Educator: Data Loss Prevention. 2 2
In this lesson, we are going to talk about DLP, 3 3
which is data loss prevention. 4 4
Now, DLP is a software solution 5 5
that detects and prevents sensitive information 6 6
from being stored on unauthorized systems 7 7
or being transmitted over unauthorized networks. 8 8
Essentially, we're tryna protect our data 9 9
from leaving our network and leaving our control. 10 10
Now, when you start setting up DLP, 11 11
there are three main components that you have to have. 12 12
The first is a policy server. 13 13
This is used to configure classification, 14 14
confidentiality, and privacy rule sets, 15 15
and be able to figure out 16 16
how you're going to log your incidents 17 17
and compile your reports. 18 18
The second thing we have is an endpoint agent, 19 19
and these are used to enforce policy on client computers, 20 20
even when they're not connected to a network. 21 21
So if I have a laptop and I've disconnected it 22 22
from the corporate network, 23 23
but I still have DLP installed as an endpoint agent, 24 24
it'll still stop me from copying those files 25 25
to an external hard drive. 26 26
And then I have network agents, 27 27
and these are essentially network appliances 28 28
that will sit at the network boundary 29 29
and interface with different web and messaging services 30 30
to scan the messages going through them 31 31
and protect things from leaving your network. 32 32
Now, DLP agents can scan both structured 33 33
and unstructured formats, 34 34
and we've talked about these two formats before. 35 35
When I'm dealing with structured formats, 36 36
that would be things like data messages 37 37
in a particular format, like a JSON format 38 38
or maybe a CSV file 39 39
that has particular set of data in each position. 40 40
Now, when I talk about unstructured, 41 41
this is things like chat and email and Word documents, 42 42
and other things like that. 43 43
Now, as you start transferring information around, 44 44
you want to be able to block it 45 45
if it doesn't conform to a predetermined policy, 46 46
and that's what DLPs are there to do. 47 47
Now, as you look at DLPs, 48 48
there are lots of different systems out there 49 49
but essentially you're going to get some sort of a dashboard 50 50
that looks like this. 51 51
This will tell you what policy matches you've had 52 52
and what type of false positive rates you've been having, 53 53
and you can search through or create new policies. 54 54
This is an example from Microsoft's DLP 55 55
that comes as part of Office 365. 56 56
Now, DLP systems will act 57 57
whenever a policy violation is detected, 58 58
and based on your policy, 59 59
it will do one of four actions. 60 60
The first is alert. 61 61
If it's set to alert only, 62 62
it's going to allow the copying to happen. 63 63
So let's say I had a file on the share drive 64 64
and I wanted to copy it to a USB drive. 65 65
I plug in my USB thumbstick to my laptop, 66 66
I drag and drop that file over, 67 67
and it might be that it flags and alerts, 68 68
and tells the administrator that I copied it 69 69
but it's still going to let me do it. 70 70
This just makes a note that I copied it 71 71
and then the administrator can report me if he wants to. 72 72
Now, the second thing you can do is be a little more active 73 73
and you can actually block it. 74 74
In this case, the user's going to be prevented 75 75
from copying the original file 76 76
but they would still have access to it. 77 77
So it notices that I'm tryna copy this file 78 78
off the share drive and it's going to block that action 79 79
but I can still read that file 80 80
and I can still access it from the corporate network 81 81
because I'm not blocked from using it, 82 82
I'm just blocked from taking it with me. 83 83
Then the third type 84 84
is a little bit even more stringent than this, 85 85
it's called quarantine. 86 86
This means the access to the original file 87 87
will now be denied to that user or possibly any user. 88 88
Essentially, as I tried to copy that file, it flagged it 89 89
that I was tryna take it, and it goes, 90 90
"Oh no. Somebody's trying to steal our stuff. 91 91
Let's lock it down and not let him see it anymore." 92 92
That's the idea of quarantine. 93 93
And now oftentimes what'll happen with quarantining 94 94
is the system will just encrypt that file, 95 95
and that way you can't access it or read it 96 96
because now it's scrambled up. 97 97
And then the fourth thing we have 98 98
is what's known as tombstoning. 99 99
And this one might be new to you 100 100
but essentially with tombstone, 101 101
the original file on the share drive 102 102
is now not only quarantined 103 103
but it's also replaced with a different file 104 104
that says the policy violation has occurred. 105 105
So, if I am the user and I go back to try to copy it again 106 106
or read that file, it's going to say, 107 107
"This file has been removed because you violated DLP policy. 108 108
To get the file reinstated, take these following actions." 109 109
And then it would tell me what I need to do. 110 110
That's the idea of tombstoning. 111 111
Again, it's a little bit more severe, 112 112
so we're going from alert to block 113 113
to quarantine to tombstone. 114 114
Now, these four actions we just covered 115 115
are all forms of DLP remediation, 116 116
and these can occur in multiple places. 117 117
They can occur on the client-side using your DLP agent 118 118
or on a server-side 119 119
if your server has a DLP agent installed. 120 120
Or it might be done at the network boundary 121 121
if you're using a network appliance. 122 122
And so there's lots of different ways to do DLP remediation. 123 123
And so it's important for you 124 124
to understand how you've configured your system. 125 125
And for the exam, 126 126
you're not going to be asked to configure a DLP system, 127 127
you're just going to be able to understand why you would use it 128 128
and how it's going to work.