Controlling Access and Protecting Value
Confidential information is the most common asset that is devalued by a failure in access control. In this case, information is valuable only if it is hidden. If confidential information becomes common knowledge, it ceases to hold special value.
NOTE
It is more effective and less expensive, both in terms of time and money, to prevent a security breach than to fix one after the fact.
Importance of Internal Access Controls
Some information is confidential internally and externally. Salary and benefit information is a classic example of privileged information that must be controlled internally. Certain employees have a right to salary information, while most do not.
For example, a manager might have access to salary information for her direct reports but not for other managers or employees who report to someone else. Implementing internal access controls to regulate which employees have access to confidential information is costly in terms of time and resources, but the risks associated with unauthorized disclosure of that information justify the costs. Unauthorized disclosure of sensitive employee information could cost the company millions in fines and legal fees. There would also be less tangible consequences from lowered morale and resources funneled away from primary business activities into rectifying the root causes of the information breach.
Importance of External Access Controls
Trade secrets and business plans are some of the information that should be secured from external disclosure. You learned earlier in this chapter the consequences of failing to secure that type of confidential information, but it is crucial enough to warrant repeating it. In most cases, the cost (in time and resources) of implementing access controls to protect confidential information is justified by the penalties for failure to do so.
Implementation of Access Controls with Respect to Contractors, Vendors, and Third Parties. It is usually straightforward to implement access controls to safeguard internal information and to control what information is released to the public. When businesses begin to work with contractors, vendors, and other third parties, the access control puzzle gets significantly more complicated.
Access Controls with Respect to Contractors
When outside contractors are hired to provide products or services to an organization, they often require information that could be considered confidential. A good example of this is an external consultant. In many cases, external consultants are either self-employed or employed by a consulting firm and work on an hourly basis for the client company. They are generally highly skilled professionals who are brought in to work on a specific project. When the project is finished, they move on to the next client company. Some client companies hire contractors indefinitely, so in day-to-day practice, they are just like regular employees of the company.
This assumption, that a contractor is “just like a regular employee,” can be useful when building team coherence, but it can also be dangerous. The contractor’s primary alliance is to the consulting company, which provides payment. If a conflict of interest arises between the consulting company and the client company, the contractor is likely to side with the consulting company.
TIP
In addition to NDAs and user access rights, when dealing with outside contractors, it is important to restrict which outside equipment can be used on the corporate network.
Contractors often supply their own laptop computers and other equipment they need to perform their jobs. This can be problematic, because those laptops may or may not have the same security safeguards in place as corporate laptops. To illustrate this risk, consider a programmer who is brought in to create a specific application for a company. One of the terms of the contract states that the contractor will supply his own laptop. The contractor agrees and does the work on his personal system, which he also uses to play online games and download music from various sites. At some point, he downloads a file infected with a virus. Because his virus scanner is out of date, the virus goes undetected and infects his system. When he connects his laptop to the corporate network to view design requirements for the application he is developing, the virus uploads itself and infects the file server, quietly sending information from the file server to the hacker who originally created the virus.
Access Controls with Respect to Vendors
When a company contracts with a vendor to manage confidential information, the client company is responsible for ensuring that the vendor has stringent access controls in place. This is especially true in regulated industries such as health care and finance.
A good example of this scenario is an insurance company that outsources its claims management application to a third-party vendor. The vendor runs the application on its servers, allowing the insurance agents to access it from any browser. This is convenient for the agents, who can submit a claim report directly from the site of the incident. It is also convenient for the insurance company because it no longer has to maintain and update its own servers. Unfortunately, the insurance company is still legally responsible for the information contained within those claims—including personally identifiable and sensitive customer information such as addresses, telephone numbers, and mortgage or auto loan information. If the vendor does not implement stringent access controls to protect those data, the client company is legally responsible for the disclosure as well as the vendor.
NOTE
With the increasing popularity of cloud computing and software-as-a-service (SaaS) applications, vendors are becoming more and more responsible for information that was once strictly controlled internally. Unfortunately, many of these applications are seamlessly integrated with applications that run on corporate servers, so there is a danger of complacency.
The most common way to safeguard confidential information that is processed or stored with a vendor is through contractual obligation. Before a vendor-client agreement can be reached, specific access control requirements should be laid out that describe what the vendor is required to do to safeguard any confidential information received in the course of dealing with the client company.
Access Controls with Respect to Other Third Parties
As business needs evolve, so do the partnerships that meet those needs. In the realm of access control, the key thing to remember is that the owner of the confidential information—the client company—is responsible for ensuring that it is handled securely. If the client company fails to do due diligence and hires a third party without investigating the third party’s access control policies, the client company can be held partly responsible for the inevitable disclosure of confidential information.