The Fallacy of the Security No-Man’s Land

Mike Rothman of Dark Reading wrote an interesting piece, which Bruce Schneier echoed last week, arguing that security vendors are focused on the top 1,000 enterprises, leaving the meager mid-sized businesses that live beneath the Security Poverty Line to fend for themselves.  Rothman:

“These folks have a couple hundred to a couple thousand employees. That’s big enough to have real data interesting to attackers, but not big enough to have a dedicated security staff and the resources they need to really protect anything.”

I feel this argument is a tad overstated.  Think about what the No-Man’s Land theory says about the business models of security vendors—that they’re collectively and deliberately ignoring an entire forest full of deer and rabbits with hopes of nabbing a few elephants?  Sounds like a surefire way to starve to death.  (My apologies, vegetarians.)

Rothman really nails it on the head here, though:

“What folks in security no-man’s land need most of all is a security program. They need an adviser to guide them through the program. They need someone to help them prioritize what they need to do right now. ”

YES!  This is the secret sauce. But what makes this exclusive to large enterprises?  Despite not having bespoke security, it’s hard to excuse mid-market companies that don’t go after the low-hanging fruit (sorry, carnivores).

Rothman continues:

“They don’t want or need someone to do everything for them. And they certainly don’t need a shiny object to stop the attack du jour. “

The “blocking and tackling” Rothman calls for something every organization can start doing—large or small.  For unstructured data, Varonis has an entire blog series detailing precisely how companies can implement a security action plan, and Varonis will custom-tailor every step around the resources available.

By focusing on the fundamentals, we’ve seen some mid-market businesses with a few ultra-bright security and operations folks implement more comprehensive and successful IT security programs than Fortune 100s with ostensibly limitless budget and staff.

Image credit: (cc) atoach

Start Sweating the Small Stuff

In his recent New York Times article, “That Daily Shower Can Be a Killer,” renowned geographer Jared Diamond observes how Americans tend to greatly exaggerate risks that are sensational and beyond our control—like plane crashes and nuclear radiation—yet underestimate the mundane, but more common risks that we can control—like slipping in the shower or falling from a ladder.

In my geek-centric mind, I immediately drew a corollary to computer security.   We’ve all met the engineer who will spend weeks obsessing over which password hashing algorithm to use, but fail to implement a solid password policy.

If you find yourself being hyper-paranoid about dangerous, but implausible attacks…stop!  Do a quick risk/frequency gut-check to determine whether you’re wasting time.  You shouldn’t be debating the strength of SHA-256 while your employees are emailing trade secrets to a Nigerian Prince.

XKCD: Security

What are some of the fall-in-the-shower type risks when it comes to data protection?  Our State of Data Protection Report from last year highlights a few:

  • Only 26% of companies are very confident their data is protected
  • 18% weren’t confident at all
  • 23% of companies were not confident or unsure where their critical business data resides
  • 27% of companies did not monitor any access activity on file servers and SharePoint sites
  • 13% of companies never revoke access to data when an employee leaves the organization
  • 61% do not scan their environment for sensitive data

Based on our results, there’s clearly a lot of room to tighten up these fundamental areas of day-to-day risk.  Just as Mr. Diamond’s goal is to reduce life’s common accidents to 1 in 1,000, we should strive to minimize common data security risks, like insider theft, by implementing sound security programs.

Want to learn more about risk analysis?

Here are some good resources:

PCI-DSS: New Mobile Security Guidelines Released

Last week the Payment Card Industry Security Standards Council (PCI  SSC) released an important document on best-practices for mobile payment security. Merchants have been rapidly adopting mobile devices—tablets, smartphones, notebooks, and other consumer gadgetry—as point-of-sale (POS) systems instead of using proprietary solutions. The trend will continue with experts predicting a $1 trillion mobile payment market by 2017. Unfortunately, this new breed of mobile software and hardware is not yet up to PCI-DSS compliance, so the PCI folks came up with a series of guidelines to help merchants and service providers reduce security risks.

For the IT savvy, PCI’s best-practices for mobile will be second nature. Non-tech savvy merchants, though, may mistakenly assume that off-the-shelf payment solutions based around IOS or Android will provide the same level of security and trust as purpose-built environments. That’s not the case. In 2011, PCI SSC agreed not to certify mobile payments until the appropriate standards are developed.

