A book publishing software implementation project requires that you protect your data conversion data files against theft.
Our company; Kensai International, protectes a client's data by;
1. Backing up the data to hardware encrypted hard-drives. If the computer is turned off or the drive is unplugged the data cannot be accessed until the the drive is reactivated with a password. Even if the drive is stolen and taken apart the data on the drive is protected as the encryption service is built into the drive controller. Which drives do we use? Maxtor Black Armor hard drives. Rugged, reliable and highly secure.
2. PGP is used to create encrypted virtual-disk partitions that can remain locked even when the whole disk is unlocked and automatically revert to the locked state after a specified idle time. Files on the virtual disk are always encrypted (while the disk is unlocked, PGP simply encrypts and decrypts on the fly).
This means that if a hacker managed to breach our hardware firewall and our software firewall they still can't access the publisher's files stored in the locked PGP encrypted-disk partition.
3. Once the client is live and the client has signed off on the project completion all copies of client data files are destroyed using PGP Shredder.
"PGP Shredder completely destroys files and folders so that even file recovery software cannot recover them. Deleting a file using the Windows Recycle Bin does not actually delete it; it sits on the drive and eventually gets overwritten. Until then, it is trivial for an attacker to recover that file. PGP Shredder, in contrast, immediately overwrites files multiple times. This is so effective that even sophisticated disk recovery software cannot recover these files."
If a client wants us to send them a copy of the data files that we worked on; before we destroy our copy, we provide it on a hardware encrypted Black Armor Hard Drive.
FYI: Bertelsmann AG, the owners of Random House, uses the PGP® Encryption Platform to protect confidential data in emails as well as on laptops and file servers.
Showing posts with label IT Security. Show all posts
Showing posts with label IT Security. Show all posts
Wednesday, January 21, 2009
Wednesday, October 31, 2007
IT Security - External Threats #2
One of the biggest threats to security occurs when managers access their corporate systems from remote PCs, which may or may not be secure.
Currently, we are recommeding that employees of our larger clients use an IRONKEY usb flashdrive with hardware security and 128 digit encryption to initiate all remote accesses.
Why?
"It starts with the onboard IronKey Password Manager. As you visit your online sites, the Password Manager will ask you if you want it to remember your usernames and passwords. These are then stored with hardware encryption on the IronKey drive.
When you wish to log back into one of your accounts, the Password Manager compares the website that you are visiting with the website where you originally entered your password. If they match, the Password Manager enters your password for you without you having to type it in. If they do not match, then you may be on a phishing site, and the Password Manager will not enter the password for you.
This gives you simple but effective protection against phishing attacks and spyware that tracks your keystrokes."
Currently, we are recommeding that employees of our larger clients use an IRONKEY usb flashdrive with hardware security and 128 digit encryption to initiate all remote accesses.
Why?
"It starts with the onboard IronKey Password Manager. As you visit your online sites, the Password Manager will ask you if you want it to remember your usernames and passwords. These are then stored with hardware encryption on the IronKey drive.
When you wish to log back into one of your accounts, the Password Manager compares the website that you are visiting with the website where you originally entered your password. If they match, the Password Manager enters your password for you without you having to type it in. If they do not match, then you may be on a phishing site, and the Password Manager will not enter the password for you.
This gives you simple but effective protection against phishing attacks and spyware that tracks your keystrokes."
Tuesday, October 30, 2007
IT Security - External Threats #1
Recently we reviewed the IT security systems for a publisher, who shall remain nameless, that had just undergone an audit by a CPA firm. The CPA firm overlooked a major hole in the publisher's management information system (MIS) security.
In our experience, 95% of security threats are internal (employees of the company) and 5% are external (hackers, viruses and worms).
ERP solutions, that store data in encrypted files are relatively secure against external threats provided that the external threat (i.e. hacker) can't gain access to a user id and password that allows access to the system and the user id that allows access to the ERP software.
At this publisher, we found that although the internal systems were secure managers who accessed the system's web site interface remotely were often doing so via systems that had expired internet security and firewall software or in two cases had turned off the security software on their laptop (as they said that it slowed their internet access).
With the security software on the external laptop turned off or expired, it would have been relatively easy for a hacker - perhaps using keyboard logging software - to obtain a copy of the user's userid and password as he entered it.
IT managers need to review and secure external internet access with an integrated set of policies, procedures, software and hardware designed to protect the company's property and customers.
In our experience, 95% of security threats are internal (employees of the company) and 5% are external (hackers, viruses and worms).
ERP solutions, that store data in encrypted files are relatively secure against external threats provided that the external threat (i.e. hacker) can't gain access to a user id and password that allows access to the system and the user id that allows access to the ERP software.
At this publisher, we found that although the internal systems were secure managers who accessed the system's web site interface remotely were often doing so via systems that had expired internet security and firewall software or in two cases had turned off the security software on their laptop (as they said that it slowed their internet access).
With the security software on the external laptop turned off or expired, it would have been relatively easy for a hacker - perhaps using keyboard logging software - to obtain a copy of the user's userid and password as he entered it.
IT managers need to review and secure external internet access with an integrated set of policies, procedures, software and hardware designed to protect the company's property and customers.
Subscribe to:
Posts (Atom)
Posts
