Data protection solutions showcased in Las Vegas

By Levi Chronister (contact)

Saturday, July 31, 2010 | 2 a.m.

The release of 75,000 documents by WikiLeaks this week about civilian casualties and other incidents during the war in Afghanistan highlights how important data-leakage protection can be for government and corporations.

The companies showcasing their data-leakage protection solutions Thursday and Friday at the Black Hat Technical Security Conference at Caesars Palace might help prevent such leaks in the future.

“Everybody that owns a computer now, frankly, is a lot smarter than they were 10 or 15 years ago,” said Eddie Schwartz, chief security officer of NetWitness. “So the idea of an insider actually doing serious damage or collaborating with amateur organized criminal groups and actually being effective at it is a much higher possibility.”

NetWitness, which this year announced it discovered a Zeus botnet that had infected more than 2,000 computers worldwide, spots security issues by tapping into and recording all network traffic. The product then indexes the traffic on nearly 100 points of metadata for analysis.

Want to know who e-mailed the computer-aided drawings of your latest car designs or internal memos? NetWitness reveals that information in either text-based search results or a visual display that looks similar to the human-gesture-based computer interface in the film “Minority Report.”

“Having the ability to look at it in a traditional, data-mining context or in a data-visualization context is very powerful when you line the two up,” Schwartz said. “I like to call it a whole-brain approach to doing data analytics for network security.”

RSA, the security division of information infrastructure technology developer EMC, also offers data-leakage protection. Major companies such as Cisco and Microsoft use RSA’s accurate network-traffic analytics and programmatic data checks, systems engineer M.J. Knudsen said. RSA isn’t looking just at surface-level data, but also at the data’s location, its use and its related information to weed out false-positive alerts of potential security breaches.

Just because a credit-card number goes out on a network doesn’t mean it’s an instance of information theft.

“We’re also looking to make sure it’s a valid credit-card number,” Knudsen said, “and then looking in the proximity of that credit-card number for corroborating evidence like expiration dates, addresses and CV2 numbers.”

A solution to documents and other information physically leaving a company — such as by being transferred to an external hard drive — must rely on more than the network’s access point to the rest of the Internet. A company best known for providing personal-computer anti-virus and security software for home users has that solution.

McAfee Inc. offers organizations security products that protect the network and each computer on it, tracking sensitive data across an entire network.

McAfee Chief Technology Officer George Kurtz said the company’s software can keep an employee from moving sensitive files to an external hard drive or e-mailing or printing the information, even if it has been copied and pasted out of its original location and into a seemingly innocuous document. With software on each computer in the company, even removing a piece of equipment and taking it to another network won’t circumvent the data-leakage protection.

“The endpoint protection is important,” Kurtz said, “because if someone takes their laptop out of the (office) environment and tries to send (sensitive data), you still want some sort of protection on the laptop itself.

“About the only thing we can’t stop is somebody taking a cell phone and taking a picture” of the data.