Every day, our nation’s governing entities mount a defense against constantly-evolving threats to the security of our most sensitive data. Increasingly, IT professionals have recommended a data-centric approach to security, which is a more holistic system of securing data at the granular level by several methods. Among those, Digital Rights Management (DRM) is one of the most effective ways of securing data – no matter where it travels by allowing users to establish controls, monitor access and automatically track information as it gets shared outside of the agency.
Regulations Escalate and Security Evolves
The government has responded to the advancing threat landscape over the years by systematically erecting regulations – the Federal Risk and Authorization Management Program (FedRAMP), for example, established standards for the types of security tools and systems every agency was required to adopt within a certain timeframe. The Department of Homeland Security (DHS) put in place the Continuous Diagnostics and Mitigation program (CDM) to assist agencies in acquiring the tools necessary to comply with such directives. These initiatives and others in the same vein were intended to compel agencies to incorporate best practices into their cybersecurity strategies.
We have watched those strategies gradually shift from a historic dependence on perimeter defenses, like firewalls, to an increased focus on securing the network. Yet, despite all the gains we’ve made in the area of cybersecurity, data breaches continue to occur – and we can attribute much of that on the persistence of the “insider threat.”
“The most fundamental element of threat is deeply human,” says Steve Durbin, Managing Director of Information Security Forum, on the array of motives and circumstances that may underlay any one individual handling classified information inappropriately.
Generally, the bulk of such incidents are not of the cloak-and-dagger variety, but simply regular employees trying to do their jobs. However, when an employee’s job requires contact and collaboration with outside parties it can create a pocket of vulnerability in the agency’s overall security system. Add the trend of employing multiple devices and networks for working within an already-complex extranet of involved parties, and you’ve got ideal conditions for mission-critical data to slip through.
Digital Rights Management: A Crucial Component of Your Data-Centric Security Strategy
Recognizing the eventuality of human error, it has become an increasingly accepted notion in the IT industry that what we need today is security at the granular level of the data itself, and that’s where DRM comes in.
Through customized controls, access monitoring and information monitoring, DRM can more effectively secure data as it gets shared outside of the agency through the use of these five strategic safeguards:
- Persistent Protection – enforces access across the file layer.
- Permissions – restricts what a user can do with a piece of content, like saving or printing it.
- Revocation – expires and terminates user access after publishing.
- Audit logs – records all valid and invalid attempts to access a piece of content for complete oversight
- Authentication – allows access to the content based on authentication mechanisms, like username/password, two-factor, PKI (public key infrastructure) and single sign-on (SSO).
With the increase in inside data leaks today, it is impossible to deny the likelihood that, at some point, an individual within the agency’s network will disclose classified information. Unfortunately, whether maliciously motivated or not, intentional or unintentional, a leak can precipitate the same harmful consequences.
So, what are you going to do to protect your sensitive information when it travels outside of the agency? There are some truly effective data-centric tools out there to add to your security arsenal – and digital rights management is one of the best. Learn more about how DRM works with Adobe’s resources here and here.
Adobe’s DRM solutions are now available via General Services Administration (GSA) Continuous Diagnostics and Mitigation (CDM) Tools Special Item Number (SIN) 132-44 through Carahsoft’s GSA IT Schedule 70. The CDM Tools SIN supports the Department of Homeland Security (DHS) CDM Program to provide a consistent set of continuous diagnostic and mitigation tools for federal, state, local, regional and tribal governments. Through the SIN, agencies now have one centralized location to access pre vetted CDM offerings. For more information on the contract and solutions available through Carahsoft, visit www.carahsoft.com/BuyCDM.