1 00:00:00,120 --> 00:00:01,110 In this lesson, 2 00:00:01,110 --> 00:00:03,630 I'm going to show you how to configure a DLP. 3 00:00:03,630 --> 00:00:04,800 For this demonstration 4 00:00:04,800 --> 00:00:06,540 we're going to be using the Google Suite 5 00:00:06,540 --> 00:00:08,520 which is known as Google Workspace 6 00:00:08,520 --> 00:00:12,270 to be able to configure a DLP for Google Drive, Google Chat, 7 00:00:12,270 --> 00:00:15,090 as well as Google Mail, which is Gmail. 8 00:00:15,090 --> 00:00:18,480 Now if you're using Office 365, it's a very similar process 9 00:00:18,480 --> 00:00:19,800 and I don't want you to worry too much 10 00:00:19,800 --> 00:00:21,990 about the exact specifics of what I'm doing 11 00:00:21,990 --> 00:00:24,960 but really focus on the concepts and how DLP works 12 00:00:24,960 --> 00:00:27,330 and is configured using the Setup Wizards. 13 00:00:27,330 --> 00:00:29,040 Now, from within Google Workspace, 14 00:00:29,040 --> 00:00:30,660 you're going to go to your admin panel, 15 00:00:30,660 --> 00:00:33,300 which is located at admin.google.com. 16 00:00:33,300 --> 00:00:35,460 This feature and functionality does not work 17 00:00:35,460 --> 00:00:36,960 on free Google accounts. 18 00:00:36,960 --> 00:00:39,690 This only works if you have a paid subscription to Google 19 00:00:39,690 --> 00:00:41,790 for their Google Workspace product 20 00:00:41,790 --> 00:00:44,310 at the enterprise or educational level. 21 00:00:44,310 --> 00:00:45,660 Now, the first thing we're going to do 22 00:00:45,660 --> 00:00:48,420 is we're going to configure it to be able to protect our chat 23 00:00:48,420 --> 00:00:51,720 and our Google Drive from having data loss happening 24 00:00:51,720 --> 00:00:53,850 by configuring a DLP solution there. 25 00:00:53,850 --> 00:00:55,470 To find that, we're simply going to go 26 00:00:55,470 --> 00:00:57,600 under security on the left menu bar 27 00:00:57,600 --> 00:00:59,160 and then we're going to hit the down arrow. 28 00:00:59,160 --> 00:01:01,320 We're going to click on access and data control 29 00:01:01,320 --> 00:01:03,930 and then we're going to go down to data protection. 30 00:01:03,930 --> 00:01:05,489 Once you click on data protection 31 00:01:05,489 --> 00:01:07,530 the data protection screen will load. 32 00:01:07,530 --> 00:01:10,530 From here, you can get information about your drive 33 00:01:10,530 --> 00:01:13,230 as well as your chats that are being blocked or not blocked 34 00:01:13,230 --> 00:01:15,540 based on the existing DLP solution. 35 00:01:15,540 --> 00:01:16,920 So you could see here, 36 00:01:16,920 --> 00:01:20,610 by default Google already has a DLP solution in place 37 00:01:20,610 --> 00:01:22,830 and it's looking for things like email addresses 38 00:01:22,830 --> 00:01:24,330 phone numbers, gender identity, 39 00:01:24,330 --> 00:01:25,950 and other things like that. 40 00:01:25,950 --> 00:01:28,430 You can notice here that we have 17.5% 41 00:01:28,430 --> 00:01:31,080 of our Drive files marked as being sensitive 42 00:01:31,080 --> 00:01:33,930 and being shared externally by their data type 43 00:01:33,930 --> 00:01:37,230 based on October 6th when we had the scan run last 44 00:01:37,230 --> 00:01:41,250 of all of our files, which has over 300,000 files. 45 00:01:41,250 --> 00:01:42,330 As you can see here, 46 00:01:42,330 --> 00:01:44,730 email addresses are by far the most common thing 47 00:01:44,730 --> 00:01:46,860 that are being flagged here in DLP 48 00:01:46,860 --> 00:01:47,940 because a lot of our stuff 49 00:01:47,940 --> 00:01:49,740 uses email addresses as an example 50 00:01:49,740 --> 00:01:53,100 like support@diontraining.com on some of our slides 51 00:01:53,100 --> 00:01:55,770 and things like that that we use in our classes. 52 00:01:55,770 --> 00:01:56,760 Now underneath this, 53 00:01:56,760 --> 00:01:58,470 you're going to see that we have different rules 54 00:01:58,470 --> 00:02:00,540 that are recommended for your organization. 