded it, you lose all control over it. You run the risk of it being exfiltrated.

Enterprise Digital Rights Management (DRM) Solutions

The primary purpose of enterprise digital rights management (DRM) solutions is to protect sensitive digital content from unauthorized use and distribution inside and outside an organization. These tools control access, usage, and distribution of digital files, ensuring that only authorized parties can view, edit, or share the content. They enforce protection on the document itself. DRM solutions protect digital content by encrypting files and applying policies that dictate how the content can be accessed and used.

Pros:

• Protection is permanent: It is a good option because it focuses its security and protection on the data itself, accompanying it wherever it goes or travels, in all three data states: at rest, in transit and in use. If you want to know more about the 3 data states, visit our article.

Cons:

• User Frustration with Restrictions: EDRM can lead to user frustration if it interferes with usability or creates a poor user experience.

It is perhaps the most comprehensive and versatile approach to mobile data security because it focuses security on the data. For us, it is the safest way, and we believe so strongly in this technology as a game changer.That is why we have developed an EDRM product specifically for mobile devices. We present it to you below.

4. Introducing SealPath Information Protector App

SealPath is the most advanced EDRM solution that provides persistent protection for documents regardless of how they are stored and shared, and has been in the market for over 10 years. Satisfied with SealPath protection on their PCs and Macs, our customers asked us to bring protection to their mobile phones and tablets. They wanted a flexible yet robust way to protect documents on the go. And it is with this in mind that we present the SealPath Information Protector App, so that they can continue to be productive and agile in their day-to-day work while protecting the information with the highest level of controls.

How does it work SealPath Information Protector App

• 1. Open the File: Open the file within your desired app such as Slack, Outlook, or WhatsApp on your phone or tablet.
• 2. Share the File: Tap on the options menu and select the share option.
• 3. Protect the Document. Inside the SealPath Information Protector App, tap the “Protect Document” button.
• 4. Select Protection Policy: A window will open allowing you to search and select your desired protection policy. You can type the policy name for quick access.
• 5. Final Steps: The app will protect the document. A window will open offering you the choice to either share the protected document via your desired app or save it on your phone or tablet .

Note: The entire process only takes a few seconds to complete.

Secure File Sharing with Real Use Cases

From Teams internal channel to board members via Whatsapp

John, an executive at a multinational company, is traveling for business. While at the airport, he receives a sensitive document containing strategic information through Teams on an internal channel. John needs to share this document with other executives quickly and securely. Using his tablet, he opens the document, taps the share option, and selects the SealPath Information Protector App.

Within the app, he taps “Protect Document” and chooses the “Confidential” policy, ensuring that only a small group of executives have permission to access the document. Once the app protects the document, John shares it via WhatsApp. This process ensures the sensitive information is secure while allowing him to stay productive and efficient.

Receive a document in Slack and email it to a client

Emily, a sales representative, spends most of her time on the road, traveling between client and partner meetings. During a break, she receives a personalized technical guide with important customer details through Slack’s internal channel on her phone. Emily needs to protect this sensitive information before sharing it with the customer.

She opens the document, taps share, and selects SealPath Information Protector App. She then taps “Protect Document” and secures the guide with the appropriate protection policy. After protecting the guide, Emily shares it with the customer via Outlook. This ensures the document is secure, and Emily can maintain her agility and responsiveness, even while on the go.

Key Features of SealPath Information Protector App

• Protect and unprotect from your usual apps: Protect and share in seconds via whatsapp, slack, teams, gmail, google drive, sharepoint, OneDrive, Telegram… You can also unprotect files using the same process.
• Easy and fast: Protecting files is very easy with an intuitive interface, and the process is very fast so it takes very little time.
• You control the data wherever it goes: You have the ability to limit who can access it and what usage permissions they have (edit, view only, print…). You can even block access after the document has been sent and monitor accesses.
• Secure login: To prevent anyone from unprotecting confidential files on your device and to make it more convenient to log in, you can use your fingerprint or face.
• Available for phones and tablets: Available on the App Store and Google Play for iOS 11 or higher and Android 5.0 lollipop or higher.

5. Balance Between Convenience and Security

In the quest to secure mobile document sharing, organizations must weigh convenience against security to select the optimal solutions. It’s crucial to implement tools that secure data without hindering user experience, as overly complicated systems may lead to user workarounds. Key considerations include ensuring robust encryption to protect data at rest and in transit, and implementing user-friendly authentication processes to streamline access without sacrificing security.

Solutions should offer seamless integration with existing applications and workflows to minimize disruption. Real-time monitoring and alerts can help detect and mitigate exfiltration attempts swiftly. Ultimately, the chosen approach should provide strong data protection while maintaining efficiency and productivity, fostering a secure yet convenient environment.