1 1 00:00:00,150 --> 00:00:01,860 Data Loss Prevention. 2 2 00:00:01,860 --> 00:00:04,620 In this lesson, we are going to talk about DLP, 3 3 00:00:04,620 --> 00:00:06,780 which is data loss prevention. 4 4 00:00:06,780 --> 00:00:09,030 Now, DLP is a software solution 5 5 00:00:09,030 --> 00:00:11,460 that detects and prevents sensitive information 6 6 00:00:11,460 --> 00:00:13,590 from being stored on unauthorized systems 7 7 00:00:13,590 --> 00:00:16,680 or being transmitted over unauthorized networks. 8 8 00:00:16,680 --> 00:00:18,660 Essentially, we're tryna protect our data 9 9 00:00:18,660 --> 00:00:21,660 from leaving our network and leaving our control. 10 10 00:00:21,660 --> 00:00:23,790 Now, when you start setting up DLP, 11 11 00:00:23,790 --> 00:00:26,490 there are three main components that you have to have. 12 12 00:00:26,490 --> 00:00:28,470 The first is a policy server. 13 13 00:00:28,470 --> 00:00:30,690 This is used to configure classification, 14 14 00:00:30,690 --> 00:00:33,120 confidentiality, and privacy rule sets, 15 15 00:00:33,120 --> 00:00:34,020 and be able to figure out 16 16 00:00:34,020 --> 00:00:35,310 how you're going to log your incidents 17 17 00:00:35,310 --> 00:00:37,080 and compile your reports. 18 18 00:00:37,080 --> 00:00:39,330 The second thing we have is an endpoint agent, 19 19 00:00:39,330 --> 00:00:42,540 and these are used to enforce policy on client computers, 20 20 00:00:42,540 --> 00:00:44,190 even when they're not connected to a network. 21 21 00:00:44,190 --> 00:00:46,080 So if I have a laptop and I've disconnected it 22 22 00:00:46,080 --> 00:00:47,310 from the corporate network, 23 23 00:00:47,310 --> 00:00:49,710 but I still have DLP installed as an endpoint agent, 24 24 00:00:49,710 --> 00:00:52,200 it'll still stop me from copying those files 25 25 00:00:52,200 --> 00:00:53,880 to an external hard drive. 26 26 00:00:53,880 --> 00:00:55,170 And then I have network agents, 27 27 00:00:55,170 --> 00:00:57,060 and these are essentially network appliances 28 28 00:00:57,060 --> 00:00:58,650 that will sit at the network boundary 29 29 00:00:58,650 --> 00:01:01,470 and interface with different web and messaging services 30 30 00:01:01,470 --> 00:01:03,480 to scan the messages going through them 31 31 00:01:03,480 --> 00:01:06,090 and protect things from leaving your network. 32 32 00:01:06,090 --> 00:01:08,474 Now, DLP agents can scan both structured 33 33 00:01:08,474 --> 00:01:10,200 and unstructured formats, 34 34 00:01:10,200 --> 00:01:12,510 and we've talked about these two formats before. 35 35 00:01:12,510 --> 00:01:14,040 When I'm dealing with structured formats, 36 36 00:01:14,040 --> 00:01:15,960 that would be things like data messages 37 37 00:01:15,960 --> 00:01:18,690 in a particular format, like a JSON format 38 38 00:01:18,690 --> 00:01:20,070 or maybe a CSV file 39 39 00:01:20,070 --> 00:01:23,100 that has particular set of data in each position. 40 40 00:01:23,100 --> 00:01:24,630 Now, when I talk about unstructured, 41 41 00:01:24,630 --> 00:01:27,660 this is things like chat and email and Word documents, 42 42 00:01:27,660 --> 00:01:29,490 and other things like that. 43 43 00:01:29,490 --> 00:01:31,980 Now, as you start transferring information around, 44 44 00:01:31,980 --> 00:01:33,180 you want to be able to block it 45 45 00:01:33,180 --> 00:01:35,790 if it doesn't conform to a predetermined policy, 46 46 00:01:35,790 --> 00:01:38,280 and that's what DLPs are there to do. 47 47 00:01:38,280 --> 00:01:39,600 Now, as you look at DLPs, 48 48 00:01:39,600 --> 00:01:41,280 there are lots of different systems out there 49 49 00:01:41,280 --> 00:01:43,290 but essentially you're going to get some sort of a dashboard 50 50 00:01:43,290 --> 00:01:44,520 that looks like this. 51 51 00:01:44,520 --> 00:01:47,340 This will tell you what policy matches you've had 52 52 00:01:47,340 --> 00:01:49,830 and what type of false positive rates you've been having, 53 53 00:01:49,830 --> 00:01:52,350 and you can search through or create new policies. 54 54 00:01:52,350 --> 00:01:54,720 This is an example from Microsoft's DLP 55 55 00:01:54,720 --> 00:01:57,330 that comes as part of Office 365. 56 56 00:01:57,330 --> 00:01:59,040 Now, DLP systems will act 57 57 00:01:59,040 --> 00:02:01,560 whenever a policy violation is detected, 58 58 00:02:01,560 --> 00:02:03,000 and based on your policy, 59 59 00:02:03,000 --> 00:02:05,490 it will do one of four actions. 60 60 00:02:05,490 --> 00:02:06,960 The first is alert. 61 61 00:02:06,960 --> 00:02:08,370 If it's set to alert only, 62 62 00:02:08,370 --> 00:02:10,230 it's going to allow the copying to happen. 63 63 00:02:10,230 --> 00:02:12,510 So let's say I had a file on the share drive 64 64 00:02:12,510 --> 00:02:14,610 and I wanted to copy it to a USB drive. 