This article explains security issue warnings displayed in WebSafetica.
Security issues simply and comprehensibly describe company security status and data flow in specific communication channels. Security issues and related recommendations are based on what data has been monitored in a company environment, what employee activities have been logged and what security rules have been set in Safetica. If security issues are not handled properly, they may pose a threat to sensitive data and company workspace.
Security issues warnings are available from Safetica 9.0. They are visible in WebSafetica and Security Audit report.
How do security issues look like?
Security issues are color-coded accordingly to their status as follows:
Unresolved security issue - colored in red
Any unresolved security issue poses a risk to a company and immediate attention should be paid to that. For example, a security issue may arise in situations when there are insufficient or completely missing security policies in place to prevent leakage of sensitive data.
Example: 10 sensitive data files have been sent from your company by webmail services, which are not controlled by any security policy.
Treated security issue - colored in green
If security measures are sufficient then a security issue is labeled as treated. However, continuous attention should be paid to the situation and it should be regularly checked that the security settings are reflecting the company's current requirements.
Example: You have set security policies for webmail services and defined where sensitive files can be uploaded.
Hidden security issue - colored in grey
A security issue which company treats by different security tools can be hidden. This way only unresolved issues will appear and admin can focus on other important problems. Previously hidden issues can be again restored.
Example: 10 sensitive data files have been sent from your company by webmail services, which are not controlled by a security policy.
What are the types of security issues and how to treat them?
Security issues cover a number of areas, below are some of them.
Elementary measures are missing
The recommended basic measures include setting up immediate warnings or regular e-mail alerts. If a security incident occurs, a quick response through immediate warnings is important to minimize negative impacts. Responsible persons can therefore immediately deal with a risky issue. Also, a regular review of the company's security status via regular reports is an important part of the overall security strategy.
To improve your company's security, we recommend the following:
- Set instant email alerts for any security incidents you want to track.
- Check that the instant warnings are up-to-date and addressed to responsible persons.
- Set automated reports to all relevant areas.
- Check that the reports are up-to-date and are addressed to the responsible persons.
You can find out how to set up an immediate warning or regular e-mail reports in the Safetica documentation.
Missing identification of sensitive company data
Without understanding what company sensitive data are, it is not possible to create an effective security policies and prevent sensitive data leaks.
To determine what sensitive company data is, we recommend the following:
- Check the files that employees are working with and identify sensitive data.
- Evaluate which files are leaving your company via individual channels. Check if files should be categorized as sensitive.
More information on how to identify sensitive company data can be found in the Safetica documentation.
Missing protection for a communication channel where sensitive data flow
Sensitive data can leave company through various communication channels such as USB flash drives, e-mail messages with attachments, websites, cloud storage, and others. Each communication channel represents a specific risk to your sensitive files and therefore, it is necessary to treat all communication channels. One of the most common methods of data leakage is, for example, transferring large volumes of sensitive files to a USB flash drive. It's a very easy and fast way for a company to lose control of its data. Subsequent loss or theft of a USB flash drive will result in critical data getting into the wrong hands.
To treat communication channels, we recommend the following:
- Determine and check which communication channel is suitable for transmitting sensitive data.
- Restrict or disable other communication channels to transfer sensitive data using DLP policies.
- Determine trusted target locations for sensitive data.
- View alerts sent to employees if sensitive files leak out via non-authorized channel.
- Set up email alerts, triggered by copying of large amount of files.
- Provide employee training, on standard security procedures when working with sensitive data.
Please refer to the Safetica documentation in order to set up DLP policies, restrict inappropriate channels, or create alerts.
Lack of restrictions for high-risk applications or websites
Understanding which applications or websites employees visit, helps companies to discover security risks and where to improve user productivity.
To reduce high-risk employee activities, we recommend the following:
- Set policies for applications and websites to prevent the use of risky or dangerous websites and applications.
- Set up regular automated reports on used applications and visited websites
- Check which applications and websites are being used. Evaluate if the categories of websites need editing.
How to reduce risky applications and websites can be found in the Safetica documentation.