Does your organization face risk from the loss of digital transportable or removable media?

Common challenges & issues:

  • Lost tapes, laptops, and other media exposing regulatory, reputation and customer risk.
  • No method to assess risk.
  • No control over methods of shipping.

Digital Removable & Transportable Media (DRTM) generally is defined as data storage devices, often small and easy to carry or transport, that can be used to copy, move and/or access data outside of an organization’s network that falls into one of the four categories:

  • Integrated Storage Devices (External Hard Drives, USB devices).
  • Removable Media (CD/DVD, Compact Flash SD, Tape, Floppy, Voice Tapes).
  • Data Devices in Transit (Laptops, Workstations, Servers, Removable Hard Drives, Printers & Fax Machines with hard drives).
  • Personal Communication / Entertainment Devices (Blackberry devices, PDAs, Cell phones, iPods, Digital Cameras).

Without a comprehensive strategy and integrated handling program for DRTM, it is extremely difficult to track the movement and storage location of sensitive data entrusted to or produced by your company, either within the enterprise or transferred to third party providers. Such a program needs to include identification of business and regulatory risk, policies and procedures, sound operational processes, risk reduction technologies, risk identification, risk acceptance, transfer controls and due diligence to adequately safeguard proprietary and confidential trade secret information from unauthorized access, use, disclosure, alteration or destruction.

Most organizations that have begun to consider security around digital transportable and removable media devices are implementing ad hoc controls that are neither linked by overarching strategies or processes nor supported by standardized technologies.

How can we support you

Our security and privacy professionals will be able to identify and tailor a set of next steps to allow your organization to develop the key components of a sustainable DRTM Program. Milton Alexander security and privacy professionals have developed a proven business process-based approach that links your business requirements to technologies, processes and policies, in order to develop a roadmap of recommendations to comprehensively reduce the overall risk to your organization posed by Digital Removable & Transportable Media.

Our approach begins with an assessment of your strategy, global processes, privacy, governance and supporting technologies, as a means to understand the overall risk to your environment. As a means to understand the effectiveness of your current DRTM security efforts and to benchmark your organization, we have adopted an approach around Carnegie Mellon’s Capability Maturity Model Integration (CMMI). This approach provides organizations with the essential elements of effective processes. The concept of using the Maturity Model is to establish a rating method that will allow us to benchmark and compare your transportable media security program against other organizations using DRTM maturity indicators. After conducting a Current State Assessment, we can assess the level of controls necessary to help mitigate the overall risk posed to your organization. Our roadmap will present recommended changes to technologies, processes and policies and will illustrate the projects necessary mapped to risk and cost over multiple quarters to mature your organization's DRTM security program. In addition, this roadmap to health is integrated into balance scorecard, key performance indicator, and dash boarding initiatives of your company, to align new initiatives and monitor their effectiveness within the business units as the risk reduction initiatives come on line. Areas of support include:

  • Technology Assessment – assess the technologies currently used in conjunction with DRTM.
  • Workflow Technologies - to span and link the systems, departments and applications that are currently used in processing transportable media, and to link your technologies into your workflow to create automation.
  • Encryption technologies – including those for USB keys, PDAs, BlackBerrys™, external hard drives and laptops.
  • Content monitoring and data leakage technologies – to scan hard drives, laptops, emails and even block content from being transferred to transportable media with the exception of approved users.
  • Content protection technologies.
  • Technologies to track data in transit – including WiFi & RFID tracking systems.
  • Assessing what data fields should be tracked and captured in risk management systems.
  • Benchmarking and Balanced Scorecards - creating a metrics and governance framework for assessing transportable media improvement and risk reduction.