Enhancing DLP

What exactly is DLP? The general consensus is that DLP technologies worth their salt should include some form of content awareness. Was recently at the Gartner Security Summit and Eric Ouellet made a strong case for it - if you get a chance to see the presentation, it is very well worth it and provides a great overview.

Also, just read a good article in CSO Magazine by Bill Brenner on technologies that can extend the value of DLP. Am glad that folks are seeing the value of encryption within a data leakage context and am encouraged by the comment by William Pfeifer about the requirement to protect the data at all times and not just at rest. This, I believe, is the right information-centric approach.

One point I think Bill might have missed is the value of Identitiy technologies (IAM) to enhance DLP as well. I strongly believe that the combination of IAM+content-aware DLP+persistent encryption can solve (from a technology perspective) many of the challenges we face. This gives control over roles, the content itself as well as completing the action of protecting the data by enforcing specific access control triggers within the data itself.

Aha - true "discover once, protect forever" :)

The Chinese Cyber very, very, very, targeted attack

Incredible news about the cyber attack launched from China - and its taking over systems worldwide.

What is amazing about this is the large number of countries attacked - 103 with the small number of actual computers affected - 1200! Just about 10 systems a country - now that's a targeted attack! And to top it off, apparently over 30% were "high-value" systems and those within embassies of many countries.

It is remarkable that something this targeted can be achieved using one malware - unless it is the secondary phase after another one was spread wide, segmented the market and finally targeted those that are important.

Without taking away from the seriousness and criminality of it, the marketer in me is impressed - and shocked.

Breaches: The collective yawn

Are the breach laws not effective at all? Are the public not concerned or not paying any attention? Not sure what we should expect - outrage, public demonstrations, letters to senators? But as the recent article from NetworkWorld points out, folks don't seem to much care...

Possibly this apathy is picked up by organizations and combined with the multitude of complex regulations and data protection solutions - and the result is folks not knowing how to address these issues. The challenges may seem too much.

I think the right way to approach the problem is take a risk based approach - what is the most vulnerable area, how do we protect that. Start with something small, since inaction does not help at all. For many organization worried about losing assets outside the organization, protect the mobile data - that which goes outside the organization. This would mean laptops, USB devices to start out with and go from there.

Obviously if the threat is internal negligence, maybe look at DLP solutions that can, based on policy, protect sensitive data from leaking outside the enterprise.

The main point it, start on the path. Don't wait to develop a comprehensive plan that takes a year to study and setup - look for quick hits and gains. As you deploy you will be able to develop the right plan for the enterprise.

Scary criminal activity and data theft

Even though one knows that criminals are increasingly behind some of the larger data breaches, it not until we get hit on the head do we pay attention. I just read this recent article from USA Today about the latest attacks on corporate intellectual property - I tell you, this is serious stuff.
Any organization not taking this very seriously is doing a disservice to its stakeholders and shareholders.

The problem seems intractable - for every hole you think you have blocked two open up to allow these criminals to grab data. What does any organization do?

I think the answer lies in the data itself - one cannot go about protecting the periphery to protect the asset. One has to protect the asset itself - in this case the data. If the data itself is always encrypted, at rest as well as in motion (even when it is grabbed of the computer by malware), we might have a shot at preventing this.

Else we are putting our collective heads in the sand thinking that encrypting the laptop drive or USB device is enough...

Protect everything? Is that a better DLP?

I was reading an interesting post about DLP at Securosis. Rich has deep expertise and an excellent way of explaining what the area is all about...

However, the post got me thinking - how do we reliably understand content in order to differentiate and protect what's important? Do we have easy to manage policies yet? Can the policies adapt easily based on chaning business? Is the technology ready?

I do see traditional DLP solutions being very complementary to data encryption products - one identifies it, finds it and the other can protect it. Nice and easy.

However, I am thinking that maybe an interim step might also be needed before we can get to nirvana of understanding content, proactive policies etc. What if we are able to protect all data (or even data that are on these file shares, laptops etc ) regardless of what is in them - and keep them persistently protected at rest and in motion? Think of it as the blunt approach - similar to using FDE to protect all the contents within a hard drive regardless of the sensitivity of an individual file within.

From a customer perspective, they don't want anyone without the right authorization to see any data - that's all. This can be achieved by persistent, data-centric or information-centric protection without any differentiation based on understanding the content.

Could/should DLP be redefined, thus?

Share, but share insecurely?

In all the hoopla about IT admins getting into your stuff, (from the recent Cyber-Ark survey) most folks might have missed this interesting nugget...

