Category Archives: Data Security

[Podcast] How Diversity & Inclusion Drives Innovation and Market Growth

[Podcast] How Diversity & Inclusion Drives Innovation and Market Growth


In part two of my interview with Allison F. Avery, a Senior Diversity & Inclusion Specialist at NYU Langone Medical Center, she clarified common misconceptions about Diversity & Inclusion (D&I) and offered a framework and methodology to implement D&I. She reminded me, “You should not be doing diversity for diversity sake.”

I’ve put together a few interview highlights below. By the way – they’re perfect for cutting-and-pasting into an email to your company’s HR executives and other C-levels!

On Recruitment Practices: Hire for Diversity or Skillset?

I’m going to challenge your question because thinking in that way dichotomizes two very critical ideas. It feeds into this mythology that diversity is lowering standards or is a compromise.

If a candidate has potential, capacity, ability and aptitude to learn new skills and someone you want to invest in – hire her. Don’t just look at people that have the hard skills today. Business climates are always changing and you need someone who is flexible to those changes. If you just look at just diversity or just skill, that’s not the model you would want.

On the Benefits of Diversity & Inclusion

If you truly understand Diversity & Inclusion appropriately, and know the actual benefits – i.e. better financial gains, better product and software development, new niche markets developed, greater capacity, enhanced creativity, better innovation. When you really understand that, it benefits everyone.

Albeit – it might make things more challenging. Because the more diversity, the more challenging things are and you have to work a little bit harder. But it really should pay dividends, make your company more lucrative, and the people who work there would and should benefit from that.

Embed this infographic on your own site – copy and paste the code below:

<a href="https://blog.varonis.com/how-infosec-can-implement-diversity-inclusion-programs-to-address-workforce-shortage-and-make-more-money-too/"><img title="Diversity & Inclusion with Allison F. Avery - Infographic" src="https://blog.varonis.com/wp-content/uploads/2015/10/diversity.png" alt="Diversity & Inclusion with Allison F. Avery - Infographic" width="650" /></a>

diversity & inclusion

Practical Powershell For IT Security, Part II: File Access Analytics (FAA)

Practical Powershell For IT Security, Part II: File Access Analytics (FAA)

In working on this series, I almost feel that with PowerShell we have technology that somehow time-traveled back from the future. Remember on Star Trek – the original of course — when the Enterprise’s CTO, Mr. Spock, was looking into his visor while scanning parsecs of space? The truth is Spock was gazing at the output of a Starfleet-approved PowerShell script.

Tricorders? Also powered by PowerShell.

Yes, I’m a fan of PowerShell, and boldly going where no blogger has gone before. For someone who’s been raised on bare-bones Linux shell languages, PowerShell looks like super-advanced technology. Part of PowerShell’s high-tech prowess is its ability, as I mentioned in the previous post, to monitor low-level OS events, like file updates.

A Closer Look at Register-WmiEvent

Let’s return to the amazing one-line of file monitoring PS code I introduced last time.

Register-WmiEvent -Query "SELECT * FROM __InstanceModificationEvent WITHIN 5 WHERE TargetInstance ISA 'CIM_DataFile' and TargetInstance.Path = '\\Users\\bob\\' and targetInstance.Drive = 'C:' and (targetInstance.Extension = 'doc' or targetInstance.Extension = 'txt)' and targetInstance.LastAccessed > '$($cur)' " -sourceIdentifier "Accessor" -Action $action

As you might have guessed, the logic on what to monitor is buried in the WQL contained in Register-WmiEvent’s query parameter.

You’ll recall that WQL allows scripters to retrieve information about Windows system events in general and, specifically in our case, file events – files created, updated, or deleted.  With this query, I’m effectively pulling out of Windows darker depths file modification events that are organized as a CIM_DataFile class.

WQL allows me to set the drive and folder I’m interested in searching — that would be the Drive and Path properties that I reference above.

Though I’m not allowed to use a wild card search — it’s a feature, not a bug — I can instead search for specific file extensions. My goal in developing the script for this post is to help IT security spot excessive activity on readable files.  So I set up a logical condition to search for files with “doc” or “txt” extensions. Makes sense, right?

Now for the somewhat subtle part.

I’d like to collect file events generated by anyone accessing a file, including those who just read a Microsoft Word documents without making changes.

Can that be done?

