It’s a long hot summer here in the Middle East and with 2/3 of the office out on vacation, you have some time to reflect on data security. Or on the humidity. Or on a cold beer.
Maybe you are working on technology like or or , or or in your organization. Or maybe you already purchased DLP technology and you’re embroiled in turf wars that have put your DLP implementation at a standstill as one of your colleagues is claiming that there are issues with DLP and you’re trying to figure out how to get the project back on track after people get back from their work and play vacations in and brushing up on their hacking skills.
Unlike firewall/IPS, DLP is content-centric. It is technology that drives straight to the core of business asset protection and business process. This frequently generates opposition from people who own business assets and manage business process. They may have legitimate concerns regarding the cost-effectiveness of DLP as a data security countermeasure.
But – people who oppose DLP on grounds of potential employee privacy violations might be selling to further a political agenda. If you’re not sure about this – ask them what they’ve done recently to prevent and in the .
For sure, there are countries such as France and Germany where any network or endpoint monitoring that touches employees is verboten or interdit as the case may be; but if you are in Israel, the US or the UK, you will want to read on.
DLP (data loss prevention) is a solution for monitoring/preventing sensitive outbound content not activity at an endpoint. This is the primary mission. DLP is often a misnomer, as DLP is more often than not, DLD – data loss detection but whatever…Network DLP solutions intercept content from the network and endpoint DLP agents intercept content by hooking into Windows operating system events. Most of the DLP vendors offer an integrated network DLP and endpoint DLP solution in order to control removable devices in addition to content leaving network egress points. A central command console analyzes the intercepted content and generates security events, visualizes them and stores forensics as part of generating actionable intelligence. Data that is not part of the DLP forensics package is discarded. In other words, DLP is not about reading your employees email on their PC. It’s about keeping the good stuff inside the company. If you want to mount surveillance on your users, youhave plenty of other (far cheaper) options like or . Your mileage will vary and this blog does not provide legal guidance but technically – it’s not a problem.
A DLP implementation will involve writing custom content signatures (for example to detect top-secret projects by keyword, IP or source code) or selecting canned content signatures from a library (for example credit cards).
The signatures are then combined into a policy which maps to the company’s data governance policy – for example “Protect top-secret documents from leaking to the competition”.
One often combines server endpoints and Web services to make a more specific policy like “Alert if top-secret documents from Sharepoint servers are not sent via encrypted channels to authorized server destinations“.
In 13 DLP installations in 3 countries, I never saw a policy that targeted a specific user endpoint. The reason for this is that it is far easier using DLP content detection to pickup endpoint violations then to white list and black list endpoints which in a large organization with lots of wireless and mobile devices is an exercise in futility.
We often hear privacy concerns from people who come from the traditional firewall/IPS world but the firewall/IPS paradigm breaks when you have a lot of rules and IP addresses and that is why none of the vendors like ever succeeded in selling the concept.
Since DLP is part of the company enforcement, it is commonly used as a tool to reinforce policy such as not posting company assets to .
It is important to emphasize again, that DLP is an alert generation and management technology not a general purpose network traffic recording tool – which you can do for free using a tap and .
Any technology can be abused when in the wrong hands or in the right hands and wrong mission. Witness NSA.
Many companies, (Israeli companies in particular) don’t have a data governance policy but if they do, it should cover the entire space of protecting employees in the workplace from cyber-threats.
An example of using DLP to protect employees are the threat scenarios of cyber-stalking, sexual harassment or drug trafficking in the workplace where DLP can be used to quickly (as in real-time) create very specific content rules and then refined to include specific endpoints to catch forensics and offenders in real-time. Just like in New York.
There are 3 key use cases for DLP in the context of privacy:
If you liked this or better yet hated it, . I am a professional security analyst specializing in HIPAA compliance and medical device security and I’m based in Israel and always looking for interesting and challenging projects.
Idea for the post prompted by .