55 00:02:00,540 --> 00:02:02,610 In this case, they're saying we should prevent 56 00:02:02,610 --> 00:02:04,380 sharing global email addresses 57 00:02:04,380 --> 00:02:06,120 and we can review that recommended rule 58 00:02:06,120 --> 00:02:08,190 and implement it if we wanted to. 59 00:02:08,190 --> 00:02:09,840 So for example, if I go over here 60 00:02:09,840 --> 00:02:11,910 and click on the "Review Recommended Rule," 61 00:02:11,910 --> 00:02:13,530 it will bring up the template for it, 62 00:02:13,530 --> 00:02:14,850 which is already configured 63 00:02:14,850 --> 00:02:17,167 and it's telling me, "Hey, this is already set up. 64 00:02:17,167 --> 00:02:20,460 "All you have to do is accept it or you can edit this rule." 65 00:02:20,460 --> 00:02:21,690 And what we're looking for here 66 00:02:21,690 --> 00:02:23,820 is anything that looks like an email address 67 00:02:23,820 --> 00:02:26,400 that's being sent outside of our organization. 68 00:02:26,400 --> 00:02:28,620 And for here we have the alerts disabled, 69 00:02:28,620 --> 00:02:29,940 Google Drive will give you a warning 70 00:02:29,940 --> 00:02:30,960 if you try to share something 71 00:02:30,960 --> 00:02:32,520 that contains this type of data, 72 00:02:32,520 --> 00:02:34,950 and we consider this to be a low sensitivity. 73 00:02:34,950 --> 00:02:35,880 Now, in our case, 74 00:02:35,880 --> 00:02:37,830 it is not a rule we have activated yet 75 00:02:37,830 --> 00:02:39,270 and if I wanted to set it to active, 76 00:02:39,270 --> 00:02:40,470 which is set up right here, 77 00:02:40,470 --> 00:02:42,420 I would simply click on the create button 78 00:02:42,420 --> 00:02:44,070 to put this rule into effect. 79 00:02:44,070 --> 00:02:45,180 Now, for our purposes, 80 00:02:45,180 --> 00:02:48,030 we are not worried about email addresses being sent out 81 00:02:48,030 --> 00:02:50,220 as part of our Google Drive files 82 00:02:50,220 --> 00:02:51,990 because again we use email addresses 83 00:02:51,990 --> 00:02:53,880 in almost everything we do 84 00:02:53,880 --> 00:02:56,610 and most of them are examples or dummy email addresses 85 00:02:56,610 --> 00:03:00,450 like test@test.com or support@diontraining.com 86 00:03:00,450 --> 00:03:03,060 which is one that we use a lot in our training materials. 87 00:03:03,060 --> 00:03:06,000 Let's go back and look at how we can configure our own rules 88 00:03:06,000 --> 00:03:08,550 for something more specific that we might want to protect. 89 00:03:08,550 --> 00:03:10,800 So from this screen, we're going to scroll down 90 00:03:10,800 --> 00:03:12,900 and you can see that we have "Manage Rules." 91 00:03:12,900 --> 00:03:14,040 We're going to click on that 92 00:03:14,040 --> 00:03:16,770 and this will allow us to set up our data protection rules. 93 00:03:16,770 --> 00:03:19,140 Right now you can see we have none available 94 00:03:19,140 --> 00:03:20,790 in our domain or in our account. 95 00:03:20,790 --> 00:03:22,050 So we want to add a rule 96 00:03:22,050 --> 00:03:23,760 to be able to create something to protect. 97 00:03:23,760 --> 00:03:25,560 So I'm going to go ahead and click on add a rule 98 00:03:25,560 --> 00:03:27,420 and I'm going to create a new rule. 99 00:03:27,420 --> 00:03:28,740 Now, when I create this new rule 100 00:03:28,740 --> 00:03:29,910 I'm going to give it a name 101 00:03:29,910 --> 00:03:32,640 and I'm going to call this "Block SSNs" 102 00:03:32,640 --> 00:03:35,040 because I want to block Social Security numbers. 103 00:03:35,040 --> 00:03:37,177 The description here is going to be 104 00:03:37,177 --> 00:03:41,107 "Configure DLP to prevent SSNs 105 00:03:41,107 --> 00:03:46,020 "from being shared in chat or Google Drive files." 106 00:03:46,020 --> 00:03:46,853 All right? 107 00:03:46,853 --> 00:03:48,060 That way when we see a long list 108 00:03:48,060 --> 00:03:49,890 of hundreds of different DLP rules 109 00:03:49,890 --> 00:03:52,080 we know what this rule is designed to do, 110 00:03:52,080 --> 00:03:53,760 then you're going to choose your scope. 111 00:03:53,760 --> 00:03:56,700 Your scope is who in the organization does this apply to? 112 00:03:56,700 --> 00:03:59,010 By default, it's going to apply to everyone, 113 00:03:59,010 --> 00:04:00,990 but there may be certain things you want to set up 114 00:04:00,990 --> 00:04:02,790 for only certain groups of people. 115 00:04:02,790 --> 00:04:05,220 For example, I could set up a rule that says 116 00:04:05,220 --> 00:04:08,100 that none of my instructors can email out anything 117 00:04:08,100 --> 00:04:09,810 that looks like an exam question 118 00:04:09,810 --> 00:04:10,980 because we don't want our instructors 119 00:04:10,980 --> 00:04:13,620 taking our exam database and posting it online 120 00:04:13,620 --> 00:04:16,410 or in an open file like inside of Google Drive. 