This company protected its sensitive data with biometric thumbprint scanner but still managed to suffer trade secret theft after a former director of research allegedly stole gigabytes of data on its recipes.

NIST has updated the Federal Information Processing Standard, or FIPS, to align with the international standard, ISO 19790, for the first time.

Looking to stay ahead of the curve on all things infosec? We've gathered a list of 50 valuable associations, LinkedIn networking groups, and meetups for security professionals.

We've got some exciting news to share! We've secured $30 million in new funding, an investment that will allow us to help satisfy a growing demand for data protection worldwide.

Data classification, discovery, and encryption: We reached out to 18 security experts for insight on implementing a data-centric audit and protection program in an organization.

Data Loss Prevention (DLP) is one of the long-standing and more traditional approaches to securing enterprise data. It can be either network or endpoint-based, each having their own unique benefits and challenges. DLP technologies have traditionally been prone to false positives, and as such, some of their best use-cases are for controlling very predictable and structured content in very specific situations. The Benefits We can all agree that nobody wants to lose their data. Every organization wants the confidence that its users are not pilfering data and sending it places it doesn’t belong, or attempting to access certain kinds of data without authorization. If you know where your data is at rest, where it’s going when it’s sent, and who’s using that data, DLP can be a great solution. DLP uses rules to classify and protect sensitive data, and provide content inspection for data flowing through the corporate network, so that unauthorized users can’t accidentally or intentionally share data whose disclosure could potentially put the organization at risk. For example, if someone tried to forward a business email outside the corporate domain, or upload files to a personal cloud storage solution like Box or Dropbox, that person would be denied permission. Often, the motivation for DLP is driven by insider threats, as well as privacy laws that have strict data protection and access rule components. The Challenges: Positive vs. Negative Controls A core challenge of DLP is that it is based on a negative control model. In many ways, you can think of DLP as an IPS (Intrusion Prevention System), where instead of trying to match malicious exploits coming into the environment, DLP tries to match sensitive content going out. In InfoSec parlance this is a “negative control” where the goal is to detect something bad and block it (and conversely let everything else go through). And this model is why DLP has earned the reputation for being both slow and prone to false positives. It must analyze all content and try to match it to block lists. This requires lots of analysis and the matching can be wrong as enterprise content is constantly changing. The counterpoint to negative control models is the positive control model. Once again using a network example, a firewall is an example of a positive control. Security specifies what should be allowed (e.g. port 80) and everything else is denied by default. Digital Guardian Secure Collaboration takes a much more positive approach although at the content level instead of the network level. Digital Guardian Secure Collaboration policy defines who should have access to the content and what they should be able to do with it. Everything else is denied by default. This not only makes policy much simpler, but it removes the constant specter of false positives. Moving Beyond Trusted Walls This lack of control after data is accessed highlights another major challenge in information security today. Just because a user can access an asset should not mean that they are inherently trusted going forward. Even in traditional on-premise networks, organizations are increasingly moving to “zero trust architectures”, where all users are presumed to be compromised and every access to data is reviewed and approved based on policy. Centralization of policy management and administration is critical, ensuring that copies of documents or edited versions do not lose the original’s security. A Data-Centric Approach Solves This Problem Digital Guardian Secure Collaboration ensures that policy is checked and enforced whenever data is accessed regardless of where or how the access takes place. Instead of trying to control everything around the data, Digital Guardian Secure Collaboration extends control to the data itself. Trust is adaptive, can be defined down to an individual and controlled in terms of what the user is allowed to do with the data, and can be revoked at any time. This provides a logical approach to protecting data in a truly modern way that neither DLP or CASB can accomplish. Data and content can move, yet IT and Security teams remain in control and can adapt as situations change. We discuss DLP (and CASB) more, in this in-depth whitepaper, “The Acronym Jungle: Understanding the Benefits and Challenges of Data Loss Prevention (DLP) and Cloud Access Security Brokers (CASB).” Check it out!

Because of ongoing tweaks, like a recent amendment that would expand consumers' private right to action, the California Consumer Privacy Act remains in constant flux.

The manufacturer, which recently won an intellectual property case involving the theft of proprietary algorithms, source code, and programming language scripts, doesn't deny it was a victim of corporate theft but disagrees with the implication it was "Chinese espionage."

Digital Guardian upgraded its Support Community over the weekend to provide an improved user experience, better workflows and ticketing process.

Organizations recently responded to a senator who's hoping to develop a strategy for reducing cybersecurity vulnerabilities in the healthcare sector.

The latest breach appears to have impacted at least two million credit card numbers across six restaurants, for 10 months.

A Ponemon Institute report published today says the biggest driver to encryption for organizations is protecting enterprise intellectual property and consumer personal information.

A new certification, launched by a division of the country's government this week, is designed to help organizations demonstrate "accountable and responsible data protection practices."

A panel of security professionals discuss the top three tips for how CISOs and risk officers can help improve board communication around security

Web browsers, virtualization software, even cars – nothing was off guards last week at Pwn2Own, the annual hacking competition held each year alongside CanSecWest in Vancouver.

The life of a CISO is a busy one and it can be easy for priorities to get lost in the shuffle. We've polled a group of CISOs and other security professionals to find out what CISOs should be aware of but likely aren't.

The ramifications of a ransomware attack last fall at a healthcare billing services provider are still coming to light. Upwards to 700 companies and 1.2 million patients could ultimately be affected.

Verizon's new Insider Threat Report breaks down five categories of inside threat actors and outlines 11 steps to reduce risk and defend against malicious insiders.

The incident stems from an employee at a vendor working with the medical center improperly disclosing patient data.