When we review a file list in Windows Explorer, we’re all familiar with the “Date Modified” field. But did you know there’s also a “Date Accessed” field? Every time you read a file in Windows, this field is, in theory, updated with the current time stamp. You can discover this for yourself—see below—by clicking on the column heads and enabling the access field.

However, in practice, Windows machines aren’t typically configured to update this internal field when a file is just accessed—i.e., read, but not modified. Microsoft says it will slow down performance. But let’s throw caution to the wind.

To configure Windows to always update the file access time, you use the underappreciated fsutil utility (you’ll need admin access) with the following parameters: 

fsutil set behavior disablelastaccess 0

With file access events now configured in my test environment, I’ve now enabled Windows to also record read-only events.

My final search criteria in the above WQL should make sense:

targetInstance.LastAccessed > '$($cur)'

It says that I’m only interested in file events in which file access has occurred after the Register-WmiEvent is launched. The $cur variable, by the way is assigned the current time pulled from the Get-Date cmdlet.

File Access Analytics (FAA)

We’ve gotten through the WQL, so let’s continue with the remaining parameters in Register-WmiEvent.

SourceIdentifer allows you to name an event. Naming things – people, tabby cats, and terriers—is always a good practice since you can call them when you need ‘em.

And it holds just as true for events! There are few cmdlets that require this identifier. For starters, Unregister-Event for removing a given event subscription, Get-Event for letting you review all the events that are queued, Remove-Event for erasing current events in the queue, and finally Wait-Event for doing an explicit synchronous wait. We’ll be using some of these cmdlets in the completed code.

I now have the core of my script worked out.

That leaves the Action parameter. Since Register-WmiEvent responds asynchronously to events, it needs some code to handle the response to the triggering event, and that’s where the action, so to speak is: in a block of PowerShell code that’s passed in.

This leads to what I really want to accomplish with my script, and so I’m forced to reveal my grand scheme to take over the User Behavior Analytics world with a few lines of PowerShell code.

Here’s the plan: This PS script will monitor file access event rates, compare it to a baseline, and decide whether the event rates fall into an abnormal range, which could indicate possible hacking. If this threshold is reached, I’ll display an amazing dashboard showing the recent activity.

In other words, I’ll have a threat monitor alert system that will spot unusual activity against text files in a specific directory.

Will Powershell Put Security Solutions Out of Business?

No, Varonis doesn’t have anything to worry about, for a few reasons.

One, event monitoring is not really something Windows does efficiently. Microsoft in fact warns that turning on last access file updates through fsutil adds system overhead. In addition, Register-WmiEvent makes the internal event flywheels spin faster: I came across some comments saying the cmdlet may cause the system to slow down.

Two, I’ve noticed that this isn’t real-time or near real-time monitoring: there’s a lag in receiving file events, running up to 30 minutes or longer. At least, that was my experience running the scripts on my AWS virtual machine. Maybe you’ll do better on your dedicated machine, but I don’t think Microsoft is making any kind of promises here.

Three, try as I might, I was unable to connect a file modification event to the user of the app that was causing the event. In other words, I know a file even has occurred, but alas it doesn’t seem to be possible with Register-WMIEvent to know who caused it.

So I’m left with a script that can monitor file access but without assigning attribution. Hmmm …  let’s create a new security monitoring category, called File Access Analytics (FAA), which captures what I’m doing. Are you listening Gartner?

The larger point, of course, is that User Behavior Analytics (UBA) is a far better way to spot threats because user-specific activity contains the interesting information. My far less granular FAA, while useful, can’t reliably pinpoint the bad behaviors since it aggregates events over many users.

However, for small companies and with a few account logged on, FAA may be just enough. I can see an admin using the scripts when she suspects a user who is spending too much time poking around a directory with sensitive data. And there are some honeypot possibilities with this code as well.

And even if my script doesn’t quite do the job, the even larger point is that understanding the complexities of dealing with Windows events using PowerShell (or other language you use) will make you, ahem, appreciate enterprise-class solutions.

We’re now ready to gaze upon the action block of my Register-WmiEvent:

Yes, I do audit logging by using the Out-File cmdlet to write a time-stamped entry for each access. And I detect bursty file access hits over 15-minute intervals, comparing the event counts against a baseline that’s held in the $Global:baseline array.

