Data Loss Prevention: Keeping Your Crown Jewels Safe in the Digital Age

I had originally wrote a post on SADA’s Engineering Blog where I talked briefly on what Data Loss Prevention (DLP) is and why it is an essential security tool; as well I provided a simple a use case for Google Cloud Platform’s Cloud DLP.

In this post I wanted to expand on the topic of DLP in general and to really ask the questions “What is Data Loss Prevention and why should we use it?”.

What is Data Loss Prevention?

Data is the lifeblood of any organization. It holds financial records, customer information, intellectual property, and a wealth of other sensitive details. Protecting this data from unauthorized access, leaks, and breaches is paramount. This is where Data Loss Prevention (DLP) comes in.

Data Loss Prevention or DLP for short, is a set security tools and procedures that work together that your organization can use to protect itself from theft of data, breaches, inadvertent or malicious loss of data, and/or unauthorized access, sharing, transfer, and manipulation of sensitive data. These tools use artificial intelligence (AI) and machine learning (ML) as well as automation to monitor, protect, and prevent data breaches/leaks of sensitive information across various platforms, whether on-premise of in the cloud

These tools also allow your organization to achieve compliance with regulations such as the Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulations (GDPR), and Payment Card Industry Data Security Standard (PCI DSS).

DLP can be deployed across various data states:

• Data at rest:
  • This refers to data stored on servers, databases, and employee devices. DLP can encrypt data at rest, making it unreadable even if accessed by unauthorized users.
• Data in motion:
  • This is data being transferred across networks, like emails or file uploads. DLP can scan for sensitive information in outgoing traffic and block transmissions that violate security policies.
• Data in use:
  • This refers to data being actively used by employees. DLP can monitor applications and user behavior to prevent accidental or malicious data leaks.

DLP technologies typically support one or more of the following cybersecurity activities:

• Prevention:
  • Establish a real-time review of data streams and immediately restrict suspicious activity or unauthorized users
• Detection:
  • Quickly identify anomalous activity through improved data visibility and enhanced data monitoring measures
• Response:
  • Streamline incident response activities by tracking and reporting data access and movement across the enterprise
• Analysis:
  • Contextualize high-risk activity or behavior for security teams to strengthen prevention measures or inform remediation activities

Why is DLP so important and why is it needed?

As I mentioned in my previous article, DLP is an essential tool in your arsenal to protect your organizations sensitive information as well as aid in organizational risk reduction strategy. This is especially true when it comes to protecting and securing endpoint devices such as mobile devices, desktop/laptop computers, and servers.

In the 2023 Data Breach Investigation Report (DBIR) from Verizon recaps the number of global data breaches and cyber attacks in 2023. According to this report there was around 5,119 confirmed data breach reported which is slightly lower than the number of breaches in the previous years report of which was 5,212.

Another report from the Physicians Practice indicates that 2023 saw twice as many patient data breaches compared to 2022.

These numbers increasingly grow year over year which is very alarming especially as we start to see the growing adoption of Gen AI and AI based attacks and why having proper security control in place is so important.

Another prime example of poor security controls is the October 2023 attack on Marina Bay Sands Resort as highlighted in the following article and why tools like DLP and Endpoint Detection and Response (EDR) are ever more important.

All of these attacks, incidents, and data breaches could have been prevented and/or minimized with the right security controls, tooling (such as DLP) and proper security training in place.

Data breaches are a constant threat, and the consequences can be severe.

Data leaks can happen due to a variety of reasons, but unlike what you might think, it’s not always malicious hackers. Here are the a few of main culprits:

• Human error and weak security practices:
  • This can include things like weak passwords, improperly configured systems, or even accidentally sending data to the wrong person.
• Insider threats:
  • Sometimes employees, contractors, or even temporary workers with access to sensitive data can be the ones who leak it, either intentionally or unintentionally.
• Outdated software:
  • Software with known vulnerabilities is a prime target for hackers who can exploit those weaknesses to gain access to data.
• Exfiltration:
  • Data exfiltration is the process of stealing or transferring data from a network and/or device.
  • Can be done by outsiders or insiders performing cyber attacks such as phishing or DDoS attacks.
  • Data which is typically exfiltrated includes login credentials and intellectual property

A data breach can result in:

• Financial losses:
  • Organizations can face hefty fines for non-compliance with data privacy regulations.
• Reputational damage:
  • A data breach can seriously erode customer trust and brand reputation.
• Loss of competitive advantage:
  • Stolen intellectual property can give competitors a significant edge.

