Outsourcing has become the order of the day, but alas, many organizations are stepping back, mainly because of security issues. But the good news is that you can outsource and still protect your data when you work with service providers, by following these simple steps
1. A sound security policy
First make sure your organization is in order, before you start outsourcing. Make sure that you have a security policy that is good and at the same time realistic. Your policy should include a data classification that distinguishes between common and sensitive data. The security policy should also include definite standards and guidelines. Finally, ensure that these guidelines have been agreed and finalized by the business managers and information technology professionals in your firm.
2. Select the right vendor
Select a vendor who follows a strict security policy. Make sure that your vendor follows security to the fullest extent. Ensure that your vendor employs security measures that control your data from being copied to portable devices.
3. Least privilege
Your organization must have a method of monitoring material exceptions on your vendors and ensuring the rule of least usage. Ensure that you don’t provide access to all your records at the same time.
4. A strong privacy and intellectual property policy
When you choose your vendor, ensure that your vendor has strong intellectual property protection laws and is willing to abide by your privacy and intellectual property policies. This is very important, as a misunderstanding in this area, can end up as a costly affair.
5. Protect your data
Ensure that the above two issues are addressed, by employing the use of database monitoring gateways and application layer firewalls. With these devices, you can enforce usage policies and prevent privilege abuse and vulnerability exploitation. The best way to ensure the protection of your data is to select a vendor who employs both these functionalities.
6. Leak-proof traffic
Ensure that your service provider monitors outbound Internet traffic and emails for potential information leaks.
7. Provide education on handling data
Ensure that your vendor educates his employees on the ways to handle and safeguard sensitive data. This is very important, as in many cases, there were employees who took the data home and left the data in unencrypted files on their laptop.
8. Application and network security audits
To ensure security, you must conduct regular application/database security audits and network security audits. Audits are important, because they identify issues and potential vulnerabilities with the applications, databases and devices on the network.
9. Are prevention technologies employed?
Find out about the prevention technologies that your vendor uses. Inquire if your vendor has the technology to control data flow. Also ensure, if your vendor’s policies are followed by the employees and if your vendor has the technologies to protect sensitive data from being emailed to other people or copied to removable media.
These steps will help you to minimize the risks of data theft. A good rule to follow when dealing with vendors is to ensure that they have a security system which is as good as yours.
jacobwilliam
Latest posts by jacobwilliam (see all)
- What Obama’s Immigration Plan means for Indian Techies? - November 26, 2014
- Top 5 Outsourcing Risks & How to Avoid Them - August 15, 2014
- 5 Reasons Why Outsourcing is Here to Stay - January 31, 2014
