It seems that an attorney at Eli Lilly’s outside legal firm accidentally sent an email with confidential information over government settlement talks to a reporter at the New York Times. The Times reporter then started poking around, eventually breaking the story far before anyone was prepared.
Oops. Did I mention it was a $1B settlement?
Now before we get too excited, let’s keep in mind that even if Eli Lilly deployed DLP, it’s unlikely that their little outside law firm would. We also need to ask ourselves if any of their DLP policies would have prevented this type of leak, which will depend greatly on what was actually sent to the Times.
Perhaps we should start by disabling autocomplete in our email applications first. I wonder what percentage of email leaks are merely the result of that little feature?
Reader interactions
5 Replies to “The DLP Guys Will Have A Field Day With This One”
(which is what they are in the actual mail messages), but then I cannot type names, because we have autocomplete disabled and Outlook doesn’t recognize a correct “Last, First” recipient when it’s
Firstly, (with tongue in cheek) I wonder how it happened that the information was sent to exactly the person that would benefit the most from knowing about it. Hmmm…
Secondly, more importantly, I find it amazing how companies will spend loads of money and time on getting great security plans and infrastructures in place and then send their very confidential information to companies that have less of a security structure in place.
Sharon, totally agree on prevention, as you well know. I’‘m not sure how improperly using their DLP solution would isn’‘t relevant? The post is a reminder to keep your policies updated to protect what needs protecting, understand said protection doesn’‘t help if you send the data to someone else who loses it, and that if you monitor only, leaks still happen.
As you know, I’‘m happy to argue with you anytime, but I’‘m fairly certain we mean the same thing here.
Without getting into the details, which at this time are still unknown, I’‘m gonna argue that your comment …”we have to ask ourselves if any of their DLP policies would have prevented this type of leak” is not relevant and should never be used as an excuse for a failure to prevent a leak. Why? first, since that’s what DLP policies are all about. Making sure that data is classified and identified correctly. Second, the “P” in DLP stands for Prevention. For those readers who do not know know me, I’‘d like to point back to some arguments that you and I had way back in the past – when I thought that Prevention by blocking is the key element that customers should look for when selecting a DLP product as well as the ability to implement such policy quickly, effectively and without addition FTE. In my opinion, should there was / there is a DLP product installed there – it failed.
I’‘m no longer strategizing DLP products, however, I see some people repeating the same (old) mistakes in my current space which includes Database and Application Security. The defined DAM (Database Activity Monitoring) category must emphasis security via active prevention (e.g. selective blocking). Let’s keep the “what’s the best method” religious war away, and agree that one should protect databases, applications and stop leaks using enforcment.
Rich,
I hope you’‘re joking about auto-complete. We’‘d trade a few emails to the wrong correspondents, for lots of emails to the wrong (mistyped) addresses. Cure would be worse than the disease. Not to mention all the wasted time typing email addresses.
There are a couple workable changes that could make this somewhat safer, though:
1) Have email clients prefer private address book over corporate AB (LDAP/AD) over recent-correspondent AB.
2) Offer a secure mode, where if there are two possibilities, users must explicitly pick one.
Both of these would be better than the current systems, which default to the first possible match alphabetically. Fortunately Brian A from high school is no longer so confused when I send him emails intended for Brian O at Rockefeller, but having no AB auto-complete at all would be much worse.