Social Media Center

This week at the annual TechEd conference Websense will be showcasing how our Websense DLP technology integrates with the new Dynamic Access Control (DAC) capabilities of Microsoft Windows® 2012.

Built on the foundation of Websense data classification expertise, this collaboration allows organizations to accurately monitor, identify, categorize, and ensure protection and proper use of sensitive information—as it is being authored. This is true, dynamic categorization in action. Here is a video that shows how it works...

Before we begin, I recommended reading Getting Ready For Data Loss Prevention (DLP). Go ahead, I’ll wait for you…

Back? OK, now let’s talk what comes after; the “How” to implement DLP part.

As a next step, and at the risk of blowing my own horn, consider watching the recording of a webcast I did on April 5 here. You’ll get recommendations on how to deal with issues that are often overlooked in DLP deployments as well as some critical “how to” advice. This I position as an antidote to the all-too-common and none-too-helpful “just do it” approach to DLP advice. Because, on the path to DLP success, there are two deadly pitfalls to watch out for: 

The first is in understanding where to start your data protection strategy using DLP (and why). Where to start influences your program’s effectiveness compared to how much risk you are hoping to eliminate from the business.

The second pitfall is in understanding how to execute. The "how" may be the most important  part as it ultimately determines how soon you will benefit from DLP and determines the amount of resources that are required.

Surviving one of the pitfalls is hard enough, but trying to get through both on your own is nearly impossible.

Unfortunately, much of the historical “how” started with massive data-discovery projects, which usually meant at least six-months of project consulting before any data is protected.

Not every DLP vendor has the same vision for how to make DLP work, so make sure that you understand your vendor’s approach and agree with it.

Have a listen and let me know what you think.

Do you think data breaches are up or down in 2011 compared to 2007 or 2008? The official answer may surprise you. According to DatalossDB and the 2011 Data Breach Investigations Report by Verizon, the number of records compromised per year has been decreasing since its 2008 peak. But these reports are missing something very important. It all comes down to what is reported. Last year I met with more than 450 CIOs and CSOs, and almost all of them said that incidents are way up. New breaches are constantly making headlines, so why is there a discrepancy between our perception and what these reports are finding?

Many industry reports focus on the never-ending stream of leaked or stolen personally identifiable information (PII). Most laws and industry standards, such as PCI DSS, also concentrate on PII. But there is something that could be more dangerous to lose than PII and that isn't getting enough attention in data breach reports—intellectual property (IP).

(More)

Credit Union Times recently published an article highlighting First Tech Federal Credit Union’s decision to partner with Websense for data security during a massive merger. During a merger, the risk of losing data increases significantly because huge amounts of sensitive information are moved around. Keeping the data from inadvertently or maliciously getting into the wrong hands is paramount.

Earlier this year, First Tech of Beaverton and Addison Avenue Federal Credit Union completed their consolidation in a massive interstate merger worth $4.75 billion with 38 branches and about 335,000 members across the nation. Websense data loss prevention capabilities were employed to protect more than 55,000 separate merger-related pieces of communications between April and November of 2010, critical to the regulatory needs of the organizations.

“We chose to implement Websense DSS during the merger and beyond, because the technology is well aligned with the growth of our organization,” Phil Romero, Senior Security Architect at First Tech

Addison Avenue Federal Credit Union had already been using Websense Data Security Suite for years prior to the merger. When Addison Avenue faced the decision of which technology to implement during its merger, it chose to expand its use of DSS and purchased six additional appliances to also implement a deeper deployment of Websense Web Security Gateway. Websense now provides First Tech Federal Credit Union the necessary tools to track and control how data is stored and moved over internal and external channels.

“Protecting confidential data during a merger and acquisition is critical to its success. In such transitional times, company files are almost always sent through an organization’s biggest communication channels: Web and email. And that’s when data is at great risk,” Patrick Murray, Websense senior director of product management

Check out our press release on the merger here.

For more information on Websense Web Security Gateway click here.

Bank Systems & Technology recently published an article  highlighting the partnership between Websense and First Tech Federal Credit Union. The article is centered on an interview with Phil Romero, senior security architect at First Tech Federal. Romero discusses how he recently partnered with  Websense to help safeguard data during a recent merger.

At the beginning of this year, First Tech Credit Union finalized a $4.75 billion merger with Addison Avenue Federal Credit Union, creating First Tech Federal Credit Union. This major merger combined a base of 335,000 customers in 38 branches across the United States.  And, protecting the large amount of sensitive data that needed to be exchanged and moved during the consolidation of the two organizations was essential for success.

While Addison Avenue had been using the Websense solution since 2007, First Tech had a different DLP system. Romero stated that he needed a system that was able to “identify and protect moving and static data, and be flexible enough to expand with a growing institution.” In this article, Romero explains how he found the Websense DLP system to be the best for the task.

