Many managers do not take preventive measures to protect information until data leakage does significant damage to the company. This position can be explained by the desire to save or the unwillingness to tackle the issues. A large number of Russian companies still do not have dedicated information security specialists, charging these functions to other employees as an additional workload. But this trend is gradually waning, especially in the banking sector, where the relevance of the data protection issue has always been very high.

SHARE OF MALICIOUS DATA LEAKS IN BANKS AMOUNTED TO 100%

Ensuring the information security of banks is an extremely urgent problem, the importance of which is ever growing, as appears from the unforgiving statistics. For example, this April the analytical center of InfoWatch presented a report on the data leaks from Russian companies and state institutions published in the media in 2012. In comparison with 2011, the number of incidents has increased about fi ve times, resulting in Russia having occupied the third place in the ranking of the countries with the most adverse data loss situation.

More than 500,000 people in Russia were recognized as persons injured by data leaks. The companies` losses are diffi cult to estimate due to the fact that the number of public incidents is not more than 1-2% of their actual number, while the Russian companies traditionally tend not to disclose the size of the fi nancial loss.

InfoWatch`s analysts point out that the calculation of the losses resulting from the incident should include lost profi ts, cost of remedial actions, litigation costs, compensations, etc. All of this only allows us to estimate the order of numbers approximately. For example, a banking industry organization will attract 20% fewer new customers because of the bank`s image deterioration after the announcement of the fact of the leak. As a result, the damage could be hundreds of millions of rubles in the fi rst year after the incident.

The study notes that 77% of the data leak cases in the Russian companies are classified as malicious, while all over the world their share remains around 50/50. At the same time, the banking sector accounts for an extremely high percentage of the total number of incidents in commercial companies – 34%. The share of malicious data leaks from banks amounted to 100%, that is, according to the fi ndings of the analysts, in all cases information pilfering was committed with the aim of getting profi t. By the way, up to a quarter of all banking leaks in the world occur in the Russian credit institutions.

PERSONAL DATA ARE EASIEST TO LEAK

The InfoWatch`s report notes: in Russia the leading type of the leaked information is personal data (65%), which corresponds to the global trends. The analysts fi nd two main reasons for this situation. First, personal data leakages have kindled lively interest in the society and media lately. Secondly, it is the most abundant way of earning for violators with access to protected information, as such information is highly liquid and can be quickly and successfully sold in the "black" market.

According to the study by InfoWatch, trade secrets leakages accounted for just over a quarter of all cases (26%), while the share of such incidents around the world does not exceed 6%.

The difference in numbers once again underlines the obvious insuffi ciency of the Russian companies` attention to the protection of their secrets, even though it is the disclosure of trade secrets that is causing them the greatest damage.

The study shows that the organizational measures are a data security weakness today. This is indicated by the strong leadership of paper documents as the most popular channel of theft. Nearly a third of information fl ows away through it (28.4%), while the increase in the number of such incidents is characteristic of the whole world.

The overall picture of leaks in Russia corresponds to the trends that were observed in InfoWatch`s global reports 3–5 years ago. However, the analysts note that Russia as a whole has good prospects in terms of information security, on condition of competent adaptation of the BYOD concept by the business community and regulating authorities, as well as elaboration of the organizational data protection methods.

It is no coincidence that it comes to the BYOD concept, which is gaining popularity in our country. Nearly a quarter of companies have switched to the format of the work according to the principle of BYOD (Bring Your Own Device - bring your device to work). In Russia, as in many other countries, the managers' attitude to this approach is quite positive, they believe it a great way to save money, and if they have not yet switched to it, they are at least ready to use it in the future. So the massive use of personal devices in the work is almost inevitable. The main problem of BYOD is the threat to the company's security. The mixing of corporate and personal information makes it impossible to establish a security perimeter, and the risk of the gadget catching a virus is more than the data leakage risks. Therefore, there is a need to speak of competent adaptation of BYOD concept in Russia.

"CLOUDS" AND SOCIAL NETWORKS -CURRENT INFORMATION SECURITY PROBLEMS

One of the major issues in the field of information security is the protection of cloud data storages. The problem here lies not only on the technical, but also on the legal level. Who will be responsible for the leak of information from a "cloud"? The following situation is shaping up: providers do not take responsibility for the data security, while the existing technologies along with the human factor make it possible to extract information from virtually any cloud system.

Another acute problem of the security experts is social networks. If previously the employees of many organizations used to be completely isolated from social networks, now new groups of users who simply need to use additional channels of communication to perform their professional duties begin to appear in most companies. We are primarily talking about sales managers, marketing experts, HR-services and managers. In the banks, where data leakages through social networks are feared, it is reasonable to use DLP-technologies.

ACCESS RIGHTS MANAGEMENT

An extremely important issue in ensuring information security of a financial and credit organization is the management of access rights in particular systems. The bank has a high level of automation and uses several information systems at a time: ERP, CRM, EDMS, e-mail and others. Access to them must be managed. In a large institution a large number of personnel changes is inevitable. In such a situation careful monitoring of information security is required, particularly in what considers the provision of access rights.

Of course, there are regulations in organizations that clearly prescribe the access rights management procedures, but often there are no systems directly dealing with access management. It should not be forgotten that the access coordination procedure can be time consuming.

In addition, the lack of technical means to monitor the compliance of the agreed access with the actually granted one leads to the fact that the information security service employees and administrators need to perform visual checks. And people are just physically unable to perform such work continuously. Between the checks, any attacker can gain access, then cover their tracks, and no one will know that some information was stolen.

According to experts, in this case, preventive measures are the most effective: correct allocation of user rights, monitoring of access events, regular audits and revisions of rights.

It should be noted that access control should be performed not only from within the bank, that is, by the members of the organization, but also on the part of the bank's clients, which complicates the problem greatly.

Optimal from the point of view of outside security is a combination of several access control tools. In particular, the client may use permanent username and password, but confirming their access to the database, for example, by entering a one-time password sent directly to the mobile phone registered with the system.

When making payments using credit cards, it is necessary to ensure their compliance with the relevant security protocols implemented by the payment systems. When using the Internet - it is 3-D Secure technology, and for the base transactions it is the chip embedded in the card.

Of course, the implementation and support of this functionality increases the cost of the services, but ensures maximum protection of the financial interests of both the bank and its customers.