Data security and the sin of hubris
Hayek wrote in his Nobel lecture – “I confess that I prefer true but imperfect knowledge. . . to a pretence of exact knowledge that is likely to be false.” One of the biggest sins of man is hubris. The Obama administration is guilty of hubris. As an American living outside the US in the […]
The role of DLP in IP protection
A common conversation I have with my technology clients touches on patent protection as a security countermeasure against abuse of intellectual property. The short answer is that if you’re not DuPont or Roche, then patent protection is not going to help you very much. If you develop software , you are probably infringing someone’s patents […]
Data loss prevention for SME
Is a SME like the old German expression – Kleine Kinder kleine Sorgen, große Kinder große Sorgen? “Small children, small problems, big children, big problems”? I wanted to call this post “The need to understand operational risk of information security” – but I realised that op risk is a concept used by big banks and […]
Ethics and data loss prevention
Are we loving the attackers and prosecuting the victims? In data security – I don’t subscribe to utilitarian ethics (which attempts to balance the benefit versus the damage of an act) and can lead to the ends justifying the means. For data security and compliance – I personally implement the “Ten commandments” approach – if […]
Scientific New York Post
I recently saw a great piece of pseudo-science courtesy of Websense describing the cost of data loss and amazing ROI for the Websense Data Security solution. (a friend who studied physics with me used to call this sort of writing “Scientific New York Post”) See Websense white paper ROI of DLP Bruce Schneier correctly notes […]
Designing a data security system
User-Driven Design versus User-Centered design Alan Cooper, in his book The Inmates are Running the Asylum, draws a distinction between user-centered design and user-driven design. User-driven design is about collecting, prioritizing and implementing a system to the user requirements – we’ve all been seen software development projects where the requirements spiraled out of control and […]
Open Access publishing
The GM of a prospect recently asked me how to control disclosure of internal research documents prior to publication. It had come as a revelation to him that anyone can post on a blog without permission from a central secretariat. I asked him how they control face-to-face information exchange with colleagues or competitors outside the […]
Data security case study
A lot of companies do V/A (vulnerability assessments) with scanners like Beyond Security or Nessus. We took a hybrid approach for an internal security assessment using a Fidelis Security Systems network DLP appliance for detecting data loss vulnerabilities and structured human interviews to identify assets and analyze business threats such as competitors who might steal […]
Websense Data Security Suite versus Verdasys Digital Guardian
A client recently asked me to help her compare the two DLP solutions. Here is what I said: Consider business, functional and technical perspectives when comparing Websense Data Security Suite with Verdasys Digital Guardian.
Why do people commit crimes?
The president of a prospect was recently discussing with us whether Oracle IRM (information rights management) was a good way of preventing data loss, and a viable alternative to a DLP (data loss prevention) system. Rights management would appear at first blush to be orthogonal to data loss prevention but it’s an interesting question that […]
