Protecting customer data

There have been a number of reports recently about customer lists leaking out through ESPs. In one case, the ESP attributed the leak to an outside hack. In other cases, the ESPs and companies involved have kept the information very quiet and not told anyone that data was leaked. People do notice, though, when they use single use addresses or tagged addresses and know to whom each address was submitted. Data security is not something that can be glossed over and ignored.
Most of the cases I am aware of have actually been inside jobs. Data has been stolen either by employees or by subcontractors that had access to it and then sold to spammers. There are steps that companies can take to prevent leaks and identify the source when or if they do happen.

1. Limit employee and subcontractor access to data. Keep data machines separate from other machines and limit employee access to those who must have access.
2. Subcontractors who must have access to data should be under contract and under NDA. Make it very clear that data leaks will be treated seriously and may result in legal action.
3. If employee or business issues mean that employees will be terminated, remove access to data sources before the employee is notified of termination. Some employees who would not consider stealing data from a company they work for will take data after they are terminated.
4. Institute secure audit trails for access to data. Track every time an employee accesses data from a console, web interface or client.
5. Prevent, as much as possible, the ability for anyone to download data. If there are reasons someone needs to download email addresses, remove @ signs and replace with another symbol to make it less likely that trojans on employee laptops will steal the addresses.
6. Prohibit employees from storing customer data on laptops or downloading over wireless.
7. When providing data to subcontractors seed addresses in the lists. This way, if the list is leaked or sold, then you will know when that happens. Provide unique seeds to each subcontractor in order to identify which subcontractor is responsible for the leak.
8. Occasionally search all machines on your network for the seeded addresses to identify places where data may unexpectedly end up internally.
9. Occasionally punch seed addresses into search engines (Google or Bing) to see where address lists may have leaked.
10. Run current and up to date anti-virus software on all machines. Use hardware firewall and VPN software to limit external access.
11. Block outbound port 25 across the network. Ban any peer to peer software on any machine that has access to address lists, including employee laptops.
12. Securely store and/or encrypt any backup tapes to prevent employees from walking off with them.
13. Don’t put email lists or log files within a webserver directory; htaccess protection is not sufficient to prevent access.
14. If you are shipping files around with email addresses, use good encryption to prevent unauthorized users from having access.

None of these things will guarantee data will not be stolen or leaked. But limiting access to the data, and having a clear audit trail and consequences will make anyone think twice before stealing it.