Leak #4 Sensitive information can leave your organization when a backup tape is lost or stolen
Risk Mitigation: enable software or hardware tape encryption
Approximate cost per server license: $800
This is a 2 fold solution

• We use the built in encryption option included with Backup Exec 11d. I have heard engineers express concern with the overhead associated with software based encryption methods but I see no significant difference in the time it takes to write a terabyte to tape with the encryption option enabled. The tapes are then sent off site to Iron Mountain.
• Our core processing system uses Neoscale, a hardware based encryption appliance. The transfer rate is outstanding but that comes with a price tag that may be outside of the budget for smaller credit unions.

Leak #5
Sensitive information can leave your organization by being sent out your internet connection.
Risk Mitigation: enable content packet inspection with the ability to block
Approximate cost: varies based on member records
This is probably the easiest way for an insider to intentionally or accidentally cause a data leak. Most organizations fail to recognize this threat and the "governing bodies of audit" do little to even mention it in their check lists.

• Employees of financial institutions have access to a tremendous amount of sensitive data. It would not be difficult to create a spreadsheet, word document or access data base and attach it to an email destined for a hotmail account. This is also true for files sent to vendors that are part of normal operations. It is imperative that all sensitive information sent from your organization is encrypted. Anything sent out your internet connection in clear text puts your organization and its members at a huge risk and should be blocked from transmission.
• Implement the INTRUSION secure tap appliance. Their product is easy to install, configure and manage. The operational concept is straightforward, export all member records from your core processing system to a delimited file and load the file to the INTRUSIONdevice. The secure tap is inserted between you internet router and external firewall interface. All outbound packets are inspected before they get to your internet router. If information in the internet destined packets matches member records, the packet transmission can be denied. The device can be configured to send an email notification to members of the incident response team.