In this lesson,
I'm going to show you how to configure a DLP.
For this demonstration
we're going to be using the Google Suite
which is known as Google Workspace
to be able to configure a DLP for Google Drive, Google Chat,
as well as Google Mail, which is Gmail.
Now if you're using Office 365, it's a very similar process
and I don't want you to worry too much
about the exact specifics of what I'm doing
but really focus on the concepts and how DLP works
and is configured using the Setup Wizards.
Now, from within Google Workspace,
you're going to go to your admin panel,
which is located at admin.google.com.
This feature and functionality does not work
on free Google accounts.
This only works if you have a paid subscription to Google
for their Google Workspace product
at the enterprise or educational level.
Now, the first thing we're going to do
is we're going to configure it to be able to protect our chat
and our Google Drive from having data loss happening
by configuring a DLP solution there.
To find that, we're simply going to go
under security on the left menu bar
and then we're going to hit the down arrow.
We're going to click on access and data control
and then we're going to go down to data protection.
Once you click on data protection
the data protection screen will load.
From here, you can get information about your drive
as well as your chats that are being blocked or not blocked
based on the existing DLP solution.
So you could see here,
by default Google already has a DLP solution in place
and it's looking for things like email addresses
phone numbers, gender identity,
and other things like that.
You can notice here that we have 17.5%
of our Drive files marked as being sensitive
and being shared externally by their data type
based on October 6th when we had the scan run last
of all of our files, which has over 300,000 files.
As you can see here,
email addresses are by far the most common thing
that are being flagged here in DLP
because a lot of our stuff
uses email addresses as an example
like support@diontraining.com on some of our slides
and things like that that we use in our classes.
Now underneath this,
you're going to see that we have different rules
that are recommended for your organization.
In this case, they're saying we should prevent
sharing global email addresses
and we can review that recommended rule
and implement it if we wanted to.
So for example, if I go over here
and click on the "Review Recommended Rule,"
it will bring up the template for it,
which is already configured
and it's telling me, "Hey, this is already set up.
"All you have to do is accept it or you can edit this rule."
And what we're looking for here
is anything that looks like an email address
that's being sent outside of our organization.
And for here we have the alerts disabled,
Google Drive will give you a warning
if you try to share something
that contains this type of data,
and we consider this to be a low sensitivity.
Now, in our case,
it is not a rule we have activated yet
and if I wanted to set it to active,
which is set up right here,
I would simply click on the create button
to put this rule into effect.
Now, for our purposes,
we are not worried about email addresses being sent out
as part of our Google Drive files
because again we use email addresses
in almost everything we do
and most of them are examples or dummy email addresses
like test@test.com or support@diontraining.com
which is one that we use a lot in our training materials.
Let's go back and look at how we can configure our own rules
for something more specific that we might want to protect.
So from this screen, we're going to scroll down
and you can see that we have "Manage Rules."
We're going to click on that
and this will allow us to set up our data protection rules.
Right now you can see we have none available
in our domain or in our account.
So we want to add a rule
to be able to create something to protect.
So I'm going to go ahead and click on add a rule
and I'm going to create a new rule.
Now, when I create this new rule
I'm going to give it a name
and I'm going to call this "Block SSNs"
because I want to block Social Security numbers.
The description here is going to be
"Configure DLP to prevent SSNs
"from being shared in chat or Google Drive files."
All right?
That way when we see a long list
of hundreds of different DLP rules
we know what this rule is designed to do,
then you're going to choose your scope.
Your scope is who in the organization does this apply to?
By default, it's going to apply to everyone,
but there may be certain things you want to set up
for only certain groups of people.
For example, I could set up a rule that says
that none of my instructors can email out anything
that looks like an exam question
because we don't want our instructors
taking our exam database and posting it online
or in an open file like inside of Google Drive.
So that might be a place where we only want
a certain thing to be held under certain people,
or we can create rules that have to do with finances
and only our accounting department has those applied to them
because in my courses I could talk about the fact
that there is a credit card number
or an amount of money, like $15,
but on the accounting side
we don't want those details getting out.
And so these are the kind of things you can do
when you want to have a smaller area.
But for something like blocking Social Security numbers,
it's probably a good idea
to block all Social Security numbers
because nobody should be sending those things around.
So I'm going to use all in "Dion Training,"
then we're going to click on continue.
And here we're going to say what is this going to apply to,
which applications?
Now from here, you can do it in two main places.
One is Google Chat,
and this is for the messages you send
as well as the files you upload.
And the other one is Google Drive
for any files that are being added to Google Drive.
In our case, we want both of these
to be able to be checked to make sure
that we're not sending out Social Security numbers.
You'll notice when I click "file uploaded" under Google Chat
it is going to use OCR or optical character recognition
to also check any photographs that you upload
because those could contain information too
like a picture of your Social Security card.
Next, we'll hit continue.
And then here we're going to add our conditions.
What kind of data do we want this rule
to actually look for?