I got a little fancy here, and set up mythical average event counts in baseline for each day of the week, dividing the day into three eight hour periods. When the burst activity in a given period falls at the far end of the “tail” of the bell curve, we can assume we’ve spotted a threat.

The FAA Dashboard

With the bursty event data held in $Global:evarray (files accessed with timestamps), I decided that it would be a great idea to display it as a spiffy dashboard. But rather than holding up the code in the action block, I “queued” up this data on its own event, which can be handled by a separate app.

Whaaat?

Let me try to explain. This is where the New-Event cmdlet comes into play at the end of the action block above. It simply allows me to asynchronously ping another app or script, thereby not tying down the action code block so it can then handle the next file access event.

I’ll present the full code for my FAA PowerShell script in the next post.  For now, I’ll just say that I set up a Wait-Event cmdlet whose sole purpose is to pick up these burst events and then funnel the output into a beautiful table, courtesy of Out-GridView.

Here’s the end result that will pop on an admin’s console:

Impressive in its own way considering the whole FAA “platform” was accomplished in about 60 lines of PS code.

We’ve covered a lot of ground, so let’s call it a day.

We’ll talk more about the full FAA script in the next time, and then we’ll start looking into the awesome hidden content classification possibilities of PowerShell.

 

[Podcast] When Our Reality Becomes What the Data Says

[Podcast] When Our Reality Becomes What the Data Says

In our “always-on” society, it’s important that our conversation on IoT security continues with the question of data ownership.

It’s making its way back into the limelight when Amazon, with the defendant’s permission, handed over user data in a trial.

Or what about that new software that captures all the angles from your face to build your security profile? Your face is such an intimate aspect to who you are, should we reduce that intimacy down to a data point?

I discussed these questions with this week’s Inside Out Security Show panel – Forrest Temple, Kilian Englert and Mike Buckbee.

Additional articles we discussed:

  • Leaked data tranche of 8,700 documents purportedly includes tools that turn smart TVs into covert surveillance devices.
  • Spammers expose their entire operation through bad backups
  • Inside the TalkTalk ‘Indian scam call centre
  • A sysadmin told the courts he was authorized to trash his employer’s network
  • Google accidentally spreads fake news

 

Varonis Cited by Forrester for Data Classification Capabilities

Varonis Cited by Forrester for Data Classification Capabilities

When I signed up for home insurance, I remember filling out a worksheet that forced me to catalog all the important, expensive and irreplaceable items within the property so we could make an accurate prediction of the costs to replace them if something were to happen, like theft or arson.

This is similar to the same kind of analysis organizations should be doing with their data. Asking ourselves: What information am I storing? Where is it? Does it fall within regulatory compliance?

This kind of data classification is an important activity every organization must undertake to meet regulatory compliance and protect their data. A February 2017 Forrester reporter, Market Overview: Data Classification For Security And Privacy, states, “Data classification is a core component of defining and understanding data that security and risk (S&R) pros must protect, as well as identifying the way employees should handle it and the types of security controls that are necessary.”

In other words, organizations cannot protect what they don’t know they have.

Within this report, Forrester cites Varonis as among vendors that “have data classification capabilities in addition to data discovery and remediation capabilities.”

The Varonis Data Security Platform (DSP) analyzes and profiles user roles, file systems and email activity, permissions, file content and directory service information. The automated classification capabilities within the platform combine these metadata streams and results from other classification solutions for increased visibility into the content of data. Classification information enables actionable intelligence for data security and compliance, including a prioritized list of folders with the most exposed permissions and containing the most sensitive data, access points to that data, users and owners, and effectively setting access limitations without disrupting business processes.

Data classification is a critical step for security and risk professionals in defining and understanding how to protect sensitive data. The report gives guidance on why data classification should maintain a priority spot in an organization’s security budget, “Although targeted attacks may be the new norm, a reactive approach to security is inefficient and ineffective. You still need an actual security strategy — and knowing what it is that you’re trying to protect — as the foundation for your efforts.”

However, many organizations are still too focused on responding to threats and don’t properly understand or control sensitive data. In fact, the January 2017 Forrester Consulting study commissioned by Varonis, “The Data Security Money Pit: Expense In Depth Hinders Maturity,” found that 62% of respondents have no idea where their most sensitive unstructured data resides. Understanding what is considered sensitive, or toxic, data lends insight and context for developing controls and policies for data awareness and proper data handling.