121 00:04:16,410 --> 00:04:17,970 So that might be a place where we only want 122 00:04:17,970 --> 00:04:20,339 a certain thing to be held under certain people, 123 00:04:20,339 --> 00:04:22,620 or we can create rules that have to do with finances 124 00:04:22,620 --> 00:04:25,290 and only our accounting department has those applied to them 125 00:04:25,290 --> 00:04:27,690 because in my courses I could talk about the fact 126 00:04:27,690 --> 00:04:29,100 that there is a credit card number 127 00:04:29,100 --> 00:04:31,470 or an amount of money, like $15, 128 00:04:31,470 --> 00:04:32,760 but on the accounting side 129 00:04:32,760 --> 00:04:34,500 we don't want those details getting out. 130 00:04:34,500 --> 00:04:35,820 And so these are the kind of things you can do 131 00:04:35,820 --> 00:04:37,710 when you want to have a smaller area. 132 00:04:37,710 --> 00:04:39,720 But for something like blocking Social Security numbers, 133 00:04:39,720 --> 00:04:40,620 it's probably a good idea 134 00:04:40,620 --> 00:04:42,510 to block all Social Security numbers 135 00:04:42,510 --> 00:04:44,640 because nobody should be sending those things around. 136 00:04:44,640 --> 00:04:46,920 So I'm going to use all in "Dion Training," 137 00:04:46,920 --> 00:04:48,660 then we're going to click on continue. 138 00:04:48,660 --> 00:04:51,120 And here we're going to say what is this going to apply to, 139 00:04:51,120 --> 00:04:52,590 which applications? 140 00:04:52,590 --> 00:04:54,840 Now from here, you can do it in two main places. 141 00:04:54,840 --> 00:04:56,070 One is Google Chat, 142 00:04:56,070 --> 00:04:57,630 and this is for the messages you send 143 00:04:57,630 --> 00:04:59,130 as well as the files you upload. 144 00:04:59,130 --> 00:05:00,660 And the other one is Google Drive 145 00:05:00,660 --> 00:05:03,180 for any files that are being added to Google Drive. 146 00:05:03,180 --> 00:05:04,950 In our case, we want both of these 147 00:05:04,950 --> 00:05:06,450 to be able to be checked to make sure 148 00:05:06,450 --> 00:05:09,060 that we're not sending out Social Security numbers. 149 00:05:09,060 --> 00:05:11,760 You'll notice when I click "file uploaded" under Google Chat 150 00:05:11,760 --> 00:05:14,820 it is going to use OCR or optical character recognition 151 00:05:14,820 --> 00:05:17,280 to also check any photographs that you upload 152 00:05:17,280 --> 00:05:19,110 because those could contain information too 153 00:05:19,110 --> 00:05:21,510 like a picture of your Social Security card. 154 00:05:21,510 --> 00:05:22,950 Next, we'll hit continue. 155 00:05:22,950 --> 00:05:24,870 And then here we're going to add our conditions. 156 00:05:24,870 --> 00:05:26,670 What kind of data do we want this rule 157 00:05:26,670 --> 00:05:28,050 to actually look for? 158 00:05:28,050 --> 00:05:29,250 Now, what am I going to scan? 159 00:05:29,250 --> 00:05:31,710 Is it all content or just certain content? 160 00:05:31,710 --> 00:05:33,990 In our case, I want everything to be scanned. 161 00:05:33,990 --> 00:05:35,310 And what am I scanning for? 162 00:05:35,310 --> 00:05:38,400 Well, you can use matching predefined data types. 163 00:05:38,400 --> 00:05:40,050 You can create a text string, 164 00:05:40,050 --> 00:05:42,240 you can create a match for a regular expression 165 00:05:42,240 --> 00:05:44,820 or you can match words from a word list. 166 00:05:44,820 --> 00:05:46,650 So for example, maybe I'm working 167 00:05:46,650 --> 00:05:49,410 on a top secret project called "Operation Neptune" 168 00:05:49,410 --> 00:05:52,050 and I want to make sure that never gets out of my organization. 169 00:05:52,050 --> 00:05:54,090 Well, I can set up a rule here 170 00:05:54,090 --> 00:05:55,590 that matches the words from a list 171 00:05:55,590 --> 00:05:58,710 or contains a text string of "Operation Neptune" 172 00:05:58,710 --> 00:06:01,590 and if I see those words, I will block that message. 173 00:06:01,590 --> 00:06:02,430 Now, in our case 174 00:06:02,430 --> 00:06:04,110 we're trying to block Social Security numbers 175 00:06:04,110 --> 00:06:06,150 and that is one of the predefined data types. 