Security professionals across all industries face a common challenge: they cannot protect data if they don’t know where it is kept. The simple reality is that risk stakeholders at most organizations do not know what data is on their network. In turn, this knowledge gap makes it difficult to prioritize often-limited information security resources. The result is that organizations often apply security to areas where they “hope” critical data resides, considering the risk and exposure of a data breach hope is not an effective strategy.
The name really says it all, as InfoGPS is purposely built to navigate enterprise networks and locate critical data. InfoGPS (www.infogpsnetworks.com ) addresses data mapping challenges with an innovative technology that identifies critical data and monitors changes in endpoint configurations. The solution helps organizations quantify the value of the data it identifies, which establishes a solid foundation for investments in risk mitigation.
Configuration is straight forward, but requires input to define data discovery patterns with string, hash and regular expression as supported options. Data search criteria will vary based on the needs of the environment, but social security, drivers license, and credit card numbers are some of the most common definitions used to identify unique data patterns. From a risk standpoint, security professionals will note that InfoGPS does not build an index of the data discovered, but simply identifies where it resides. This approach avoids duplication of data and the risk associated with keeping it in multiple places. Initiating a deployment scan is simple and requires the installation of a small agent on endpoints using standard software deployment technology like Microsoft SCCM or ConnectWise. As data is located, InfoGPS masks the results (when displaying) and highlights the endpoint(s) where it resides.
Another interesting feature is the ability to quantify the value of data that resides in the enterprise. Values of data can be configured to meet the specific needs of a customer as well as following industry standard values from Ponemon and other reputable sources. With baseline values defined, InfoGPS will assign an overall value to the data it discovers. This gives executives and other stakeholders a baseline for evaluating investments in risk mitigation.
Mainstream solutions often struggle to understand where data resides and how it is being transmitted; InfoGPS provides core functions that overcome this challenge across the enterprise, including:
• Data Mapping – a clear and detailed listing of data assets in areas of the network that are frequently invisible to current controls.
• Endpoint Monitoring – a visual gap analysis that displays deviations from the standard performance. You can even get to the level of detail showing what services are running on a device (versus simply installed), what ports are active, and what data patterns were matched.
• Monetary Risk Valuation – a true value for off-balance-sheet risk to use in calculating the cost of a data breach for the enterprise.
The current version runs on commercial Windows and there are two versions of Linux (Ubuntu and Red Hat) in beta testing. Support for MacOS is also on the roadmap for a release this quarter. The deployment agent is 220 MB and the system will run on a Windows Server 2008 R2 or higher. Pricing is subscription-based starting at $4.00 per device/month.
Product: InfoGPS
Vendor: InfoGPS
Price: Subscription based license $4.00 per asset/month.
What it does: Performs real-time data discovery and monitors it for any change in state.
What we liked: Assigns a monetary risk value to assets that contain critical data…helping organizations prioritize mitigation resources.
The Bottom Line: Addresses one of the most common issues for information security – locating critical data.