The Market Overview found that 54% of global client security decision-makers have implemented a data classification solution, and an additional 22% plan do so in the next year. As more organizations recognize the need to boost data awareness, solutions like the Varonis DSP can give security professionals confidence in their systems and build a foundation for data security and privacy.

Find out where your sensitive data lives, take a free risk assessment to experience the automated classification solution within the Varonis DSP.

Varonis eBook: Pen Testing Active Directory Environments

Varonis eBook: Pen Testing Active Directory Environments

You may have been following our series of posts on pen testing Active Directory environments and learned about the awesome powers of PowerView. No doubt you were wowed by our cliffhanger ending — spoiler alert — where we applied graph theory to find the derivative admin!

Or maybe you tuned in late, saw this post, and binge read the whole thing during snow storm Nemo.

In any case, we know from the many emails we received that you demanded a better ‘long-form’ content experience. After all, who’d want to read about finding hackable vulnerabilities using Active Directory while being forced to click six-times to access the entire series?

We listened!

Thanks to the miracle of PDF technology, we’ve compressed the entire series into an easy-to-ready, comfy ebook format. Best of all, you can scroll through the entire contents without having to touch messy hyperlinks.

Download the Varonis Pen Testing Active Directory Environments ebook, and enjoy click-free reading today!

[Podcast] How Infosec Can Implement Diversity & Inclusion Programs to Address Workforce Shortage and Make More Money Too

[Podcast] How Infosec Can Implement Diversity & Inclusion Programs to Address Workforce Shortage and Make More Money Too

Data breaches keep on happening, information security professionals are in demand more than ever. Did you know  that there is currently a shortage of one million infosec pros worldwide? But the solution to this “man-power” shortage may be right in front of and around us. Many believe we can find more qualified workers by investing in Diversity & Inclusion programs.

According to Angela Knox, Engineering Director at Cloudmark, “We’re missing out on 50% of the population if we don’t let them [women] know about the job.”

For skeptics: creating a more diverse workplace isn’t about window dressing. It makes your company more profitable, notes Ed Lazowska, a Professor of Computer Science and Engineering at the University of Washington-Seattle. “Engineering (particularly of software) is a hugely creative endeavor. Greater diversity — more points of view — yields a better result.”

According to research from Center of Talent Innovation, companies with a diverse management and workforce are 45 percent more likely to report growing market share, and 70 percent likelier to report that their companies captured a new market.

I wanted to learn more about the benefits of a D&I program, and especially how to create a successful one. So I called Allison F. Avery, Senior Organizational Development & Diversity Excellence Specialist at NYU Langone Medical Center, to get the details from a pro.

She is responsible for providing organizational development consultation regarding issues such as diversity and inclusion, performance improvement, workforce engagement, leadership development, and conflict resolution.

In part one of our interview, Ms. Avery sets the foundation for us by describing what a successful diversity & inclusion program looks like, explaining unconscious bias and her thoughts on hiring based on one’s social network.

And next week, we cover hiring for skill set or diversity (the short answer: neither), hard skills versus soft skills, and how to create a successful diversity & inclusion program.

 

[Podcast] Security Courts the Internet of Things

[Podcast] Security Courts the Internet of Things


As more physical devices connect to the internet, I wondered about the responsibility IoT manufacturers have in building strong security systems within devices they create. There’s nothing like a lapse in security that could potentially halt the growth of a business or bring more cybersecurity awareness to a board.

I discussed these matters with this week’s Inside Out Security Show panel – Forrest Temple, Kilian Englert and Mike Buckbee.

First in line to be discussed was the shocking revelation that while car manufacturers enabled users to control their vehicles with an app, they never thought through what happens when it’s sold. What’s the harm? In the words of the car owner, “If I were a criminal, I could’ve stolen the car.”

In another alarming article, a security researcher recently discovered that anyone can connect and control a cuddly CloudPets via Bluetooth, recording private conversations with the built-in microphone. If you’re a parent who finds this IoT toy a cute way to leave messages with your child, your privacy may be at stake.

Additional recent news articles we discussed include:

Tool of the week: Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures.

 

[Podcast] More Scout Brody: Bringing Design Thinking to IoT

[Podcast] More Scout Brody: Bringing Design Thinking to IoT


By now, we’ve all seen the wildly popular internet of things devices flourish in pop culture, holding much promise and potential for improving our lives. One aspect that we haven’t seen are IoT devices that not connected to the internet.

