Employees cause most corporate data loss

I remember describing many years ago about the issues of security in the typical data center (or, as we called them back then, server room). Talking to a room of IT managers with their own facilities, more than half were stunned when I talked about physical security as one of the most important aspects of any security system.

I was disturbed to find that almost a third had no type of physical security in place on their servers, or the room in which they were kept. Having visited some of the sites, some of them even showed off their 'datacenter' in glass-fronted rooms in reception to show how big and important their company was. A small proportion of these even let people walk into the room.

Today, I hope, we don't have these situations. I have no problem with allowing people to see your data center (escorted, of course), but allowing unrestricted access, as many of these companies did, means that vast chunks of your software and network security are thrown out of the window. If I can steal your machine, access the hard drive, or even just the console, it doesn't matter how many firewalls you have or whether your systems have token card access. With physical access, all bets are off in terms of getting access to your data.

Of course, there is still one group of users who not only have access to your hardware, but also to your software, and they account for a large proportion of security breaches and losses.

There is no solution to this problem, aside from the one I've been repeating for years - educate your users. Luckily, we have plenty of examples of where carelessness (or callousness) can have a direct effect on individual users. The TJ Maxx data loss, or in the UK the loss of details of every family claiming benefit is something that will resonate with individuals. Explain to them that losing corporate data is akin to giving their credit card details out, and perhaps they would begin to take the issue more seriously.