1 1 00:00:00,420 --> 00:00:03,630 DLP Discovery and Classification. 2 2 00:00:03,630 --> 00:00:05,700 Now, as we talked about in the last lesson, 3 3 00:00:05,700 --> 00:00:07,650 we talked about DLP at large. 4 4 00:00:07,650 --> 00:00:09,720 But DLP is going to define data 5 5 00:00:09,720 --> 00:00:12,720 that should be protected using different mechanisms, 6 6 00:00:12,720 --> 00:00:14,370 and there's really six of them. 7 7 00:00:14,370 --> 00:00:16,380 Now, as we go through, we're going to talk about these six, 8 8 00:00:16,380 --> 00:00:19,470 which includes things like classification, dictionary, 9 9 00:00:19,470 --> 00:00:22,950 policy template, exact data match, or EDM, 10 10 00:00:22,950 --> 00:00:26,070 document matching and statistical/lexicon. 11 11 00:00:26,070 --> 00:00:27,600 Now, we don't have to know these in-depth, 12 12 00:00:27,600 --> 00:00:28,650 but we basically have to know 13 13 00:00:28,650 --> 00:00:30,300 a definition for each one of those. 14 14 00:00:30,300 --> 00:00:32,370 And that's what we're going to cover in this lesson. 15 15 00:00:32,370 --> 00:00:34,140 Now, when we talk about classification, 16 16 00:00:34,140 --> 00:00:37,050 this is a rule based on confidentiality tags 17 17 00:00:37,050 --> 00:00:39,150 or labels that was attached to the data. 18 18 00:00:39,150 --> 00:00:40,770 So we talked about data classification 19 19 00:00:40,770 --> 00:00:42,270 in the last section of the course, right? 20 20 00:00:42,270 --> 00:00:44,010 And we said, as you have this data, 21 21 00:00:44,010 --> 00:00:46,890 you say this is unclassified or secret, or top secret, 22 22 00:00:46,890 --> 00:00:49,290 or whatever classifications or tags you use. 23 23 00:00:49,290 --> 00:00:50,760 Well, if DLP sees that, 24 24 00:00:50,760 --> 00:00:52,350 for instance, this is a secret file 25 25 00:00:52,350 --> 00:00:53,730 and you're trying to send it to somebody 26 26 00:00:53,730 --> 00:00:54,930 who is not authorized 27 27 00:00:54,930 --> 00:00:56,160 because you're only able to send things 28 28 00:00:56,160 --> 00:00:57,510 out at the unclassified level, 29 29 00:00:57,510 --> 00:01:00,810 then DLP can flag that, alert it or block on it. 30 30 00:01:00,810 --> 00:01:02,700 And this is all done based on these labels 31 31 00:01:02,700 --> 00:01:04,230 and classifications. 32 32 00:01:04,230 --> 00:01:06,150 Now, the next one we have is dictionary. 33 33 00:01:06,150 --> 00:01:07,320 And a dictionary is essentially 34 34 00:01:07,320 --> 00:01:09,341 just a set of patterns that should be matched. 35 35 00:01:09,341 --> 00:01:11,580 Now these can be actual words 36 36 00:01:11,580 --> 00:01:14,340 or they can be phrases or registry expressions. 37 37 00:01:14,340 --> 00:01:16,950 It really depends on you and how you configure this. 38 38 00:01:16,950 --> 00:01:17,783 For instance, 39 39 00:01:17,783 --> 00:01:18,960 let's say my company was starting to do 40 40 00:01:18,960 --> 00:01:21,870 some kind of a new project and we codenamed it Tiger. 41 41 00:01:21,870 --> 00:01:24,300 Well, anytime we see something that matches the word Tiger 42 42 00:01:24,300 --> 00:01:26,280 trying to be emailed out, we would block it, 43 43 00:01:26,280 --> 00:01:27,720 because we don't want anybody getting information 44 44 00:01:27,720 --> 00:01:30,360 on our super cool new project called Tiger. 45 45 00:01:30,360 --> 00:01:32,400 That would be the idea of a dictionary. 46 46 00:01:32,400 --> 00:01:35,280 Now the next one we need to talk about is a policy template. 47 47 00:01:35,280 --> 00:01:37,560 Now, a policy template is essentially a dictionary, 48 48 00:01:37,560 --> 00:01:39,480 but it's a very specialized dictionary. 49 49 00:01:39,480 --> 00:01:41,310 This is a template that contains dictionaries 50 50 00:01:41,310 --> 00:01:42,990 that are optimized for data points 51 51 00:01:42,990 --> 00:01:45,570 in a regulatory or legislative schema. 52 52 00:01:45,570 --> 00:01:48,240 So if you fall under a PCI DSS, 53 53 00:01:48,240 --> 00:01:50,677 there's a policy template you can download that would say, 54 54 00:01:50,677 --> 00:01:53,070 "Hey, put this in your DLP to make sure anything 55 55 00:01:53,070 --> 00:01:56,100 that matches this format doesn't leave the network." 