So what can merchants do in the mean time? One of the most important measures they can take is to use approved scanners and readers that encrypt the PAN or credit card information at the point of interaction, so even if the mobile device acting as a reader/scanner is stolen, the personal transaction data won’t be compromised.

In any case, the new guidelines are a good starting point for those looking to secure their systems and reduce the risks of a breach. I’ve listed some of the key points below:

Secure the device

Simply put: make sure the mobile device is in a physically secured location when not in use. As a consumer-level gadget, it’s more open to hacking threats, and one of the easiest is for unauthorized users to get actual access to the device and install malware.

Authenticate users

Employ a PIN, pattern, or password that authorized users must enter to gain device access. Enforce re-authentication after a period of time.

Scan for malware

A key thing for merchants and vendors to remember is that a general purpose mobile computer can run more than just payment software. The PCI SSC guidelines not only recommend that merchants remove non-essential applications, but that they also install anti-malware and anti-virus software, as well as keeping it all up to date!

Prefer online transactions

Don’t store transactions on the mobile device for later transmission. This opens a potential security hole if the device is hacked or stolen.

Monitor logs and reports

Even if a merchant has taken all the steps in the guidelines, it’s still critical to detect for intrusions or other hacking exploits by scanning logs for unusual activity. This would typically be the responsibility of a service provider doing the back-end transaction processing. Merchants should make sure to ask their processors for activity reports or even, if available, real-time alerts.

Image credit: Jkl8850

Email: The Bane and Boon of Modern Communication

Recently, we conducted a survey on digital work habits, specifically around email and its ubiquitous (and overwhelming) role in business communication. The survey results were eye-opening to stay the least. We found that a constantly increasing volume of emails are forcing knowledge workers to allocate significant time and effort to managing their inboxes.

Moreover, we were interested in getting feedback from experts in the productivity arena to learn how our results lined up with email productivity data at-large. When one of the top productivity gurus expressed an interest in writing about our findings; we were more than happy to oblige.

Below is productivity and time management expert Tara Rodden Robinson’s commentary on the Varonis Digital Work Habits Survey findings.

——
Email is both the bane and boon of modern communication. According to a recent report, 144 billion (yes, billion, with a “b”) email messages are sent each day and nearly 70% of that traffic is spam. In a corporate setting, email still provides many benefits: it’s quick, provides documentation and information trails, and it’s convenient. But the continuous inflow, volume, and “leanness” of communication (that is, it’s lack of tone and context) make email one of the most complicated areas of information management in the business environment.

The Varonis survey on digital work habits sought to explore daily volume, how people manage their email, and determine the frequency and severity of email “mistakes” (such as a reply-all goof or forwarding sensitive or offensive materials to the wrong recipient). One of the key contributions of the resulting report was the division of results by job category; this is one of the few studies that offers insight into how C-level executives handle their email. (However, their sample size of C-level respondents was quite small so caution should be used in generalizing from these data.)

Here, I provide a commentary on the report based on my expertise with productivity and time management as well as my experience and background in coaching knowledge workers, including executives. I call out some highlights in the findings, make comparisons with data from other sources, and draw some conclusions.

Highlights From the Report

When a new client comes to me for coaching on time management, one of the first questions I ask is: How many emails do you receive each day? According to the Varonis survey, 67% of respondents received 50 or more emails per day with a small percentage (~5%) receiving more than 300 emails daily. Extrapolated, this amounts to 250 – 500 messages weekly or 1,000 – 2,000 messages per month. This makes it easy to see how an inbox can become inundated quite quickly. If representative, then it’s no wonder when people (sheepishly) report the number of emails stored in their inboxes as in the thousands.

The Varonis survey didn’t ask respondents how many total emails were in their inboxes but only how many “unread” emails there were. The vast majority of employees and managers reported having very few (less than 10 or zero) unread emails (~59% and ~70%, respectively). A small number of respondents claimed to be automating their email management with rules leaving me to surmise that practically every email message received must be reviewed individually in order to mark it as “read.” If, indeed, only 30 minutes are spent on email each day, as was reported, and a respondent receives, say, 100 messages daily, that would require a lightning fast processing time of 18 seconds per message.

When asked how they were processing email, the survey classified respondents into three categories: “filers” who empty their inboxes daily (presumably into some system of folders and deleting the remainder), “hoarders” who never delete anything but file and/or tag some proportion of their messages, “hybrids” who do a combination of filing and hoarding, and those who have “given up” on managing their messages. One might imagine that “filing” would be the most time consuming style, however, 65% of the filers reported spending 30 minutes or less each day on this task. (And I don’t know what to make of the 2.3% of filers who claim to spend “no time” on their email–they must use magic or have minions to do the work for them.)