Now, what am I going to scan?
Is it all content or just certain content?
In our case, I want everything to be scanned.
And what am I scanning for?
Well, you can use matching predefined data types.
You can create a text string,
you can create a match for a regular expression
or you can match words from a word list.
So for example, maybe I'm working
on a top secret project called "Operation Neptune"
and I want to make sure that never gets out of my organization.
Well, I can set up a rule here
that matches the words from a list
or contains a text string of "Operation Neptune"
and if I see those words, I will block that message.
Now, in our case
we're trying to block Social Security numbers
and that is one of the predefined data types.
So I'm just going to select that.
As you go through this list,
they are in alphabetical order
based on predefined data types for different countries.
So I'm in the United States,
so I'm going to scroll all the way down to the U.S.
and under the U.S. I'm going to find the one
that says Social Security number.
Notice there's a lot of other things in here
like state names, taxpayer identifications,
passports different ID numbers,
like the German ID number or the Australian ID number,
your driver's license, your phone numbers,
your addresses, all that kind of stuff.
But for us, we worry about the Social Security numbers
so we're going to go ahead and click on that.
Then we're going to assign a likely threshold.
Where do we want actions to start happening
whether those are logging, whether those are alerting,
whether that is notifying the user that they're doing it
or is it blocking it all together?
Regardless of what action we're going to take,
we first have to define
when is the likely threshold going to apply.
Now, if you set it to something like very low
you are going to get a ton of false positives
and lots of things are going to be blocked
that shouldn't be blocked.
So I wouldn't recommend doing that.
Generally, if it's something
like a Social Security number or a phone number,
I will set it to high or very high.
Some people will go down as far as medium,
but for me, I like to set it at least at high.
Otherwise, you're going to have a lot of false positives
and a lot of work for you to look through.
And then you're going to look
at the minimum number of unique matches
and the minimum match count.
And both of these cases,
one is set as the default value,
so I'm going to go ahead and leave that there.
Now we have this set up
to search for US-based Social Security numbers.
If we have a high or very high likelihood of a match
we will then take some action.
So we can tick on continue.
We'll now define what action that is
and we're going to do this for each of those two applications.
First, we have Google Chat.
If somebody types in a Social Security number
in Google Chat, what do we want to happen?
Do we want to warn the user?
Do we want to block the message or do we want to audit?
Which means we're just going to log that thing
and tell our system administrators about it.
Again,
depending on what you're trying to accomplish with DLP
you want to make a decision based on what you're going to do.
In our case, I want to block the message
'cause I don't want people
sending Social Security numbers over chat.
And so we'll just go ahead and hit block message.
Now, from here
you'll select all the things it's going to apply to.
Does it apply to internal or external conversations,
spaces, chats, or one-on-one chats
and things like that?
And in addition to that,
you can also give a message to your user
if they're being warned or blocked.
So in my case, I'm going to use a custom message
that says "Your message may contain sensitive content like,"
I'm going to put "a Social Security number
"that shouldn't be shared
"based on your organization's policies.
"Edit as needed, check your admin if it doesn't seem right."
Okay?
And then we also are going to set this up for Google Drive.
And here if I have a file
with something that looks like a Social Security number,
do I want to block external sharing?
Warn on external sharing
or disable download, print and copying
for commenters and viewers?
In our case, I'm going to go ahead and block external sharing
because I don't want any files with Social Security numbers
being sent outside of our organization.
And then we have alerting.
When the event matches this rule criteria
the event is going to be reported in the security dashboard
and the alert center if applicable.
What level of events should it be reported under?
If this rule fires, is this considered a low event
or is this considered a medium or a high event?
Well, because we're talking about data getting out
and this isn't the most critical of data
we probably want to have this set as something like a medium.
But again, this is a risk-based decision
that your organization will come to.
And then in addition to that,
you can also send to the alert center
by sending additional detailed analysis
so your system administrators are able to go ahead
and take care of this issue.
And in addition to that, you can also email them
but we're not going to do that
because we're going to let our cybersecurity workforce
take care of going through all those alerts
and taking care of those themself.
And then we'll hit continue.
And from here you see all the details
of what we just configured
and then we're going to go all the way to the bottom
and then we will set it to be active.
Now this rule is in effect,
and if somebody tries to upload a file
with a Social Security number
or tries to send a Social Security number over Google Chat,
it will be blocked and it will then take the actions
that we specified in this rule.
Now the second thing we need to set up is one for Gmail.
Gmail is located in a separate place
but it's still underneath this admin dashboard.
To access it,
we're going to go on the left side under admin,
we're going to click on apps,
and then we're going to go to Google Workspace
and then we're going to click on Gmail
which is located about halfway down.
Once you're there, you're going to go down
and scroll on the right-hand side
all the way down to "Compliance."
And under "Compliance," you will find our DLP features.
Now from here, we have this turned on for everyone
and right now you can see the email and chat auto deletion
is currently not set.