"Majority are sloppy at handling and exchanging sensitive data Seven out of 10 companies rely on out-dated and insecure methods to exchange sensitive data when it comes to passing it between themselves and their business partners with 35% choosing to email sensitive data, 35% sending it via a courier, 22% using FTP and 4% still relying on the postal system. This shouldn’t be any big surprise when you learn that 12% of these senior IT personnel who were interviewed also choose to send cash in the post!"

Over 70% of companies share sensitive information within and without in an insecure way! Here we are, locking down data at rest within the company. However, as it leaves the safe haven - it is sent out in the clear!

This is where I think a more information-centric approach can help - protect the data rather than the devices and wherever the data goes, the protection follows. A bit like Mary's little lamb, if you get my drift...

The "IT admin bad guy"? Not sure I buy it much..

The recent survey on IT Admins misusing privileges might be accurate - but am not sure I buy it much. I'd like to see some of the questions as well :)

Most of the IT admins I have met with have a sense of the responsibility that comes with their power. True, there might be some bad eggs or apples in the bunch, but overall I think they are ethically sound people.

This is like implying that since the guard to the safe has access to it, he/she might be taking advantage of that ability. My view is that the state of technology is (or was) such that there is no way around it - there had to be someone who has access.

However, to get this monkey off the back of IT admins, all they have to do it install technology that creates isolation between content and infrastructure. IT admins don't lose anything - they get their work done, and they wont be scapegoats for leaked data or bear the burden because of a few rotten apples.

I spy - employees snooping around?

Apparently many employees ( nearly half ) have the habit of snooping around within the company. This according to a new research study by Cyber-Ark. Many gain access using privileged accounts such as administrator or root passwords, which the research found were not changed that often.

"Cyber-Ark said privileged passwords get changed far less frequently than user passwords, with 30 percent being changed every quarter and 9 percent never changed at all, meaning that IT staff who have left an organization could still gain access."

This is a bit unnerving - most organizations should be following compliance mandates such as SOX to isolate administrator access from content. And using technology to enforce this..

Medical records - the new frontier in data theft?

Looks like supply and demand and the good old laws of economics are catching up to data breaches as well. Seems like medical records is the new black - more criminals are focusing on getting access to this rather than boring credit card numbers, bank accounts etc.

There is a related scary part to this story - (other than the fact that medical records are under active threat)

The scary part is the huge numbers of available stolen credit card, bank account information out there - this is depressing prices all over the world for this data! The laws of supply/demand are taking over and making this a commodity. For example, not too long ago, prices for a valid credit card/bank card with a pin was $100 and now with the flood of such products, the prices have come down to $10-20 range.

The logical conclusion follows that criminals are becoming so good at getting access to sensitive data - this is causing flooding in the market! They are therefore now moving up the value chain to get to even more valuable data. Presumably, stuff they can sell for more than $100!

Medical records under threat

Just saw a disturbing article on how folks are targeting medical records. Apparently Finjan (a security vendor) was trolling for malware and came across a large chunk of data with patient information etc - and get this, it was available for purchase for the highest bidder!

By now all of us are aware that hackers are no longer kids looking for laughs or thrills - they are the new criminal organizations. These organizations make it a business buying and selling data - be it credit cards, bank account information etc.

I suspect medical information can be used for many things - identity theft, blackmail, maybe even insurance fraud. Who knows?

But the main point here is this - it does appear that medical and patient information has value to criminal organizations and this is something to worry about. They will do anything to get their hands on this...

Jeez - State department laptops missing..

This is bad news - folks with some of the most sensitive information seem to be willy-nilly with their laptops. How can we expect plain old corporate folks to take protection seriously?

And this snippet takes the cake "...about 400 missing laptops belonging to the Anti-Terrorism Assistance Program ..."

I wonder how many of these were targeted and stolen... If so, is a cold boot attack more likely against these types of assets?

The insider threat - jobs at risk!

Looks like Her Majesty's Revenue & Customs does not take lightly to employees peeking at sensitive data - they have disciplined around 600 employees.

Lots of questions come up - intentional breach, stupid mistakes etc. If the data were protected with the right policies and access controls would this have been prevented?

My Dad always said when I leave stuff in my car seat - "Don't tempt folks. Even if they are not thieves, the sight of something valuable can turn people". I started believing this after my car was broken into and it turned out to be a neighbor kid.

I firmly believe that taking temptation away (in this case not having access to data you should not) is a great strategy. Insider threats are more troubling, since this is targeted at the most sensitive and valuable data - while the outsider threat depends a lot on luck to get to this.

The insider threat - Lending Tree

We spend so much time and processes protecting against the unknown external threat - it is time we also took the insider threat more seriously. Case in point - the recent news from Lending Tree about insiders giving out passwords to external entities.