176 00:06:06,150 --> 00:06:07,500 So I'm just going to select that. 177 00:06:07,500 --> 00:06:08,610 As you go through this list, 178 00:06:08,610 --> 00:06:10,050 they are in alphabetical order 179 00:06:10,050 --> 00:06:12,630 based on predefined data types for different countries. 180 00:06:12,630 --> 00:06:13,830 So I'm in the United States, 181 00:06:13,830 --> 00:06:16,380 so I'm going to scroll all the way down to the U.S. 182 00:06:16,380 --> 00:06:18,120 and under the U.S. I'm going to find the one 183 00:06:18,120 --> 00:06:20,130 that says Social Security number. 184 00:06:20,130 --> 00:06:21,750 Notice there's a lot of other things in here 185 00:06:21,750 --> 00:06:24,180 like state names, taxpayer identifications, 186 00:06:24,180 --> 00:06:26,280 passports different ID numbers, 187 00:06:26,280 --> 00:06:29,220 like the German ID number or the Australian ID number, 188 00:06:29,220 --> 00:06:31,020 your driver's license, your phone numbers, 189 00:06:31,020 --> 00:06:32,910 your addresses, all that kind of stuff. 190 00:06:32,910 --> 00:06:35,310 But for us, we worry about the Social Security numbers 191 00:06:35,310 --> 00:06:36,960 so we're going to go ahead and click on that. 192 00:06:36,960 --> 00:06:39,450 Then we're going to assign a likely threshold. 193 00:06:39,450 --> 00:06:41,580 Where do we want actions to start happening 194 00:06:41,580 --> 00:06:44,610 whether those are logging, whether those are alerting, 195 00:06:44,610 --> 00:06:47,190 whether that is notifying the user that they're doing it 196 00:06:47,190 --> 00:06:49,260 or is it blocking it all together? 197 00:06:49,260 --> 00:06:51,120 Regardless of what action we're going to take, 198 00:06:51,120 --> 00:06:52,200 we first have to define 199 00:06:52,200 --> 00:06:54,840 when is the likely threshold going to apply. 200 00:06:54,840 --> 00:06:56,880 Now, if you set it to something like very low 201 00:06:56,880 --> 00:06:59,160 you are going to get a ton of false positives 202 00:06:59,160 --> 00:07:00,570 and lots of things are going to be blocked 203 00:07:00,570 --> 00:07:01,830 that shouldn't be blocked. 204 00:07:01,830 --> 00:07:03,630 So I wouldn't recommend doing that. 205 00:07:03,630 --> 00:07:04,800 Generally, if it's something 206 00:07:04,800 --> 00:07:07,080 like a Social Security number or a phone number, 207 00:07:07,080 --> 00:07:09,990 I will set it to high or very high. 208 00:07:09,990 --> 00:07:11,970 Some people will go down as far as medium, 209 00:07:11,970 --> 00:07:14,490 but for me, I like to set it at least at high. 210 00:07:14,490 --> 00:07:16,320 Otherwise, you're going to have a lot of false positives 211 00:07:16,320 --> 00:07:18,240 and a lot of work for you to look through. 212 00:07:18,240 --> 00:07:19,260 And then you're going to look 213 00:07:19,260 --> 00:07:20,970 at the minimum number of unique matches 214 00:07:20,970 --> 00:07:22,500 and the minimum match count. 215 00:07:22,500 --> 00:07:23,670 And both of these cases, 216 00:07:23,670 --> 00:07:25,680 one is set as the default value, 217 00:07:25,680 --> 00:07:27,600 so I'm going to go ahead and leave that there. 218 00:07:27,600 --> 00:07:29,100 Now we have this set up 219 00:07:29,100 --> 00:07:31,830 to search for US-based Social Security numbers. 220 00:07:31,830 --> 00:07:34,650 If we have a high or very high likelihood of a match 221 00:07:34,650 --> 00:07:36,600 we will then take some action. 222 00:07:36,600 --> 00:07:38,250 So we can tick on continue. 223 00:07:38,250 --> 00:07:40,650 We'll now define what action that is 224 00:07:40,650 --> 00:07:43,380 and we're going to do this for each of those two applications. 225 00:07:43,380 --> 00:07:44,910 First, we have Google Chat. 226 00:07:44,910 --> 00:07:46,680 If somebody types in a Social Security number 227 00:07:46,680 --> 00:07:48,630 in Google Chat, what do we want to happen? 228 00:07:48,630 --> 00:07:50,130 Do we want to warn the user? 229 00:07:50,130 --> 00:07:52,560 Do we want to block the message or do we want to audit? 230 00:07:52,560 --> 00:07:54,120 Which means we're just going to log that thing 231 00:07:54,120 --> 00:07:56,130 and tell our system administrators about it. 232 00:07:56,130 --> 00:07:56,963 Again, 233 00:07:56,963 --> 00:07:58,920 depending on what you're trying to accomplish with DLP 234 00:07:58,920 --> 00:08:01,800 you want to make a decision based on what you're going to do. 235 00:08:01,800 --> 00:08:03,870 In our case, I want to block the message 236 00:08:03,870 --> 00:08:04,770 'cause I don't want people 237 00:08:04,770 --> 00:08:06,840 sending Social Security numbers over chat. 238 00:08:06,840 --> 00:08:09,360 And so we'll just go ahead and hit block message. 