How to prevent private data being disclosed outside of Organization

Question

I'm not looking to secure my internal network
Our company keeps sensitive customer information. How can I prevent this information spreading outside of the company ?
How do big companies prevent to leakage Their information. I seek a comprehensive solution for preventing information leakage.

Answer 1

This encompasses many security and access control practices companies follow. Generally you'll need to do this at many levels at many places. There are a lot of Data Loss Prevention software that can help you prevent information theft. A quick comparison is here.

To quickly answer your question, these are the things you'd normally want to do:

• Remove write access to all media on corporate workstations, which includes USB and optical drives
• Audit emails, both personal and official for attachments. There are software that can help you do this.
  • You can even intercept personal emails (gmail, yahoo) by playing MITM. Yes, companies do that !
• Devise sophisticated snort/sourcefire rules to flag and trigger alerts when anything you think that is proprietary leaves your network.
• No ssh/shell access to internal machines from outside the corporate network (specially internet).
• Ban outgoing ssh, ftp connections as well. Remember banning outgoing traffic to corresponding ports(22, 21) won't help (one can run her home ssh server on port 80).
• Access control: have a solid privileging system in your organization where restricted resources are accessible only to a set of authorized people.

Again this is not comprehensive. Lot of specifics depend on your network/organization/policies. Basically you should spend a lot of focus on minimizing the exposure of sensitive data to a extremely small set of people.

There are a lots of ways data can be infiltrated. Someone can just upload a couple pictures to her picasa album and effectively steal lots of code. No IDS/surveillance will be able to stop that. But proper controls and checks at all places can definitely reduce such occurrences.

Answer 2

If you think about it the question is extremely broad. You're asking how to make sure sensitive data doesn't get outside your network, that's the same as asking how do I protect a network from hackers.

One thing that should be done is encrypt data. That way even if a server/machine is compromised the attacker will only get garbage when viewing the file.

I would monitor network traffic. What do you mean "close USB Port"?

Are you more worried about a malicious outsider hacking into your network or are you asking about employees copying code and taking it home with them, what's the scenario?