In our follow-up discussion, this was the vision Simply Secure‘s executive director Scout Brody advocates, as current IoT devices don’t have a strong foundation in security.

She points out that we should consider why putting a full internet stack on a new IoT device will help users as well as the benefits of bringing design thinking when creating IoT devices.

 

[Podcast] Proper Breach Notification

[Podcast] Proper Breach Notification

I recently came across an article that gave me pause, “Why Data Breaches Don’t Hurt Stock Prices.” If that’s the case and if a breach doesn’t impact the sale of a company, does security matter?

So I asked the Inside Out Security Panel – Forrest Temple, Mike Buckbee and Kilian Englert.

They gently reminded me that there’s more than just the stock price to look at – brand, trust, as well as pending lawsuits.

In addition to these worries, proper breach notification is becoming a bigger responsibility. Is there a good or bad way to notify others about a breach? We discussed a controversial way a vendor disclosed their breach as well as some of the top stories of the week:

Tool of the week: Netflix Stethoscope

 

 

 

G’Day, Australia Approves Breach Notification Rule

G’Day, Australia Approves Breach Notification Rule

Last month, Australia finally amended its Privacy Act to now require breach notification. This proposed legislative change has been kicking around the Federal Government for a few years. Our attorney friends at Hogan Lovells have a nice summary of the new rule.

The good news here is that Australia defines a breach broadly enough to include both unauthorized disclosure and access of personal information. Like the GDPR, Australia also considers personal data to be any information about an identified individual or that can be reasonably linked to an individual.

In real-world terms, it means that if hackers get phone numbers, bank account data, or medical records or if malware, like ransomware, merely accesses this information, then it’s considered a breach.

So far, so good.

There’s a ‘But’

However, the new Australian requirement  has a harm threshold that also has to be met for the breach to be reportable. This is not in itself unusual in that we’ve seen these same harm thresholds in US states breach notification laws, and even the EU’s GDPR and the NIS Directive.

In the Australian case, the language used is that the breach will “likely to result in serious harm.”  While not explicitly stated, the surrounding context in the amendment says that breach would have to cause serious physical, psychological, emotional, economic, reputational, and financial harm or other effect that a “reasonable” person would agree.

By the way, this is also similar to what’s in the GDPR’s preamble.

The Australian breach notification rule, though, goes further with explicit remediation exceptions that give the covered entities – privacy sector companies, government agencies, and health care providers – even more wiggle room. If the breached entity can show that they have taken actions involving the disclosure or access before it results in serious harm, then they don’t have to report it.

I suppose you could come up with scenarios where there’s been, say, limited exposure of passwords from a health insurance company’s website, the company freezes the relevant user accounts, and the instructs affected individuals to contact them about resetting passwords. That might be a successful remediation.

You can see what the Australian regulators were getting at. By the way, I don’t think this rule is as “floppy” as one publication called the notification criteria. But it does give the covered entities something of a second chance.

Anyway, if there’s a harmful breach event, then Australian organizations will have to notify the regulators as soon as possible after discovery. They’ll need to provide them with breach details, including the information accessed, as well as steps affected individuals should take.

The Australian breach notification rule is set to go into effect in a few weeks, and there will be a one-year grace period from that point. Failure to comply can result in investigations, forced remedial actions, and fines or compensations.

It’s Not Just Waymo: IP Most at Risk According to Our RSA Survey

It’s Not Just Waymo: IP Most at Risk According to Our RSA Survey

This year, the RSA Conference boasted over 43,000 attendees and 557 exhibitors spread across two enormous and cacophonous halls. Even in the quiet of the hotel room, my ears rang with echoes of the discordant noise about new potential threats. Let’s just say I’ll be eyeing every public outlet from which I charge my phone with suspicion.

Tom Foremski, ex-Financial Times journalist and editor/publisher of Silicon Valley Watcher, summed up the experience nicely via ZDNet:

[G]oing to RSA show will likely cause your mind to race in panic at all the vectors of malice that the security vendors will happily tell you about.

Foremski and those he interviewed discussed the implications of a widening security pit: how we could buy every tool on the market and still not be 100% secure. Forrester Consulting has coined this “expense in depth” in a recently released study, writing:

The reality is that companies have spent a lot of money on individual technology — instead of a unified data security strategy — and are judging their maturity based on money spent.