Not that the above could have been easily circumvented by technology, but good process and education of employees would have helped. When trusted employees start sharing passwords, things become very dicey.

More process, threats of termination - interesting times ahead...

Best practices - notification of a breach

CSO magazine has a facinating article on notifying stakeholders of a breach. They compare and contrast two styles of letters to customers - interesting stuff. How does one provide details without overwhelming the reader who may not understand everything? Does one mention steps beign taken, other breaches in the industry?

I wonder how many folks within the company (as well as lawyers, PR folks) might be involved in this task? I assume this increases the visibility of data breaches across the company - mainly because of the number of senior folks involved. Bit late though, now that the horse has left the barn...

Wireless holes - protecting retailers from themselves

Interesting article in Network World on some of the holes many retailers have in their wireless infrastructure. Apparently, wireless security company AirDefense walked around New York City and ran their analyzer against many small retailers. They found that over a third did not have even basic and easily hacked WEP protection!

According to the article:

"..access to the unprotected access points and unencrypted traffic -- spilled well beyond the walls of the store. Attackers could set up shop outside, snoop on the WLAN traffic, and collect MAC addresses and other data that could be used to hack deeper into the store’s net, servers and data. "

Apparently the TJX scenario has not yet put feet to the fire for smaller retailers! Now, I agree that some technology solutions can be expensive - but surely, using inbuilt protection all wireless products come with can't be that hard?

Data leakage and being proactive about it..

My colleague, Hugh, has an interesting point in his article on keeping barrels out of the water. I agree that by the time information is out on the network and the IT Security folks don't know whether the data is sensitive or not, the battle is nearly lost. Access control and protection are vital. However, I also think classification is a huge issue as well.

Which brings us back to understanding data in an organization being the "a stitch in time" approach. We need to be able to classify, and identify interesting data. Don't get me wrong - this is a hard problem to address. Too much data, information about them being distributed, end users not being reliable to classify it, the changing business dynamics changing what is sensitive from day to day - all of these make it feel like a Herculean task. Nick Selby from the 451 Group also participated in an interesting Q&A on this.

Maybe the better approach is - start small (as always!). Much of it will be process focusses with help from the technologies currently emerging in this space. Be interesting to see how this area evolves in the future....

What’s next in Data Leakage Prevention - Keeping your barrels out of the water

I recently attended the SANS WhatWorks in Stopping Data Leakage and Insider Threat Summit in Orlando. The Summit included a variety of sessions where vendors, industry experts, and end users talked about their experience with Data Leakage Prevention (DLP) products. There were also plenty of networking opportunities to talk one on one with presenters and peers. I applaud SANS on the program and highly recommend the WhatWorks series to anyone looking to implement one of the featured technologies.

The Summit provided me the opportunity to learn more about the various types of DLP products on the market today and while there is not one product that is right for every company, I liked what I heard from Vericept and Tablus. Vericept has one of the more mature products in this space and Tablus is poised to have a big impact as it is integrated into the RSA product suite.

There are different approaches to the data leakage problem. For example, some vendors sit at the edge of the network while others deploy an agent to the endpoint. Rich Mogull has an excellent whitepaper on how to choose a DLP solution. The one thing that all of the solutions have in common is that they are designed to keep sensitive data from leaving the enterprise or, as one presenter described it, to keep the barrels from going over the falls. He went on to say that while this is important, the best way to protect your data is to keep the barrels out of the water in the first place.

Data Leakage Prevention products solve a real problem today but you can expect much more than data monitoring and blocking from your DLP vendor in the future. In addition to monitoring outbound traffic, many DLP products are good at finding unstructured data much like a search engine and then classifying it as sensitive or top secret based on the criteria that your business outlines. While this requires various amounts of tuning and configuration, you will get a better understanding of where your sensitive data resides and who is using it.

However, finding and classifying your data is not enough. Forward looking DLP vendors are extending their products and developing partnerships to help you protect and manage the data they discover. These vendors are looking to implement data control polices to enforce access rights, the use of encryption, retention schedules, and even a time for the data to self destruct. This data-centric approach will allow companies to enforce their paper polices on electronic data and reduce the risks associated with the growing volumes of unstructured data.

The best way to protect your data is to manage it. You can spend a lot of time and energy trying to stop the barrels from going over the falls or you can keep the barrels out of the water in the first place by controlling access and enforcing usage polices.

Looking for more information about what DLP solutions can do for you? Check out what Nick Selby of The 451 Group has to say on his blog. Two of his recent posts on this topic are ADL doesn’t cure piles, either and Tying the Business Problem of Data Leakage to IT Processes - recovering from the deer-in-the-headlights moment.