In January 2017, Royal & Sun Alliance Insurance PLC joined the growing list of organisations to be fined by the Information Commissioner's Office (ICO) for a breach of the data protection laws that led to the loss of personal information for nearly 60,000 customers
Nick Banks, head of EMEA and APAC for mobile security at Imation, explains what businesses can learn from this security breach:
A £150,000 fine was levied on Royal & Sun Alliance after the theft of a hard drive resulted in the names, addresses and bank account details of 59,592 customers being exposed to the outside world.
While this level of fine is unlikely to dent the pockets of organisations as big as Royal & Sun Alliance, as noted by Mark James, IT Security Specialist at ESET, "the fine itself may seem fairly insignificant but that of course is not the whole story. The PR exposure, your customer hearing about your failings and of course the damage done through the act in the first place, all has a cost."
The sheer size of the data loss makes this case notable, but unfortunately the situation from which the breach arose is not uncommon.
Some organisations choose to combat this issue by blocking the use of portable hard drives and USB memory devices altogether, but these restrictions make it difficult for staff to do their jobs. So, how can organisations keep data secure without harming productivity?
Data protection documents
Save £5 and pay £30 for a year's access to 740 business document templates. Use code SLD7948.S
The security remote control
Features such as remote wipe and remote kill could be part of the solution, and they are growing in prominence as news about data breaches and fines stacks up. It's a process that is far easier to administer nowadays, with Apple offering the Find my iPhone service for the majority of its devices and Google a similar solution for users of its tech.
There are similar solutions for USB drives. Enabling these functions means that as soon as a lost or stolen flash drive is plugged into an internet-connected computer or other device, the flash drive receives a command. This either wipes all data from the USB drive, or completely disables the drive so that it is entirely unusable.
Either way, the data on the device remains protected and a data breach is prevented.
Good for sensitive data
For highly sensitive data, organisations sometimes prefer the security of remote kill because it makes the hard or flash drive useless and prevents all access, even by the people who are authorised.
This technique is particularly useful if you want to prevent an employee from taking data with them when they leave your organisation. Equally, if there happen to be inconsistencies in security procedures elsewhere, remote kill provides a handy extra layer of security.
However, although the principles of remote kill are very simple, the reality can be more technical. Making remote kill 100% effective requires your company to have a policy enforcement server that's accessed each time someone tries to read data from any form of drive.
A precious safety net
Remote wipe and remote kill undoubtedly improve security, but also add an extra layer of complexity to your IT setup. For this reason, these technologies are best suited to high-security environments involving sensitive data.
In organisations that hold banking details, medical records or other highly sensitive data, remote kill and remote wipe act as a form of safety net; they're a way to rescue potentially catastrophic situations.
They should not be used in isolation, though, and there should be many preventative measures to prevent data breaches ahead of this final line of defence. You can start with simple, cost-effective solutions such as proper staff training and encryption.