The data for C-level respondents presented quite a different picture from the other two categories. In stark contrast to employees and managers, half of the C-level respondents report spending 30 minutes or more daily on email management. (The majority “employee” and “manager” respondents (59% and 63%, respectively) claim to spend 30 minutes or less each day on email.) One third of C-level respondents reported spending more than an hour each day on email (compared to 18% and 11%, employees and managers, respectively). Sadly, email management style (filer, hoarder, etc.) by job category was not included in the report. The number of unread emails for C-level executives was quite different from the other two groups as well. All C-level respondents reported having some unread emails (as opposed to a large number of employees and managers who claimed to have none); most C-level respondents had 10 or fewer, roughly 25% had 100 or less, and (gulp) nearly 20% claimed over 20,000 unread messages (one wonders what their boards would think if they knew!).

Comparisons with Data From Other Sources

Similar to the Varonis survey, the Radicati Group reports [pdf] that the average corporate employee receives roughly 60 emails per day. Thus, according to the Radicati Group, a worker processes roughly 100 emails per day (sent and received, together), a distinction that was not explored in the Varonis study.

According to the McKinsey Global Institute (MGI; 2012) report entitled The social economy: Unlocking value and productivity through social technologies, knowledge workers spend an average 28 hours each week (or roughly 5.6 hours per day) “writing emails, searching for information, and collaborating internally.” This includes “28% of work time reading, writing, or responding to e-mail,” which would break down to 13 hours a week (their average work week was 46.5 hours) or approximately 2.6 hours per day. In contrast, only 16.7% of the respondents in the Varonis survey report spending more than one hour per day on email however, the survey asked only about time spent managing email and didn’t specifically examine the time invested in other sorts of email related work.

Conclusions and Recommendations

One key question that is unanswered by the Varonis survey is: “How much of your work (that is, tasks) comes to you as email?” The number of requests that become actionable tasks varies greatly across the corporate landscape. In addition, the ability to delegate also varies from high (at the C-level) to none at all (for many managers and perhaps the majority of employees). Thus, knowing how much work (outside of the actual reading, writing, and managing) email represents would have been extremely useful to know.

In any event, I strongly recommend that workers separate task management from email management. The email inbox makes a very poor task management tool: the constant inflow of new items pushes unfinished work out of sight and messages must be read repeatedly to ascertain what is requested or is actionable. If workers are committed to being reliable and following through on what is requested of them, then the best way to track those commitments is to maintain a task list.

A second, widely reported email headache that went unexplored was the “cc” issue. When speaking to corporate audiences, excessive use of copying others on messages is one of the most vociferous complaints and one of the biggest drivers of volume. Thus, the number of emails received may be decoupled from the amount of actionable task content but messages may still demand a substantial investment of a worker’s time and attention. Surprisingly, a move from email to using social media may be a useful solution.

Luis Suarez, the IBM poster-child for going email-less, has reduced his inflow of email to practically nil and moved the vast majority of his communication to open, social channels. His rationale is that if his communications are openly available, fewer people will need to contact him directly. This reasoning is at the heart of the recommendations of the MGI report as well. By reducing the amount of information “locked up” in people’s inboxes and folders, MGI estimates that email use could be reduced by 25% (although Suarez’s personal experiment suggests individual gains could be much greater). This is an idea with legs: there are indications that numerous corporations are contemplating variations on social media that may reduce the primacy of email.

###

Tara Rodden Robinson, Ph.D., is a productivity and time management expert. As an executive productivity coach, she provides one-on-one and team coaching services as well as speaking and training for corporate audiences. You can follow her on Twitter @TaraRodden or learn more about her by visiting her website: TaraRobinson.com

Data Stewardship in 13 Minutes a Week

Clock

Andrew White, Research VP at Gartner, has a great thesis on data stewardship:

“13 minutes a week – that is how much work your data stewards should be doing.”

That is, in order for data stewardship (or data ownership) to be truly adopted by the business—marketing, HR, finance—the work we require them to do should amount to no more than 13 minutes per week.

This is a terrific goal and it is what we strive for with DataPrivilege.  How do we do it?