DLP helps mitigate these risks by providing an extra layer of security for your sensitive data.

Benefits of a DLP Solution

The following are some key benefits that a DLP solution brings to your organizations security profile.

• Enhanced data security:
  • DLP helps prevent unauthorized access, leaks, and breaches of sensitive data.
• Improved regulatory compliance:
  • DLP can help organizations meet the requirements of data privacy regulations like GDPR and HIPAA.
• Reduced risk of financial loss:
  • By preventing data breaches, DLP can help organizations avoid costly fines and penalties.
• Increased productivity:
  • With robust data security in place, employees can focus on their work without worrying about data leaks.

DLP policy adoption and deployment best practices

Due to the intricate nature of the threat landscape and the complex nature of most corporate networks, the first step in implementing a DLP policy is often to identify a trusted and capable cybersecurity partner. Whether your organization uses a third-party cybersecurity partner or keeps it in house, having a dedicated team of knowledgeable security professionals will be critical in helping the business at every stage of the program, from strategy and design to implementation and operation.

Below are some best practice guidelines to help organizations maximize their DLP investment and ensure the chosen solution aligns to their security strategy and measures:

1. Data Classification:
   • Identify and classify your sensitive data (financial records, customer data, intellectual property). This helps prioritize DLP efforts.
2. Risk Assessment:
   • Understand the potential risks to your data. This includes insider threats, malware, and accidental leaks.
3. Policy Development:
   • Create clear policies on data handling, access control, and acceptable use. Ensure alignment with compliance regulations.
4. Stakeholder Identification & Engagement:
   • Get buy-in from key players including, but is not limited to, IT security, legal, HR, and business unit representatives.
   • Their involvement ensures the DLP strategy aligns with business needs and regulations.
5. DLP Tool Selection:
   • Research and choose a DLP solution that fits your organizational needs.
   • Consider factors like budget, data types, deployment options (cloud, on-premise).
6. DLP Implementation Plan:
   • Once a DLP solution is procured, IT develops an implementation plan to roll out the DLP solution which includes, but not limited to, the following:
     • start state, desired end state and steps to get from one to the other
     • steps on how discovery of sensitive items works
     • development of policies and the order in which they will be implemented
     • how any prerequisites will be addressed
     • a plan for how you’ll simulate policies before implementing them for enforcement
     • a plan for how you’ll train your end users
     • a plan for how you’ll tune your policies
     • a plan for how you’ll review and update your data loss prevention strategy based on changing regulatory, legal, industry standard, or intellectual property protection and business needs
7. Data Discovery and Monitoring:
   • Implement the DLP tool to discover and monitor sensitive data across endpoints, networks, and storage systems.
8. Control Selection:
   • Define DLP controls based on identified risks and policies. This could include content inspection, encryption, data transfer restrictions.
9. User Training and Awareness:
   • Educate employees about DLP policies and how the DLP tool works. Foster a culture of data security.
10. Testing and Refinement:
    • Continuously test your DLP solution to ensure effectiveness. Monitor logs and refine rules as needed.

The following is merely a guideline for a typical DLP implementation:

• Phase 1 (1-2 Months):
  • Data classification, risk assessment, policy development.
• Phase 2 (2-3 Months):
  • DLP tool selection, pilot deployment with a small test group.
• Phase 3 (2-4 Months):
  • User training, DLP tool rollout across the organization, policy enforcement.
• Phase 4 (Ongoing):
  • Continuous monitoring, log analysis, DLP rule adjustments, user awareness campaigns.

This is above steps are a general framework, adapt it to your organization’s specific needs and involve key stakeholders from IT, security, and legal departments as needed.

Always communicate the DLP strategy clearly to gain user buy-in.