Optical character recognition is turned on,
comprehensive mail storage is turned on.
And then we have other things as we go down.
Now, as we go down towards the bottom,
we are going to be able to see
that there's one called content compliance
and that is what they call DLP inside of Gmail.
So what we're going to do is hit "Configure"
and from here we're going to say what is required?
What are we going to call this?
So we're going to say
this is "Blocking SSNs being sent by email."
And then we're going to say, what is it going to affect?
Well, I just said we're sending it.
So we're going to set this as an outbound rule.
If somebody wants to send me
an inbound Social Security number, we'll accept it
but we're not going to be responsible for sending those out.
Then we're going to add an expression
that describes the content we want to search for.
And again, there are all of these preset things
that we can use.
We can use a simple content match,
an advanced content match
a metadata match or predefined content.
In our case, we're going to use predefined content.
And it already selected United States Social Security number
for me by default,
probably because that is what we just used
in the other rule.
So it's guessing that's probably what I want.
And then you'll see it also has a confidence threshold here
and we could set that again
from high, medium, low, et cetera.
I personally liked it to have a high threshold.
So I'm going to set that there
and then I'm going to hit save.
Now from here, I can scroll down
and we can see if any of the expressions above match.
What action do we want to have?
Do we want to modify the message?
Do we want to route it?
Do we want to mark it as spam?
Do we want to deliver it to somebody else?
Do we want to encrypt it?
All sorts of different options that we can choose.
And if you go here
you can also reject the message,
quarantine the message, et cetera.
So in this case, we might quarantine the message
anytime we find a Social Security number
and then we can notify the sender
when the mail is quarantined
so they know, hey, we have not sent this email out
because it's in quarantine
and they know that the other person they sent it to
is not going to get that message.
And then we can hit save.
And from here we now have a new rule
that's been applied here in content compliance.
That's it.
Now at this point, we have two rules set up.
We have one that's set up for our chat and our Google Drive
to help prevent something sensitive
like a Social Security number from being sent.
And we've also set the same thing inside of Gmail.
Now, the last thing I want to bring up
is this thing called the "data loss prevention" demo
that Google gives you access to inside of your account.
In here you actually could see
a sample email message up top.
Notice we have the welcome text
and it's all this information.
At the bottom, we have what they call the "Findings."
So using this sample, we can see on line five,
for example strings like this one
produce a phone number finding.
"Please call me.
"My phone number is 5552530000."
If you look down below
the first finding is a very likely high
and the string was 5552530000.
So this says, "Yes, this was a phone number
"we believe it's a phone number."
And looking at this,
we believe it's a phone number too.
As we go through the rest of this,
you'll see that it's parsing the information
to find any kind of information that it thinks is there
like email addresses, credit card numbers,
domain names and things like that.
And as we scroll through here,
you'll probably see a couple of those,
like the email address, right here,
like the credit card number, right here,
like the National Provider Identity, right here.
And you'll see that's down here as well
with these highly likely
as either a U.S. driver's license
or a healthcare ID.
And you have all the kind of information as you go through.
Now, if I go in here and I add something,
for example, and I say something like,
"This is my Social Security number,"
and I put something like 432-12-1234,
you'll now see, down below,
the second finding is a U.S. Social Security number
and is very likely high.
And it thinks that that is a Social Security number
because it takes the Social Security number format
of three digits, then two digits, then four digits.
Now, if I take out the words "Social Security"
in front of the number,
you're going to notice that the one at the bottom
is no longer going to recognize this as a high likelihood
of being a Social Security number.
And here you'll see
that Social Security dropped off our "Findings."
But if I go a little bit further down,
you'll see it will show up again down here,
but now it's unlikely and low.
Why is that?
Well, because it's just a nine digit number
separated by some dashes,
and they don't know if it's something
like an identification number
a Social Security number,
an employee ID or anything else.
It's just a number at this point.
Now, if I take away the word number
and I type in SSN,
again, you'll notice that the Social Security number
is going to pop right back up as very likely.
Now, the other thing I've noticed in this
is if you play with some numbers like 123-45-6789,
this is still showing up as a Social Security number
because it's in that format and has the word SSN.
But again, if I take this away,
"my identification number,"
now, you'll see it's going to go away from that
and it's going to look like something else.
And now it's a possible medium for Social Security
instead of a low or a high,
based on what it's seeing.
So this is a great way
to play with your data loss prevention tool
and see what will and what will not get caught
based on this system.
For example, if I type something like "jason@diontraining
and don't put the ".com,"
it's probably not going to realize
that that is actually an email,
and it doesn't.
Instead of being an email
they think it is my person's name
but my name is not jason@diontraining,
it's Jason Dion.
And so that's the way that this DLP stuff works.
It's scanning it, it's looking at context,
it's looking at what you've chosen
and it's figuring out what should be blocked
or what should not be blocked
based on the rules you set up
in your data loss prevention system.