65 65 00:02:14,610 --> 00:02:16,710 I plug in my USB thumbstick to my laptop, 66 66 00:02:16,710 --> 00:02:18,540 I drag and drop that file over, 67 67 00:02:18,540 --> 00:02:20,880 and it might be that it flags and alerts, 68 68 00:02:20,880 --> 00:02:22,530 and tells the administrator that I copied it 69 69 00:02:22,530 --> 00:02:24,090 but it's still going to let me do it. 70 70 00:02:24,090 --> 00:02:25,920 This just makes a note that I copied it 71 71 00:02:25,920 --> 00:02:28,350 and then the administrator can report me if he wants to. 72 72 00:02:28,350 --> 00:02:30,210 Now, the second thing you can do is be a little more active 73 73 00:02:30,210 --> 00:02:31,800 and you can actually block it. 74 74 00:02:31,800 --> 00:02:33,600 In this case, the user's going to be prevented 75 75 00:02:33,600 --> 00:02:35,250 from copying the original file 76 76 00:02:35,250 --> 00:02:37,200 but they would still have access to it. 77 77 00:02:37,200 --> 00:02:38,908 So it notices that I'm tryna copy this file 78 78 00:02:38,908 --> 00:02:41,850 off the share drive and it's going to block that action 79 79 00:02:41,850 --> 00:02:43,860 but I can still read that file 80 80 00:02:43,860 --> 00:02:45,660 and I can still access it from the corporate network 81 81 00:02:45,660 --> 00:02:47,280 because I'm not blocked from using it, 82 82 00:02:47,280 --> 00:02:49,470 I'm just blocked from taking it with me. 83 83 00:02:49,470 --> 00:02:50,610 Then the third type 84 84 00:02:50,610 --> 00:02:52,110 is a little bit even more stringent than this, 85 85 00:02:52,110 --> 00:02:53,580 it's called quarantine. 86 86 00:02:53,580 --> 00:02:55,620 This means the access to the original file 87 87 00:02:55,620 --> 00:02:59,040 will now be denied to that user or possibly any user. 88 88 00:02:59,040 --> 00:03:02,040 Essentially, as I tried to copy that file, it flagged it 89 89 00:03:02,040 --> 00:03:03,487 that I was tryna take it, and it goes, 90 90 00:03:03,487 --> 00:03:05,730 "Oh no. Somebody's trying to steal our stuff. 91 91 00:03:05,730 --> 00:03:08,430 Let's lock it down and not let him see it anymore." 92 92 00:03:08,430 --> 00:03:10,110 That's the idea of quarantine. 93 93 00:03:10,110 --> 00:03:12,180 And now oftentimes what'll happen with quarantining 94 94 00:03:12,180 --> 00:03:14,220 is the system will just encrypt that file, 95 95 00:03:14,220 --> 00:03:15,870 and that way you can't access it or read it 96 96 00:03:15,870 --> 00:03:17,490 because now it's scrambled up. 97 97 00:03:17,490 --> 00:03:18,570 And then the fourth thing we have 98 98 00:03:18,570 --> 00:03:20,070 is what's known as tombstoning. 99 99 00:03:20,070 --> 00:03:21,240 And this one might be new to you 100 100 00:03:21,240 --> 00:03:22,860 but essentially with tombstone, 101 101 00:03:22,860 --> 00:03:25,080 the original file on the share drive 102 102 00:03:25,080 --> 00:03:27,180 is now not only quarantined 103 103 00:03:27,180 --> 00:03:29,610 but it's also replaced with a different file 104 104 00:03:29,610 --> 00:03:32,370 that says the policy violation has occurred. 105 105 00:03:32,370 --> 00:03:35,610 So, if I am the user and I go back to try to copy it again 106 106 00:03:35,610 --> 00:03:37,057 or read that file, it's going to say, 107 107 00:03:37,057 --> 00:03:40,320 "This file has been removed because you violated DLP policy. 108 108 00:03:40,320 --> 00:03:43,260 To get the file reinstated, take these following actions." 109 109 00:03:43,260 --> 00:03:44,910 And then it would tell me what I need to do. 110 110 00:03:44,910 --> 00:03:46,230 That's the idea of tombstoning. 111 111 00:03:46,230 --> 00:03:47,310 Again, it's a little bit more severe, 112 112 00:03:47,310 --> 00:03:48,870 so we're going from alert to block 113 113 00:03:48,870 --> 00:03:50,970 to quarantine to tombstone. 114 114 00:03:50,970 --> 00:03:52,710 Now, these four actions we just covered 115 115 00:03:52,710 --> 00:03:54,768 are all forms of DLP remediation, 116 116 00:03:54,768 --> 00:03:56,940 and these can occur in multiple places. 117 117 00:03:56,940 --> 00:03:59,670 They can occur on the client-side using your DLP agent 118 118 00:03:59,670 --> 00:04:01,230 or on a server-side 119 119 00:04:01,230 --> 00:04:03,480 if your server has a DLP agent installed. 120 120 00:04:03,480 --> 00:04:05,280 Or it might be done at the network boundary 121 121 00:04:05,280 --> 00:04:06,810 if you're using a network appliance. 122 122 00:04:06,810 --> 00:04:09,870 And so there's lots of different ways to do DLP remediation. 123 123 00:04:09,870 --> 00:04:10,710 And so it's important for you 124 124 00:04:10,710 --> 00:04:12,930 to understand how you've configured your system. 125 125 00:04:12,930 --> 00:04:13,830 And for the exam, 126 126 00:04:13,830 --> 00:04:16,440 you're not going to be asked to configure a DLP system, 127 127 00:04:16,440 --> 00:04:18,840 you're just going to be able to understand why you would use it 128 128 00:04:18,840 --> 00:04:20,073 and how it's going to work.