Instructor: DLP Discovery and Classification. 2 2
Now, as we talked about in the last lesson, 3 3
we talked about DLP at large. 4 4
But DLP is going to define data 5 5
that should be protected using different mechanisms, 6 6
and there's really six of them. 7 7
Now, as we go through, we're going to talk about these six, 8 8
which includes things like classification, dictionary, 9 9
policy template, exact data match, or EDM, 10 10
document matching and statistical/lexicon. 11 11
Now, we don't have to know these in-depth, 12 12
but we basically have to know 13 13
a definition for each one of those. 14 14
And that's what we're going to cover in this lesson. 15 15
Now, when we talk about classification, 16 16
this is a rule based on confidentiality tags 17 17
or labels that was attached to the data. 18 18
So we talked about data classification 19 19
in the last section of the course, right? 20 20
And we said, as you have this data, 21 21
you say this is unclassified or secret, or top secret, 22 22
or whatever classifications or tags you use. 23 23
Well, if DLP sees that, 24 24
for instance, this is a secret file 25 25
and you're trying to send it to somebody 26 26
who is not authorized 27 27
because you're only able to send things 28 28
out at the unclassified level, 29 29
then DLP can flag that, alert it or block on it. 30 30
And this is all done based on these labels 31 31
and classifications. 32 32
Now, the next one we have is dictionary. 33 33
And a dictionary is essentially 34 34
just a set of patterns that should be matched. 35 35
Now these can be actual words 36 36
or they can be phrases or registry expressions. 37 37
It really depends on you and how you configure this. 38 38
For instance, 39 39
let's say my company was starting to do 40 40
some kind of a new project and we codenamed it Tiger. 41 41
Well, anytime we see something that matches the word Tiger 42 42
trying to be emailed out, we would block it, 43 43
because we don't want anybody getting information 44 44
on our super cool new project called Tiger. 45 45
That would be the idea of a dictionary. 46 46
Now the next one we need to talk about is a policy template. 47 47
Now, a policy template is essentially a dictionary, 48 48
but it's a very specialized dictionary. 49 49
This is a template that contains dictionaries 50 50
that are optimized for data points 51 51
in a regulatory or legislative schema. 52 52
So if you fall under a PCI DSS, 53 53
there's a policy template you can download that would say, 54 54
"Hey, put this in your DLP to make sure anything 55 55
that matches this format doesn't leave the network." 56 56
The same thing with things like HIPAA or GDPR. 57 57
There are different templates that are there 58 58
that can help match individual 59 59
taxpayer identification numbers, 60 60
social security numbers, passport numbers, 61 61
or whatever else you want based on that particular template. 62 62
The next one we want to talk about is EDM, 63 63
which is Exact Data Match. 64 64
Now, EDM is a structured database of string values 65 65
that we want to search for and match. 66 66
Now the difference here is that these particular strings 67 67
are actually hashed and they create fingerprints 68 68
and then we start searching with those policy engines 69 69
based on those hash strings. 70 70
This way, 71 71
we're not compromising confidentiality or privacy issues, 72 72
but we are still matching the exact thing. 73 73
So if I had a list of 74 74
all of my customer's credit card numbers, for instance, 75 75
and I wanted to make sure they didn't leave the network, 76 76
I wouldn't want to load up all their credit card numbers 77 77
in my DLP, because if I did that, 78 78
then somebody could get their credit cards from my DLP. 79 79
So instead, 80 80
I would hash those credit card numbers individually 81 81
and store them in this structured database. 82 82
And that's what I'm searching for. 83 83
So as I see something 84 84
that looks like a credit card number going out in email, 85 85
I can hash that, 86 86
compare that hash against my database, and if it matches, 87 87
that's an exact data match, I would then flag that email. 88 88
Next we have document matching. 89 89
Now this is matching based on entire or partial document, 90 90
again, based on hashing. 91 91
So I have my new top secret Tiger program 92 92
and I have my PowerPoint 93 93
explaining everything we're going to do in it. 94 94
I can create a full document match against that 95 95
by hashing it, 96 96
and if I see that hash file trying to leave the network, 97 97
I would then block it. 98 98
Now, in addition to that, 99 99
I could do partial document matching, 100 100
where I'm looking for certain slides in it 101 101
or certain pictures, or certain words. 102 102
And all of those would be based on smaller amounts 103 103
that were then hashed and we could check for those as well. 104 104
And then the final one we have is Statistical/Lexicon. 105 105
Now, Statistical/Lexicon is a further refinement 106 106
of partial document matching, 107 107
which uses machine learning 108 108
to also analyze a range of data sources. 109 109
So we're not just using the standard document match 110 110
based on what I fed the system, 111 111
but I'm also using some machine learning 112 112
to make it more intelligent and do a better job.