Skip to main content

Data Leakage Risk

  • Financial firms are technology organisations, and all such organisations need to worry about Intellectual Property Risk. IP Leakage can happen anywhere.
  • Arguably, risks are greater in finance because of the penalties that regulators may apply.
  • Historically, use of social media / sharing sites has been prohibited by many firms to mitigate data leakage.
  • But you have to balance the data leakage risk against the benefits (outlined above). Therefore: can employees use a site like GitHub (where uploading data is commonplace) but have controls in place to mitigate the data-leakage aspect?
  • Tools such as GitProxy, personal machines, ephemeral desktops etc. help to mitigate this.
  • Training of open source developers within the organisation is an important step. Do developers understand the rules? Can you be explicit about what is and isn't included in a commit? For example: non-code contributions such as test data might be outside the policy. It's easier to have a blanket policy that this isn't allowed. Test data needs to be generated by the tests as they run instead.
  • A governance process needs to be in place for supervising contributions and observing what leaves the organisation.
  • Tools like GitHub Enterprise also aim to help with Data Leakage Prevention.
  • Evidence may need to be provided that data hasn't been leaked (according to regulations).