239 00:08:09,360 --> 00:08:10,193 Now, from here 240 00:08:10,193 --> 00:08:12,270 you'll select all the things it's going to apply to. 241 00:08:12,270 --> 00:08:14,670 Does it apply to internal or external conversations, 242 00:08:14,670 --> 00:08:16,860 spaces, chats, or one-on-one chats 243 00:08:16,860 --> 00:08:18,000 and things like that? 244 00:08:18,000 --> 00:08:18,960 And in addition to that, 245 00:08:18,960 --> 00:08:21,030 you can also give a message to your user 246 00:08:21,030 --> 00:08:22,830 if they're being warned or blocked. 247 00:08:22,830 --> 00:08:25,140 So in my case, I'm going to use a custom message 248 00:08:25,140 --> 00:08:28,680 that says "Your message may contain sensitive content like," 249 00:08:28,680 --> 00:08:32,797 I'm going to put "a Social Security number 250 00:08:32,797 --> 00:08:33,630 "that shouldn't be shared 251 00:08:33,630 --> 00:08:35,347 "based on your organization's policies. 252 00:08:35,347 --> 00:08:37,710 "Edit as needed, check your admin if it doesn't seem right." 253 00:08:37,710 --> 00:08:38,543 Okay? 254 00:08:38,543 --> 00:08:41,220 And then we also are going to set this up for Google Drive. 255 00:08:41,220 --> 00:08:42,870 And here if I have a file 256 00:08:42,870 --> 00:08:44,760 with something that looks like a Social Security number, 257 00:08:44,760 --> 00:08:46,590 do I want to block external sharing? 258 00:08:46,590 --> 00:08:48,120 Warn on external sharing 259 00:08:48,120 --> 00:08:50,580 or disable download, print and copying 260 00:08:50,580 --> 00:08:52,350 for commenters and viewers? 261 00:08:52,350 --> 00:08:55,290 In our case, I'm going to go ahead and block external sharing 262 00:08:55,290 --> 00:08:57,570 because I don't want any files with Social Security numbers 263 00:08:57,570 --> 00:09:00,090 being sent outside of our organization. 264 00:09:00,090 --> 00:09:01,710 And then we have alerting. 265 00:09:01,710 --> 00:09:03,780 When the event matches this rule criteria 266 00:09:03,780 --> 00:09:06,060 the event is going to be reported in the security dashboard 267 00:09:06,060 --> 00:09:08,010 and the alert center if applicable. 268 00:09:08,010 --> 00:09:10,650 What level of events should it be reported under? 269 00:09:10,650 --> 00:09:13,500 If this rule fires, is this considered a low event 270 00:09:13,500 --> 00:09:16,170 or is this considered a medium or a high event? 271 00:09:16,170 --> 00:09:18,660 Well, because we're talking about data getting out 272 00:09:18,660 --> 00:09:20,610 and this isn't the most critical of data 273 00:09:20,610 --> 00:09:22,800 we probably want to have this set as something like a medium. 274 00:09:22,800 --> 00:09:24,840 But again, this is a risk-based decision 275 00:09:24,840 --> 00:09:26,700 that your organization will come to. 276 00:09:26,700 --> 00:09:27,840 And then in addition to that, 277 00:09:27,840 --> 00:09:29,730 you can also send to the alert center 278 00:09:29,730 --> 00:09:31,710 by sending additional detailed analysis 279 00:09:31,710 --> 00:09:33,900 so your system administrators are able to go ahead 280 00:09:33,900 --> 00:09:35,460 and take care of this issue. 281 00:09:35,460 --> 00:09:37,710 And in addition to that, you can also email them 282 00:09:37,710 --> 00:09:38,850 but we're not going to do that 283 00:09:38,850 --> 00:09:40,950 because we're going to let our cybersecurity workforce 284 00:09:40,950 --> 00:09:42,690 take care of going through all those alerts 285 00:09:42,690 --> 00:09:44,400 and taking care of those themself. 286 00:09:44,400 --> 00:09:45,810 And then we'll hit continue. 287 00:09:45,810 --> 00:09:47,580 And from here you see all the details 288 00:09:47,580 --> 00:09:48,930 of what we just configured 289 00:09:48,930 --> 00:09:50,520 and then we're going to go all the way to the bottom 290 00:09:50,520 --> 00:09:52,620 and then we will set it to be active. 291 00:09:52,620 --> 00:09:54,450 Now this rule is in effect, 292 00:09:54,450 --> 00:09:56,130 and if somebody tries to upload a file 293 00:09:56,130 --> 00:09:57,390 with a Social Security number 294 00:09:57,390 --> 00:10:00,180 or tries to send a Social Security number over Google Chat, 295 00:10:00,180 --> 00:10:03,180 it will be blocked and it will then take the actions 296 00:10:03,180 --> 00:10:05,100 that we specified in this rule. 297 00:10:05,100 --> 00:10:08,370 Now the second thing we need to set up is one for Gmail. 