  • We make reviews devoid of noise – stewards only see data they care about
  • We make reviews differential – if it hasn’t changed since last review, it doesn’t show up
  • We make reviews inline with normal workflow – a timely email appears in the steward’s inbox with a big link that takes them right to the review; no separate reminders or TODOs needed
  • We make reviews actionable – exceptional items are highlighted and a suggested action is given along with the ability to take the action without leaving the review screen

A significant portion of our operational plan is devoted to finding, assigning, and involving data owners.  But without buy-in from the people who will be doing the work, the plan can’t be executed.  Andrew cuts right to the core of why many businesses have failed at implementing information governance programs: they have effectively dumped an unreasonable and unnecessary amount of work on their stewards’ desks and walked away.

What do you think? Could you sell 13 minutes of work per week in exchange for true information governance, accountability, and data protection?

Image credit: flickr – scjn

Using Varonis: Involving Data Owners – Part II

(This is one entry in a series of posts about the Varonis Operational Plan – a clear path to data governance.  You can find the whole series here.)

Image of pills

If your doctor said “Your blood pressure is 120/95” would that mean anything to you?  Even if you could interpret that data as symptomatic of stage 1 high blood pressure, would it be actionable?  A helpful doctor would not only help you understand your vital stats, she’d also empower you to make informed decisions about your health.

Likewise, not only should we deliver targeted reports to data owners, we should ensure that the information is actionable and provokes intelligent, data-driven decisions.

The next step in the Operational Plan is to help owners make informed decisions about who should have access to their data, and make sure they’re decisions can be executed without bogging anyone down in paperwork. With DataPrivilege we can do exactly that.

Entitlement Reviews

One of the first actions data owners can take is to re-certify access to their data through an attestation, or entitlement review. At a high level, the owner will review the list of users who have access, and users who probably shouldn’t have access to their data, make any appropriate changes, and then commit those changes to file systems or directory services. What has typically been a very manual and time-intensive (for IT) task can be completely automated with DataPrivilege, the internal web-based interface into the Varonis Metadata Framework.

Once configured, DataPrivilege Entitlement Reviews offer automatic, web-based forms delivered on a regular basis that show data owners exactly who has access to their data, highlighting any users that DatAdvantage recommends for removal based on its automated analysis. These recommendations show owners those users who have likely moved on to other roles, left the company, or were added by mistake.  Varonis’ recommendation engine is like the doctor with extremely trustworthy advice on how to immediately improve your health.

These entitlement reviews can be set up for data sets—reviewing the users with access to a specific folder or share—and/or for security groups or mail-enabled distribution lists. This means an organization is able to effectively shift the burden for access reviews for all data to its rightful owner, as well as leverage the same system for application and other group reviews.

Authorization Workflow

While entitlement reviews are key to correcting and maintaining access controls, it’s also important to involve owners at the “point of sale,” when access is initially requested by a user. Traditionally, access control approval has often come from the manager of the requesting user, a group owner that may or may not be aware of what data that group grants access to, or IT rather than the actual Data Owner. This is a problem, since that’s not usually the person who has the best context to make good access control decisions.  To continue our metaphor—it’s like allowing the pharmacy decide which medicine we should take.

DataPrivilege changes this model by offering an authorization workflow that puts decisions into the hands of owners and their designated delegates. A big part of operationalizing DataPrivilege is transitioning this approval process from IT to the end users and owners themselves. It can mean significant operational resource gains for IT as well as a higher level of service and data protection.

Self-Service Portal

The last thing I want to mention about DataPrivilege is the Self-Service Portal, which allows Data Owners to get information and make decisions on-demand. The DataPrivilege portal lets owners see—at any time—information about their data, including permissions, log information and statistics.

We’ve found that many of our customers have seen impressive results once they deploy the portal to their users. If you give owners information about their assets and the ability to make decisions, they tend to use it. The Self-Service Portal is another way IT can shift the management burden to owners themselves.

Empowering owners to implement policy is a great first step, but Data Privilege also offers the ability to automate a lot of this work. The next step in the Varonis Operational Plan involves setting up and deploying automatic rules. Stay tuned!

Image credit: flickr – epsos

Clash of Compliance Cultures: Old vs. New World

In the last few years, US companies have not been shy about expressing their feelings on the EU’s Data Protection Directive (DPD). There’s a major social media player, for example, with a European HQ in Ireland that’s been publicly critical of a proposed “right to be forgotten” rule for letting consumers delete their online data. There’s also a search engine service that, while not openly objecting, is instead suggesting it’s already doing a darn good job of meeting the DPD’s rules.

