In the past, the general consensus was that data security threats primarily came from external sources rather than internal ones, so corresponding data protection measures were established to guard against external threats. It wasn’t until recent years that many companies realized that employees leaking or destroying sensitive company data could have incalculable consequences for the company.This shift in awareness began with the Edward Snowden incident—Edward Snowden, a former contract technician at the NSA (National Security Agency), stole critical classified documents from the NSA.
In addition to the Snowden incident, a public report by Boscom also challenged the following view: “The primary threats to corporate data come from external sources: hackers, industrial spies, and other competitors.”This report revealed a disturbing fact: nearly 85% of departing employees take sensitive company data with them when they leave. Moreover, it is relatively easy for employees to take sensitive, confidential data with them when they leave. Although the information Snowden stole from the NSA was highly newsworthy, it also highlighted the serious consequences of internal data leaks.
In light of the above, it is easy to understand why companies find it difficult to ensure data security, especially when these security risks stem from internal employees. Employees access internal company data as part of their job duties. Restricting such access could hinder employees’ normal work and even impact the company’s overall operational capabilities. So, is this dilemma unsolvable?
Let’s examine this challenge through a real-world industry scenario: a forex brokerage firm.
Brokerage firms have different functional departments, each with distinct access permissions. From sales representatives to marketing teams (such as email marketing specialists), and various categories of customer information, we should use software to configure visibility settings that segment access based on different functional departments and job roles. This is because if an employee views information outside their authorized scope, it creates a data security vulnerability.This is why it is crucial to assign data access permissions based on job roles. It is also the only way for brokerage firms to currently protect information from potential internal threats without compromising productivity.
CRM Systems and Data Encryption Technologies
From a technical standpoint, the most suitable tools for brokers to protect data are CRM management systems and data encryption technology. The former allows management to determine who has access to which data, while the latter prevents unauthorized individuals—such as hackers—from accessing information via external devices.One benefit of data encryption technology is that it prevents malicious employees from sending confidential company data outside the organization, since such data becomes useless if it is not properly decrypted upon transmission.
To better implement the above measures, it is even more important for brokerage firms to establish implementation strategies for data security support measures. This means that technical measures are determined by regulations and policies, rather than by the available tools.In addition to adopting technical safeguards, management must clearly define internal policies—such as prohibiting the use of USB drives within the company and forbidding employees from logging into the system using others’ accounts. While these requirements may seem self-evident and expected to be followed by employees without explicit stipulations, they are not always easy to enforce in practice.
Data Breaches Are Everywhere
The Edward Snowden incident has shown us that data breaches are everywhere. After all, if even the data of the powerful U.S. National Security Agency (NSA) can be easily stolen, how much more so for a single company? In fact, appropriate data security measures can significantly reduce a company’s vulnerability to data breaches.When discussing the Edward Snowden incident, it’s important to remember what kind of actors steal what kind of information: the NSA possesses more classified information than ordinary companies, and its agents are willing to take greater risks to obtain that information.While Snowden and others stole information for ideological reasons, trade secrets are typically stolen for financial gain and profit. Therefore, measures to prevent the theft of trade secrets are relatively simple and cost-effective.
In summary, we live in a world where data risks are ubiquitous, but there are also many technical solutions and standard operating procedures that can significantly reduce these risks.You need to remain vigilant and address potential data security threats proactively, but please remember that while data security threats are ubiquitous, they are manageable—there is no need to sacrifice business productivity and profits in the name of excessive data security.