298 00:10:08,370 --> 00:10:10,110 Gmail is located in a separate place 299 00:10:10,110 --> 00:10:12,360 but it's still underneath this admin dashboard. 300 00:10:12,360 --> 00:10:13,290 To access it, 301 00:10:13,290 --> 00:10:15,570 we're going to go on the left side under admin, 302 00:10:15,570 --> 00:10:17,250 we're going to click on apps, 303 00:10:17,250 --> 00:10:18,900 and then we're going to go to Google Workspace 304 00:10:18,900 --> 00:10:21,090 and then we're going to click on Gmail 305 00:10:21,090 --> 00:10:23,550 which is located about halfway down. 306 00:10:23,550 --> 00:10:25,830 Once you're there, you're going to go down 307 00:10:25,830 --> 00:10:27,630 and scroll on the right-hand side 308 00:10:27,630 --> 00:10:29,400 all the way down to "Compliance." 309 00:10:29,400 --> 00:10:33,060 And under "Compliance," you will find our DLP features. 310 00:10:33,060 --> 00:10:36,480 Now from here, we have this turned on for everyone 311 00:10:36,480 --> 00:10:39,300 and right now you can see the email and chat auto deletion 312 00:10:39,300 --> 00:10:40,860 is currently not set. 313 00:10:40,860 --> 00:10:43,230 Optical character recognition is turned on, 314 00:10:43,230 --> 00:10:45,540 comprehensive mail storage is turned on. 315 00:10:45,540 --> 00:10:47,013 And then we have other things as we go down. 316 00:10:47,013 --> 00:10:49,260 Now, as we go down towards the bottom, 317 00:10:49,260 --> 00:10:50,160 we are going to be able to see 318 00:10:50,160 --> 00:10:52,440 that there's one called content compliance 319 00:10:52,440 --> 00:10:56,370 and that is what they call DLP inside of Gmail. 320 00:10:56,370 --> 00:10:58,800 So what we're going to do is hit "Configure" 321 00:10:58,800 --> 00:11:01,440 and from here we're going to say what is required? 322 00:11:01,440 --> 00:11:02,580 What are we going to call this? 323 00:11:02,580 --> 00:11:03,413 So we're going to say 324 00:11:03,413 --> 00:11:08,220 this is "Blocking SSNs being sent by email." 325 00:11:08,220 --> 00:11:09,990 And then we're going to say, what is it going to affect? 326 00:11:09,990 --> 00:11:11,490 Well, I just said we're sending it. 327 00:11:11,490 --> 00:11:13,320 So we're going to set this as an outbound rule. 328 00:11:13,320 --> 00:11:14,250 If somebody wants to send me 329 00:11:14,250 --> 00:11:16,167 an inbound Social Security number, we'll accept it 330 00:11:16,167 --> 00:11:18,870 but we're not going to be responsible for sending those out. 331 00:11:18,870 --> 00:11:20,340 Then we're going to add an expression 332 00:11:20,340 --> 00:11:22,410 that describes the content we want to search for. 333 00:11:22,410 --> 00:11:24,780 And again, there are all of these preset things 334 00:11:24,780 --> 00:11:25,770 that we can use. 335 00:11:25,770 --> 00:11:27,390 We can use a simple content match, 336 00:11:27,390 --> 00:11:28,740 an advanced content match 337 00:11:28,740 --> 00:11:31,100 a metadata match or predefined content. 338 00:11:31,100 --> 00:11:33,510 In our case, we're going to use predefined content. 339 00:11:33,510 --> 00:11:36,120 And it already selected United States Social Security number 340 00:11:36,120 --> 00:11:37,350 for me by default, 341 00:11:37,350 --> 00:11:39,270 probably because that is what we just used 342 00:11:39,270 --> 00:11:40,103 in the other rule. 343 00:11:40,103 --> 00:11:42,090 So it's guessing that's probably what I want. 344 00:11:42,090 --> 00:11:44,187 And then you'll see it also has a confidence threshold here 345 00:11:44,187 --> 00:11:45,780 and we could set that again 346 00:11:45,780 --> 00:11:48,600 from high, medium, low, et cetera. 347 00:11:48,600 --> 00:11:50,760 I personally liked it to have a high threshold. 348 00:11:50,760 --> 00:11:51,900 So I'm going to set that there 349 00:11:51,900 --> 00:11:53,520 and then I'm going to hit save. 350 00:11:53,520 --> 00:11:55,500 Now from here, I can scroll down 351 00:11:55,500 --> 00:11:57,780 and we can see if any of the expressions above match. 352 00:11:57,780 --> 00:11:59,670 What action do we want to have? 353 00:11:59,670 --> 00:12:01,170 Do we want to modify the message? 