In my blog from September 2014, I wrote “encryption and access controls are your front-line defenses for defending data-at-rest. Given today’s threat environment, encrypt everything possible, everywhere possible.” While lots of things change in 6 months – the projected World Series Champion, the Super Bowl front-runner, Taylor Swift going from tweeting about dating to tweeting about hacking – this recommendation remains constant.
Data-at-rest is susceptible to many forces, not least of which are malicious and non-malicious insiders. As we noted in our recent 2015 Insider Threat Report, the insider threat landscape is becoming more difficult to deal with as the range of miscreant’s moves beyond employees and privileged IT staff. It now includes outsiders who have stolen valid user credentials; business partners, suppliers, and contractors with inappropriate access rights; and third-party service providers with excessive admin privileges. Unless properly controlled, all of these groups have the opportunity to reach inside corporate networks and steal unprotected data.