isaca kbc 2-12-2010 - copy
DESCRIPTION
Isaca RoundTableNoel VandendriesscheData Loss PreventionTRANSCRIPT
![Page 1: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/1.jpg)
The Weakest Link
Data Loss Prevention in a financial organisation
ISACA
2 December 2010
Noël Van den Driessche, Group ISO KBC
![Page 2: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/2.jpg)
12/04/23 2
This presentation gives an overview of ideas and techniques used in KBC’s Information Risk Management
programme. Opinions and comparisons expressed, represent the author’s thoughts and do not necessarily
refer to official views of KBC.
![Page 3: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/3.jpg)
12/04/23 3
“Endpoints are the highest risks”Aberdeen Group, 2008
![Page 4: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/4.jpg)
12/04/23 4
Pandora’s box?
![Page 5: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/5.jpg)
12/04/23 5
Protect the data?
Or
Control the perimeter?
Your votes please!
![Page 6: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/6.jpg)
12/04/23 6
500 Terabyte of dataonline in data centre
![Page 7: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/7.jpg)
12/04/23 7
Security Theory:
People
Technology
Process
![Page 8: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/8.jpg)
12/04/23 8
1in hands of
right person?
2for necessary
process?
3with acceptedtechnology?
![Page 9: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/9.jpg)
12/04/23 9
![Page 10: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/10.jpg)
12/04/23 10
84leakage channels
![Page 11: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/11.jpg)
12/04/23 11
Risk-ranking the leakage channels
![Page 12: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/12.jpg)
12/04/23 12
![Page 13: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/13.jpg)
12/04/23 13
![Page 14: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/14.jpg)
12/04/23 14
![Page 15: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/15.jpg)
12/04/23 15
![Page 16: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/16.jpg)
12/04/23 16
34 highest-riskleakageareas
![Page 17: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/17.jpg)
12/04/23 17
White ListBlack List
![Page 18: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/18.jpg)
12/04/23 18
“Only use company-approved techniques”
example
![Page 19: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/19.jpg)
12/04/23 19
“Only provide company-approved techniques”
![Page 20: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/20.jpg)
12/04/23 20
Don’t offer staff techniques thatthey can’t use in a secure way
![Page 21: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/21.jpg)
12/04/23 21
Always installbaseline security
![Page 22: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/22.jpg)
12/04/23 22
34 highest-risk leakage areas: 150 baseline security controls
![Page 23: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/23.jpg)
12/04/23 23
![Page 24: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/24.jpg)
12/04/23 24
DLP requirements analysis
![Page 25: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/25.jpg)
12/04/23 25
![Page 26: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/26.jpg)
12/04/23 26
Decisions?At local level
Behaviour?It all dependson users…
![Page 27: Isaca kbc 2-12-2010 - copy](https://reader034.vdocuments.net/reader034/viewer/2022052619/55616b8dd8b42a5f4b8b552d/html5/thumbnails/27.jpg)
Next steps…
12/04/23 27
Next 38 leakage channels: done
User behaviour & Data whereabouts:Scan: data at rest / data at move Education of users
ongoing
Automated user assist tools