354 00:12:01,170 --> 00:12:02,250 Do we want to route it? 355 00:12:02,250 --> 00:12:03,810 Do we want to mark it as spam? 356 00:12:03,810 --> 00:12:05,310 Do we want to deliver it to somebody else? 357 00:12:05,310 --> 00:12:06,480 Do we want to encrypt it? 358 00:12:06,480 --> 00:12:08,550 All sorts of different options that we can choose. 359 00:12:08,550 --> 00:12:09,420 And if you go here 360 00:12:09,420 --> 00:12:10,800 you can also reject the message, 361 00:12:10,800 --> 00:12:12,630 quarantine the message, et cetera. 362 00:12:12,630 --> 00:12:14,790 So in this case, we might quarantine the message 363 00:12:14,790 --> 00:12:16,560 anytime we find a Social Security number 364 00:12:16,560 --> 00:12:18,690 and then we can notify the sender 365 00:12:18,690 --> 00:12:20,100 when the mail is quarantined 366 00:12:20,100 --> 00:12:22,410 so they know, hey, we have not sent this email out 367 00:12:22,410 --> 00:12:23,580 because it's in quarantine 368 00:12:23,580 --> 00:12:25,560 and they know that the other person they sent it to 369 00:12:25,560 --> 00:12:27,120 is not going to get that message. 370 00:12:27,120 --> 00:12:29,130 And then we can hit save. 371 00:12:29,130 --> 00:12:31,140 And from here we now have a new rule 372 00:12:31,140 --> 00:12:34,380 that's been applied here in content compliance. 373 00:12:34,380 --> 00:12:35,213 That's it. 374 00:12:35,213 --> 00:12:37,290 Now at this point, we have two rules set up. 375 00:12:37,290 --> 00:12:39,990 We have one that's set up for our chat and our Google Drive 376 00:12:39,990 --> 00:12:41,340 to help prevent something sensitive 377 00:12:41,340 --> 00:12:43,470 like a Social Security number from being sent. 378 00:12:43,470 --> 00:12:46,650 And we've also set the same thing inside of Gmail. 379 00:12:46,650 --> 00:12:48,000 Now, the last thing I want to bring up 380 00:12:48,000 --> 00:12:50,430 is this thing called the "data loss prevention" demo 381 00:12:50,430 --> 00:12:53,460 that Google gives you access to inside of your account. 382 00:12:53,460 --> 00:12:55,080 In here you actually could see 383 00:12:55,080 --> 00:12:57,390 a sample email message up top. 384 00:12:57,390 --> 00:12:58,740 Notice we have the welcome text 385 00:12:58,740 --> 00:13:00,300 and it's all this information. 386 00:13:00,300 --> 00:13:02,820 At the bottom, we have what they call the "Findings." 387 00:13:02,820 --> 00:13:06,660 So using this sample, we can see on line five, 388 00:13:06,660 --> 00:13:08,400 for example strings like this one 389 00:13:08,400 --> 00:13:09,937 produce a phone number finding. 390 00:13:09,937 --> 00:13:10,770 "Please call me. 391 00:13:10,770 --> 00:13:14,610 "My phone number is 5552530000." 392 00:13:14,610 --> 00:13:15,750 If you look down below 393 00:13:15,750 --> 00:13:18,420 the first finding is a very likely high 394 00:13:18,420 --> 00:13:22,260 and the string was 5552530000. 395 00:13:22,260 --> 00:13:24,547 So this says, "Yes, this was a phone number 396 00:13:24,547 --> 00:13:25,830 "we believe it's a phone number." 397 00:13:25,830 --> 00:13:26,663 And looking at this, 398 00:13:26,663 --> 00:13:28,830 we believe it's a phone number too. 399 00:13:28,830 --> 00:13:30,240 As we go through the rest of this, 400 00:13:30,240 --> 00:13:32,280 you'll see that it's parsing the information 401 00:13:32,280 --> 00:13:34,680 to find any kind of information that it thinks is there 402 00:13:34,680 --> 00:13:36,630 like email addresses, credit card numbers, 403 00:13:36,630 --> 00:13:38,520 domain names and things like that. 404 00:13:38,520 --> 00:13:39,780 And as we scroll through here, 405 00:13:39,780 --> 00:13:41,010 you'll probably see a couple of those, 406 00:13:41,010 --> 00:13:43,470 like the email address, right here, 407 00:13:43,470 --> 00:13:45,630 like the credit card number, right here, 408 00:13:45,630 --> 00:13:48,060 like the National Provider Identity, right here. 409 00:13:48,060 --> 00:13:49,620 And you'll see that's down here as well 410 00:13:49,620 --> 00:13:51,120 with these highly likely 411 00:13:51,120 --> 00:13:52,740 as either a U.S. driver's license 412 00:13:52,740 --> 00:13:54,360 or a healthcare ID. 413 00:13:54,360 --> 00:13:57,240 And you have all the kind of information as you go through. 