US companies have begun to learn that the data privacy rules and expectations they’re accustomed to in the US are viewed differently on the other side of the Atlantic. The EU Charter–the European constitution—explicitly lists data protection as a fundamental right. That’s roughly like having a US amendment devoted to encryption, which, at this time, there isn’t.

This is not to say there’s a complete privacy compliance chasm between the US and EU.

Healthcare companies have long had extensive regulatory obligations under HIPAA for securing health information, alerting consumers about breaches, and gaining consent on information transfers. US companies in the banking and credit sectors could point to parallels in Gramm-Leach-Bliley and the Fair Credit Reporting Act.

While US medical and financial companies have had to deal with privacy and security legal burdens, that’s not been the case with the social media players. Because the Data Protection Directive covers all companies collecting data—not just ones in select, albeit important, industries—and through its Safe Harbor treaty it snags US firms as well, it’s not surprising that US Internet-based companies face the most culture shock when conducting business in the EU.

The ultimate issue is that in the new information economy data is revenue, and so deleting it is like, well, burning legacy paper currency.

Besides the right to data erasure differences, another sticking point between US social media companies and the EU is on rules for reasonable data retention limits. But this again reflects mostly differences between old and new economies.  After all, outside the social media world, it’s generally considered good security policy—limiting data breach liabilities—to keep PII data to a minimum and erase it when it’s no longer necessary. For example, the credit card vendors, through their PCI industry standard, emphatically remind corporations with regard to credit card numbers that “if you don’t need it, don’t store it! ”

But new regulatory forces along with changes in consumer attitudes may tilt social media companies towards a European view.

The FTC’s new privacy framework that was published earlier last year—and that I always come back to—calls for minimizing data collection of consumer data and sensible retention limits. There’s a (stalled) bill in the Senate, revealingly entitled “The Commercial Bill of Rights”, which will implement some EU-style data and privacy protections. The bill’s scope, by the way,  covers any company that “collects, uses, transfers, or stores covered information concerning more than 5,000 individuals.”

Good data protection and privacy best practices may one day become as American as espressos and lattes.

Image credit: Paris 16

Is DNA Really Personally Identifiable Information (PII)? No. Maybe? Yes!

Biometric data is at the limits of what current personal data privacy laws consider worthy of protection. This type of identifier covers fingerprints, voiceprints, and facial images. While the risk factors are not nearly as threatening to consumers as more traditional PII, they do exist. Until recently, the dangers of biometric identification using DNA were more theoretical than real. That has suddenly changed. An article in The New York Times last month put a spotlight on research that proved the feasibility of identifying a person—getting a specific name and address—all from a DNA sequence posted online.

It’s not that regulators have overlooked biometric identifiers. Under HIPAA’s safe harbor rules, for example, the Department of Health and Human Services has a list of 18 e-PHIs that would need to be removed from public medical data for it to be effectively considered de-identified. Along with IP addresses, URLs, email addresses, HHS mentions biometric data, with voiceprints and fingerprints given as the only examples.

I’ve already written about how the Federal Trade Commission, another key US agency involved in data privacy regulation, has issued new guidelines to companies collecting facial images. Driving the FTC’s suggestions—mostly directed at retailers—are the recent improvements in image recognition technology and the availability of massive amounts of tagged photos on social media sites. Image matching software is now good enough so that a face captured by a store’s mall kiosk can eventually reveal ethnicity, mood, and with good likelihood, an actual name behind the face.

The risk of linking a name to a set of fingerprints is less serious for the general public— unless you have a criminal record. However, after the Graduate Management Admission Council  (GMAC) began using fingerprints to establish the identity of students taking their “GMATs” for admission to US business schools, the testing company realized there could be privacy issues.

GMAC ultimately decided to use palm scans, which are based on digitizing vein patterns. Since public databases of hand veins don’t exist, the possibility of identification is eliminated.

I would have put DNA into the same category as palm scans: there’s advanced matching technology—available even at the consumer level—but without a public database, there isn’t much of a privacy issue, and therefore DNA is not really a PII.

However, this is not true anymore, and that was the starting point for the researchers mentioned in the Times article. There are actually two public genealogy databases for tracking down one’s ancestry, Ysearch and SMGF, with a combined 135,000 records of DNA data and covering about 39,000 unique last names.