"I've worked with several different types of DLP systems in the past, and being familiar with their functionality, it was clear that Websense was a robust enough product to really support the needs of the credit union moving forward," he explains. "The ease of management, throughput and performance capabilities, and the scope of visibility of the product itself really addressed all of our current and potentially future needs." – Phillip Romero, First Tech Federal Credit Union

Using the Websense DLP solution, First Tech Federal Credit Union was able to secure both its email and web activity. Romero noted that First Tech Federal Credit Union was able to secure more than 50,000 merger-related emails between April and November of 2010.

"The system is very robust and complete as a product," says Romero. "It has the ability to allow us to fingerprint the kind of information that we have to protect and then implement the control mechanisms to make sure that data stayed secure at all times, even when it left the company."

For more information on the Websense DLP solution, click here.

To read more about the Websense partnership with First Tech Federal Credit Union, check out our press release here.

CBS News TechTalk just published an article questioning the security of smartphone passcodes. Patrik Runald of Websense warns about the serious implications of an unlocked phone in the wrong hands, as smartphones frequently have a massive amount of personal or even corporate information stored on the them.

"Just think about the information you have stored on your phone and what would happen if that information came into the wrong hands… Your emails, your contacts, your calendar, your notes... You might have Twitter and Facebook set to auto-login and now the thief can post public messages in your name." -- Patrik Runald, senior manager of security research at Websense

A 20-year-old NYU student is also noted for a recently completed research project on the most common smartphone passcodes. Nearly 10 percent of the passcodes in his research sample were one of five common combinations: 1234, 0000, 2580, 1111 and 5555.

Bottom line: don’t make your PIN something easy to remember or guess. It might seem obvious, but it’s better to be safe than sorry. Proper passcodes are just the first step in smartphone security, but one you must get right.

 For more information from the WebsenseSecurity Labs™ click here. Read more about securing company mobile phones here.

Websense Positioned as a Leader in Magic Quadrant for Secure Web Gateway

Websense also positioned as a leader in the Magic Quadrant for Content-Aware Data Loss Prevention

SAN DIEGO, June 8, 2011 - In 2010, 52 percent of data-stealing attacks were conducted over the web(i) and 2011 doesn't look any safer. To stop targeted attacks and advanced persistent threats (APTs), organizations need new security strategies. Their content security needs to examine-in real time-the substance of each website and email. Traditional endpoint and network security products are no longer sufficient. That's why Websense, Inc. (NASDAQ: WBSN) developed the TRITON^TM solution, including the Websense® Web Security Gateway. And today, Websense announced that Gartner, Inc. has positioned Websense as a leader in its recently released "Magic Quadrant for Secure Web Gateway."(ii)

Last week, Patrik Runald joined CBC’s Lang & O’Leary Exchange to discuss the recent surge in Canadian cybercrime. In the segment, Runald answers a series of questions on why this escalation is happening. He explains how the increase is not an accident, but rather a calculated, organized move. To avoid the severe scrutiny of security software that IP addresses in China and Eastern Europe experience, cybercriminals are moving their networks to countries like Canada that have better cyber reputations. Canadian infrastructure is being used to attack users worldwide. As a result, in the past year alone, Canada has seen a 319 percent jump in servers hosting phishing sites, a 53 percent increase in bot networks, and is now number six in the world for hosting cybercrime.

The numbers are continuously rising, and attacks are growing increasingly more advanced. Read more about the threats here. Watch the full interview here.

How many letters have you received? You know what I’m talking about. Let’s talk data breaches. Let’s avoid the hype of the headlines and some of the sensationalism of the media coverage. And look at a few facts from recent episodes to see if we can identify the root issue at the heart of the breaches.

I’ve already posted a first glance look at the Epsilon breach, but, let’s talk about this in a little more detail. There are three critical elements that need to be addressed here.

1.       The business imperatives that lead to this episode

2.       Why most organizations aren’t currently equipped to prevent such breaches

3.       What companies need to do to protect themselves from third part breaches

This week, I am doing two presentations at CSO Perspectives 2011. I look forward to sharing the stage with two dynamic CSOs who have deep experience securing their enterprises from every attack imaginable. And they both have their own views on how to deal with a fast-paced threat environment in ”organizations without borders.”

Jerry Archer is the Senior Vice President and Chief Security Officer for Sallie Mae. We’re going to talk about what Angelina Jolie has to do with data loss prevention. Sounds interesting, right? But Jerry and I have been talking about doing this talk for some time now.   It will be a great discussion.

Infoexecutive Canada just released a new article that features Websense’s very own David Meizlik in highlighting Websense® TRITON ™ as the first of its kind in the security product market.  The article draws attention to the necessity of maximum flexibility in security products used by all types of customers so that they can have full license to use all Websense Web, Email, and Data Security solution modules “however, wherever and whenever they need.”