414 00:13:57,240 --> 00:13:59,040 Now, if I go in here and I add something, 415 00:13:59,040 --> 00:14:00,877 for example, and I say something like, 416 00:14:00,877 --> 00:14:04,377 "This is my Social Security number," 417 00:14:04,377 --> 00:14:08,940 and I put something like 432-12-1234, 418 00:14:08,940 --> 00:14:10,650 you'll now see, down below, 419 00:14:10,650 --> 00:14:13,440 the second finding is a U.S. Social Security number 420 00:14:13,440 --> 00:14:15,150 and is very likely high. 421 00:14:15,150 --> 00:14:16,800 And it thinks that that is a Social Security number 422 00:14:16,800 --> 00:14:19,380 because it takes the Social Security number format 423 00:14:19,380 --> 00:14:22,500 of three digits, then two digits, then four digits. 424 00:14:22,500 --> 00:14:25,470 Now, if I take out the words "Social Security" 425 00:14:25,470 --> 00:14:26,850 in front of the number, 426 00:14:26,850 --> 00:14:28,650 you're going to notice that the one at the bottom 427 00:14:28,650 --> 00:14:31,680 is no longer going to recognize this as a high likelihood 428 00:14:31,680 --> 00:14:33,330 of being a Social Security number. 429 00:14:33,330 --> 00:14:34,163 And here you'll see 430 00:14:34,163 --> 00:14:35,970 that Social Security dropped off our "Findings." 431 00:14:35,970 --> 00:14:37,770 But if I go a little bit further down, 432 00:14:37,770 --> 00:14:40,140 you'll see it will show up again down here, 433 00:14:40,140 --> 00:14:42,270 but now it's unlikely and low. 434 00:14:42,270 --> 00:14:43,260 Why is that? 435 00:14:43,260 --> 00:14:45,060 Well, because it's just a nine digit number 436 00:14:45,060 --> 00:14:46,500 separated by some dashes, 437 00:14:46,500 --> 00:14:47,580 and they don't know if it's something 438 00:14:47,580 --> 00:14:48,840 like an identification number 439 00:14:48,840 --> 00:14:50,040 a Social Security number, 440 00:14:50,040 --> 00:14:51,600 an employee ID or anything else. 441 00:14:51,600 --> 00:14:53,490 It's just a number at this point. 442 00:14:53,490 --> 00:14:54,447 Now, if I take away the word number 443 00:14:54,447 --> 00:14:56,280 and I type in SSN, 444 00:14:56,280 --> 00:14:58,170 again, you'll notice that the Social Security number 445 00:14:58,170 --> 00:15:00,930 is going to pop right back up as very likely. 446 00:15:00,930 --> 00:15:02,310 Now, the other thing I've noticed in this 447 00:15:02,310 --> 00:15:05,620 is if you play with some numbers like 123-45-6789, 448 00:15:07,980 --> 00:15:10,320 this is still showing up as a Social Security number 449 00:15:10,320 --> 00:15:13,320 because it's in that format and has the word SSN. 450 00:15:13,320 --> 00:15:15,577 But again, if I take this away, 451 00:15:15,577 --> 00:15:18,270 "my identification number," 452 00:15:18,270 --> 00:15:20,730 now, you'll see it's going to go away from that 453 00:15:20,730 --> 00:15:22,230 and it's going to look like something else. 454 00:15:22,230 --> 00:15:25,050 And now it's a possible medium for Social Security 455 00:15:25,050 --> 00:15:26,580 instead of a low or a high, 456 00:15:26,580 --> 00:15:28,020 based on what it's seeing. 457 00:15:28,020 --> 00:15:28,853 So this is a great way 458 00:15:28,853 --> 00:15:30,750 to play with your data loss prevention tool 459 00:15:30,750 --> 00:15:32,910 and see what will and what will not get caught 460 00:15:32,910 --> 00:15:34,260 based on this system. 461 00:15:34,260 --> 00:15:38,580 For example, if I type something like "jason@diontraining 462 00:15:38,580 --> 00:15:40,200 and don't put the ".com," 463 00:15:40,200 --> 00:15:41,430 it's probably not going to realize 464 00:15:41,430 --> 00:15:43,080 that that is actually an email, 465 00:15:43,080 --> 00:15:43,913 and it doesn't. 466 00:15:43,913 --> 00:15:45,480 Instead of being an email 467 00:15:45,480 --> 00:15:47,910 they think it is my person's name 468 00:15:47,910 --> 00:15:49,650 but my name is not jason@diontraining, 469 00:15:49,650 --> 00:15:50,910 it's Jason Dion. 470 00:15:50,910 --> 00:15:53,220 And so that's the way that this DLP stuff works. 471 00:15:53,220 --> 00:15:55,530 It's scanning it, it's looking at context, 472 00:15:55,530 --> 00:15:57,120 it's looking at what you've chosen 473 00:15:57,120 --> 00:15:58,710 and it's figuring out what should be blocked 474 00:15:58,710 --> 00:15:59,940 or what should not be blocked 475 00:15:59,940 --> 00:16:01,350 based on the rules you set up 476 00:16:01,350 --> 00:16:03,150 in your data loss prevention system.