These genealogy databases simply accept a key—actually a pattern on the Y-chromosome—and then return a surname (along with a confidence level). The idea behind these services is to help subscribers find their ancestors and learn more about family backgrounds.

The researchers then examined whether they could narrow down their search. They assumed that they had the state of residency of the subject along with a birthdate—both of these, by the way, are not considered PII under current HIPAA rules. With these three data points and public US Census data, they were able to prove that successful DNA matches would lead to just 12 people on average. That’s a stunning end result from starting with just a DNA pattern.

How good is the DNA “keyword” match at finding a last name? The researchers projected a success rate of 12% for males—since it’s based on the Y chromosome—with a 5% false positive. This is not nearly as accurate as the facial scans, but still a cause for concern. They concluded that the risk of this DNA-based last name search will grow in the future, and there are other scientists and experts who are calling for more public discussion.

I decided to check the privacy policy of one of the DNA testing services. Here’s the good news. They’ll only release your DNA data to third parties with your consent; they treat genetic data as personal data (like name and address), and they say that the genetic data is stored on “secure servers”.

However, thinking purely in term of bytes, folders, and access rights, I’m wondering how truly secure those DNA files are, and whether there are already hackers looking to get that data using the same techniques and exploits they use to snatch credit card numbers and other personally identifiable information.

Image credit: Silky M

HIPAA’s New Rules Reach Far Beyond Healthcare Providers – Are You Impacted?

Two weeks ago, the Department of Health and Human Services (HHS) issued final regulatory rules that place a new group of data processors and third-party consultants directly under HIPAA’s data security compliance regulations.

Some Background

In 2010, HHS issued a “notice of proposed rulemaking”, seeking comments from stakeholders as it worked out updated regulations for HIPAA that had been mandated by Congress.  One of the areas that regulators wanted to resolve was precisely who is subject to HIPAA’s central Security Rule, which defines steps organizations must take to maintain reasonable technical safeguards for electronic protected health information (e-PHIs for short).

The regulators first proposed that “business associates”  handling e-PHI for, say, hospitals or HMOs, would fall directly under HIPAA laws. While not considered a medical provider, they could be still held liable—with civil and criminal penalties—for compliance failures.

Without this type of extension, health organizations could conceivably outsource their data protection obligations to others, and then depending what was in the private contract with the business associate, it would be feasible that no one at all could be held responsible for a breach or other security lapse.

What Has Changed

With the finalized rules (which by the way run over 500 pages) not only do business associates come under HIPAA, but a new class of consultants and subcontractors who perform work on behalf of the business associates also have HIPAA obligations.

In effect, the final rules say that any company that has access to e-PHI is treated just like a hospital or HMO. By the way, HIPAA/HITECH’s Breach Notification Rule, which originally required health companies and their business associates to report e-PHI disclosures, is now extended to medical data subcontractors as well.

The ultimate intent is to close off any holes in security and enforcement when the business associates themselves outsource data processing to others.

HIPAA’s Much Wider Impact

US yearly health care expenditures run over $3 trillion. With an historic shift to digital medical records and new investments in advanced health IT technologies, the final rules will have a major impact on many data processing companies that perhaps would not have considered themselves in the medical business—think of cloud-based providers, analytic services,  and software vendors and resellers.

Lawyers and  health care analysts will, no doubt, be mulling over the new HIPAA rules for months to come. And I’ll have more to say on this in future posts. Need to quickly catch up on HIPAA?  Take a look at our free whitepaper.

Report: Nearly Half of IT Staff Fear Unauthorized Access To Virtual Servers

There are reportedly over 50 million VMs residing on servers.  Varonis surveyed IT staff at VMWorld San Francisco and VMWorld Barcelona in 2012 to answer questions about VM adoption, saturation, use cases, deployment, security and more.

Virtualization yields countless benefits.  Our results show that 76% of respondents use VMs for fast deployment, 74% cite disaster recovery as a driver, and 56% tout easy segregation.

There are many more reasons why virtualization technology is one of greatest leaps in innovation in the past decade.  But have VMs become a black box in terms of security?  Has the plug-n-play nature of virtual machines lead IT to set-it-and-forget-it when it comes to permissions and access control?

Download our full research report to view our findings.

Virtualization and Data Protection

Twitter Feed


    Follow @Varonis on Twitter