Data Loss Prevention Overview Jeff Silver, CISSP Delaware DLP - - PowerPoint PPT Presentation
Data Loss Prevention Overview Jeff Silver, CISSP Delaware DLP Technical Specialist AGENDA: I. Introduction II. WHY Data Loss Prevention III. DLP Architecture and Fundamentals IV. Examples of DLP Violations IV. Examples of DLP
Jeff Silver, CISSP
Delaware DLP Technical Specialist
Many customers worry about data extraction and leakage:
The Legal Department informs the Network Security Team that a DLP deployment might violate International Privacy Laws in Europe. The Human Resources Department does not feel comfortable installing DLP Agents onto employee PCs, as active monitoring of every user action is generally frowned upon.
PC ‘Barker’ message that comes up for every login session. This message must contain the proper legal ‘verbage’ to clearly remove the employees ‘right’ to any privacy on company owned equipment. Employee action to click on this message stating they read and understand this corporate policy. Employees must sign an employee handbook . For certain industries, annual confirmation is required [i.e. Healthcare]. This handbook should clearly lay out in
confirmation is required [i.e. Healthcare]. This handbook should clearly lay out in solid legal terms that the company has the right to monitor all user actions while they are using or accessing corporate resources. On-line mandatory training regarding protection of corporate intellectual property and
added value. Clearly written ‘Standard Operating Procedures’ on corporate policy that lays out not just what the company can and will do to the employee, but what the interaction is with Law Enforcement, if intervention is needed.
Should the employer issue out mobile devices or let the employee use their own for corporate use? Compartmenting work spaces with ‘Containers’. Corporate applications that can be accessed from personal devices. For example, Outlook Web Application. How do you monitor this vector of data loss that can happen right from the employees living room!
Has the organization formalized a clear plan of action for what to do if sensitive data has been moved onto an active employees personal device? Has the organization factored in State and Federal Privacy Laws that apply to it’s business and employees? If the organization is International in nature, is the network infrastructure segmented so that security tools can be implemented in a way that does not violate stricter
cover this vector.
PCI DSS HIPAA Internal Policy GLBA HSPD 12 CSB 1386 Country Privacy Laws SOX EU CDR UK RIPA Data EU Data
FISMA COCOM Data Security Act FACTA EU Data Privacy FFIEC BASEL II J-SOX IRS 97-22 NERC NISPOM Partner Rules ACSI 33 NIST 800 State Privacy Laws
Customers WWW WAN eCommerce Applications Production Database Backup Tape Disk Arrays Privileged Users Privileged Users Privileged Users Privileged Users Internal Employees
:because sensitive information is always moving and transforming
Endpoint Endpoint Apps/DB Apps/DB Storage Storage FS/CMS FS/CMS Network Network
Partners Remote Campuses LAN VPN Business Analytics Enterprise Applications Outsourced Dev. Replica Staging Backup Disk Collaboration & Content Mgmt Systems File Server Portals Disk Arrays Disk Arrays Disk Arrays Backup System Production Database Remote Employees
PII, government, defense industrial base,
Unaware/Petty criminals Organized crime Organized, sophisticated supply chains (PII, financial services, retail) Unsophisticated
PII, government, defense industrial base, IP rich organizations
CyberTerrorists Anti-establishment vigilantes “Hacktivists” Targets of opportunity PII, Government, critical infrastructure
Monitor Monitor Discover
DLP Enterprise Manager
DLP Datacenter DLP Network DLP Endpoint
Unified Policy Mgmt & Enforcement
Incident Workflow Dashboard & Reporting User & System Administration
Enforce
Allow, Notify, Block, Encrypt
Enforce
Allow, Justify, Block on Copy, Save As, Print, USB, Burn, etc.
Remediate
Quarantine, Move to secure location, Delete, or Shred
Monitor
Hard Drives, USB, External Devices, Print Actions, burn to CD/DVD, etc.
Monitor
Email, webmail, IM/Chat, FTP, HTTP/S, Telnet, etc
Discover
File shares, SharePoint sites, Databases, SAN/NAS
11
Electronic Data Rights Management Electronic Data Rights Management
Encryption Encryption
Access Controls Access Controls
Rescan sources to measure and manage risk
File shares, Servers, Laptops Databases & Repositories
13
Remediation
300+ True File types
Rescan sources to measure and manage risk
Automatic Load Balancing
Grid Workers work together, intelligently balancing the scan load. They can be modified on the fly as well. Grid Workers can be dedicated servers, or even existing servers and PCs in the
be made permanent or temporary, based on the needs of the business. the needs of the business.
Agent Software Uses
15 Temporary scan agent
Agent Software Deployment Options
Permanent scan agent
Sensitive Information Sensitive Information
Endpoint Network Applications FS/DB Storage
Security Incidents Security Incidents
Email Web Traffic
25
Remediation
Instant Messages
This employee sent work home, and it contained a lot of SSNs.
RSA DLP can help track business traffic that is encrypted.
Print Copy and Save As
29
drives Actions & Controls
USB
Content Analysis
Described Content Analysis Fingerprinted Analysis
31
Built-in Expert Policy Templates
32
Described Content Analysis
33
Fingerprinted Analysis
34
Identity Analysis
35
analyzed
36
Highest levels of accuracy in identifying and discovering sensitive data
Scales to hundreds of terabytes of data, thousands of laptops/desktops across geographically distributed areas
Centralized policy management across Datacenter, Network, Endpoint with:
38