56 56 00:01:56,100 --> 00:01:58,800 The same thing with things like HIPAA or GDPR. 57 57 00:01:58,800 --> 00:02:00,720 There are different templates that are there 58 58 00:02:00,720 --> 00:02:02,010 that can help match individual 59 59 00:02:02,010 --> 00:02:03,930 taxpayer identification numbers, 60 60 00:02:03,930 --> 00:02:06,240 social security numbers, passport numbers, 61 61 00:02:06,240 --> 00:02:09,840 or whatever else you want based on that particular template. 62 62 00:02:09,840 --> 00:02:12,060 The next one we want to talk about is EDM, 63 63 00:02:12,060 --> 00:02:13,920 which is Exact Data Match. 64 64 00:02:13,920 --> 00:02:16,860 Now, EDM is a structured database of string values 65 65 00:02:16,860 --> 00:02:18,810 that we want to search for and match. 66 66 00:02:18,810 --> 00:02:21,060 Now the difference here is that these particular strings 67 67 00:02:21,060 --> 00:02:23,370 are actually hashed and they create fingerprints 68 68 00:02:23,370 --> 00:02:25,431 and then we start searching with those policy engines 69 69 00:02:25,431 --> 00:02:27,780 based on those hash strings. 70 70 00:02:27,780 --> 00:02:28,613 This way, 71 71 00:02:28,613 --> 00:02:31,260 we're not compromising confidentiality or privacy issues, 72 72 00:02:31,260 --> 00:02:33,900 but we are still matching the exact thing. 73 73 00:02:33,900 --> 00:02:35,040 So if I had a list of 74 74 00:02:35,040 --> 00:02:37,380 all of my customer's credit card numbers, for instance, 75 75 00:02:37,380 --> 00:02:39,450 and I wanted to make sure they didn't leave the network, 76 76 00:02:39,450 --> 00:02:41,310 I wouldn't want to load up all their credit card numbers 77 77 00:02:41,310 --> 00:02:43,590 in my DLP, because if I did that, 78 78 00:02:43,590 --> 00:02:46,170 then somebody could get their credit cards from my DLP. 79 79 00:02:46,170 --> 00:02:47,003 So instead, 80 80 00:02:47,003 --> 00:02:49,500 I would hash those credit card numbers individually 81 81 00:02:49,500 --> 00:02:51,240 and store them in this structured database. 82 82 00:02:51,240 --> 00:02:52,920 And that's what I'm searching for. 83 83 00:02:52,920 --> 00:02:53,790 So as I see something 84 84 00:02:53,790 --> 00:02:56,400 that looks like a credit card number going out in email, 85 85 00:02:56,400 --> 00:02:57,270 I can hash that, 86 86 00:02:57,270 --> 00:03:00,300 compare that hash against my database, and if it matches, 87 87 00:03:00,300 --> 00:03:03,810 that's an exact data match, I would then flag that email. 88 88 00:03:03,810 --> 00:03:05,580 Next we have document matching. 89 89 00:03:05,580 --> 00:03:08,585 Now this is matching based on entire or partial document, 90 90 00:03:08,585 --> 00:03:10,680 again, based on hashing. 91 91 00:03:10,680 --> 00:03:12,990 So I have my new top secret Tiger program 92 92 00:03:12,990 --> 00:03:13,920 and I have my PowerPoint 93 93 00:03:13,920 --> 00:03:15,403 explaining everything we're going to do in it. 94 94 00:03:15,403 --> 00:03:18,152 I can create a full document match against that 95 95 00:03:18,152 --> 00:03:19,410 by hashing it, 96 96 00:03:19,410 --> 00:03:21,549 and if I see that hash file trying to leave the network, 97 97 00:03:21,549 --> 00:03:23,130 I would then block it. 98 98 00:03:23,130 --> 00:03:24,090 Now, in addition to that, 99 99 00:03:24,090 --> 00:03:26,100 I could do partial document matching, 100 100 00:03:26,100 --> 00:03:27,930 where I'm looking for certain slides in it 101 101 00:03:27,930 --> 00:03:30,360 or certain pictures, or certain words. 102 102 00:03:30,360 --> 00:03:32,820 And all of those would be based on smaller amounts 103 103 00:03:32,820 --> 00:03:35,700 that were then hashed and we could check for those as well. 104 104 00:03:35,700 --> 00:03:38,550 And then the final one we have is Statistical/Lexicon. 105 105 00:03:38,550 --> 00:03:41,190 Now, Statistical/Lexicon is a further refinement 106 106 00:03:41,190 --> 00:03:42,870 of partial document matching, 107 107 00:03:42,870 --> 00:03:44,070 which uses machine learning 108 108 00:03:44,070 --> 00:03:46,680 to also analyze a range of data sources. 109 109 00:03:46,680 --> 00:03:49,260 So we're not just using the standard document match 110 110 00:03:49,260 --> 00:03:50,730 based on what I fed the system, 111 111 00:03:50,730 --> 00:03:52,500 but I'm also using some machine learning 112 112 00:03:52,500 --> 00:03:54,900 to make it more intelligent and do a better job.