Or in other terms, companies are focused on threats (as the RSA newsfeeds testified) rather than the data – customer, employee, intellectual property and financial data – any of which would be toxic if stolen or made public (e.g., Waymo IP theft – keep reading).

The RSA Data Security Results

We surveyed security professionals who stopped by our booths at RSA about how their companies identify, classify, protect and monitor data.  The results are in and echo the Forrester study:

  • 72% use 3 or more data security tools (and over 50% use 5 or more).
  • Respondents are not confident in the ability to identify, classify, protect and monitor their enterprise data, with few stats crossing the 50% line:
    • Employee data fares the best with 67% completely confident in knowing exactly where this data resides on the network, 59% enforce a least privilege model against it and only 45% audit access to it and alert on abuse.
    • Less than 50% of respondents can identify the location and monitor for anomalous behavior on customer and financial data.
    • Coming in last for all categories is intellectual property — one of the most toxic and costly data sets. Well under 45% are confident in their ability to identify, classify and restrict access on a need-to-know-basis to this data set: even more concerning, only 30% monitor IP for access and abuse.

While the similarities to the Forrester study are validating, real world examples showing how these data sets quickly turn toxic drive the point home even more. Let’s take a look at one of those examples.

Waymo and the Alleged Toxic IP Leak

Last week, Waymo, pioneers in self-driving car technologies, announced legal action against competitors Otto and Uber for the alleged theft at the hands of several former employees of more than 14,000 highly confidential and proprietary design files.

Mention this theft to any R&D head, CEO or CISO and they’ll cringe at the thousands of man hours, millions of R&D dollars and expected revenue that drove off the parking lot.  To put more context around this, Waymo spent seven years in R&D on self-driving technologies including their own in-house hardware, accumulated 1.5 million miles of experience on public roads and billions of miles in simulation tests.  Self-driving technology is how they make their money; now key components of that technology appear to have fallen into the hands of a competitor.

The loss and future damage of stolen IP is enough to cripple any company, maybe even put them out of business. Yet we see time and again in our risk assessments that sensitive data like IP is not identified, classified or monitored for abuse. Both the Forrester Study and our RSA survey results found that 60% of organizations do not enforce a need-to-know access model for this type of highly confidential information and even fewer monitor access for abusive behavior – like a sudden flurry of access activity on files an employee may not normally access (cue Paul Harvey: “And now for the rest of the story”… employee gives his resignation a few days later).

The allegations of IP theft at the hands of multiple former employees who are now at a competitor is a story we’ve seen (and blogged about) before: an ambitious insider not only steals IP but recruits other colleagues to do the same, and then he takes both to a competitor. The Waymo complaint outlines how the alleged ringleader, the founder of Otto, stole 9.7 GB of highly confidential data and tried to cover his tracks, and it alludes to collusion with several employees who followed suit:

A number of Waymo employees subsequently also left to join Anthony Levandowski’s new business, downloading additional Waymo trade secrets in the days and hours prior to their departure [emphasis mine].

Regardless of the court’s decision in the Waymo case, this serves as a wake-up call for any company who has data that would be toxic to the company’s revenues and reputation if it were stolen or made public.

And Now for the Rest of the Story

Data has real value.  Self-driving technology alone has the power to change the world and save lives. And there are many other types of innovations being worked on and invested in.  Organizations need to start seeing this data and data security as a driver of business growth. Ensuring that the right people and only the right people have access will accelerate bringing this innovation to market and drive competitive advantage – the flip side to this coin is very real, and we see it playing out in the Waymo/Uber case, where too much unmonitored access can give a competitive advantage to the other guy.

The final piece to our RSA survey asked respondents about the benefits they would receive with a unified data security platform – in other words, a solution that would have stopped or greatly reduced the damage of the Waymo IP theft. The top rated benefits include:

  • quicker response to breaches (60%)
  • improved ability to identify data (60%)
  • improved ability to spot anomalous behavior (56%)
  • increased visibility on access and usage of sensitive data (55%)

Want to see what type of data might be overexposed in your company?  Our Data Risk Assessment gives a snapshot of your data security to quickly ascertain the level of risk associated with your data: exposing high risk areas and where you can safely and swiftly pull back access, reducing your risk profile.

Get more details on our Data Risk Assessment.