By following these steps and implementing a well-defined plan, you can effectively adopt a DLP tool and strategy to safeguard your sensitive data.

Deployment Architecture Types

There are four main DLP deployment architectures:

• Endpoint DLP:
  • Protects data on endpoint devices like laptops, desktops, and mobile devices.
  • Assists in classification of regulatory, confidential, proprietary, or business-critical data to streamline reporting and compliance requirements
  • Tracks data stored on endpoint devices both on and off the network
  • The following are a few top listed Endpoint DLP solutions on the market:
    • McAfee Endpoint DLP (now Trellix Endpoint DLP):
      • Offers a comprehensive suite for endpoint data protection, preventing unauthorized data transfer through various channels (email, USB, cloud storage). Features data encryption, fingerprinting, and keyword detection. Integrates with McAfee ePO platform for centralized management.
    • CrowdStrike Falcon Endpoint Protection (with DLP module):
      • Cloud-native solution known for its lightweight endpoint agent and real-time threat detection. The DLP module provides data discovery, classification, and monitoring capabilities. Focuses on user behavior analysis and risk scoring to identify potential data exfiltration attempts.
    • Microsoft Defender for Endpoint (with DLP capabilities):
      • Built-in DLP functionality within Microsoft’s endpoint protection platform. Integrates well with other Microsoft security solutions for a holistic security posture. Offers data classification, access control, and data encryption to prevent unauthorized data leaks. May require additional configuration for advanced DLP needs.
    • Sophos Endpoint Protection (with DLP features):
      • Provides a balanced approach to endpoint security with DLP features like data discovery, application control, and content filtering. Integrates with Sophos Central for unified management. Offers pre-defined DLP policies for common data types (PII, financial data) and allows for customization.
    • CylanceENDPOINT:
      • Utilizes AI-powered prevention to detect and block malicious attempts to exfiltrate data. DLP capabilities include data discovery, classification, and endpoint activity monitoring. Focuses on identifying abnormal user behavior and preventing unauthorized data access.
• Network DLP:
  • Monitors and protects data in motion on the network, includes:
    • monitoring of emails, messaging, and file transfers
  • Creates a centralized database that records when sensitive or confidential data is accessed, who accessed it, and - if applicable - where the data moves over the network
  • Allows infosec team to have a complete picture and visibility into all the data on the network, including data in use, in motion, and at rest
  • The following is a list of the top 5 Network DLP solutions:
    • Forcepoint DLP:
      • Often considered the overall leader, Forcepoint DLP offers robust features like email DLP, endpoint DLP, and data encryption. It excels at preventing data exfiltration across various channels.
    • (Broadcom) Symantec DLP:
      • A powerful solution well-suited for large enterprises. Symantec DLP provides comprehensive content inspection, user behavior analytics, and centralized management. However, its deployment can be complex and resource-intensive.
    • Trellix DLP (formerly McAfee DLP):
      • A solid option for distributed enterprises, Trellix DLP offers endpoint and network DLP functionalities. It caters well to organizations needing to protect data across a geographically dispersed workforce.
    • Proofpoint:
      • Known for its cloud-based approach, Proofpoint DLP provides a unified platform for email, endpoint, and cloud application DLP. It’s a good choice for organizations seeking a comprehensive solution with strong insider threat management capabilities.
    • Digital Guardian:
      • Focuses on preventing data loss from your network and endpoints.
      • Emphasizing user behavior analysis and session context to allow it to understand how users interact with sensitive data, enabling more nuanced policy creation and enforcement compared to simply identifying sensitive data.
• Discovery DLP (or Data at Rest):
  • Focuses on automatically identifying and classifying sensitive data stored on devices, networks, and cloud storage locations.
• Cloud DLP:
  • Cloud-based DLP solutions offer a more scalable and cost-effective option, with the software hosted by a third-party provider.
  • Designed to protect organizations that leverage cloud infrastructure and cloud based data storage
  • Automatically Scans and audits data in the cloud in order to detect and encrypt sensitive information before it is stored in the cloud
  • Maintains a list of authorized cloud applications and users that can access sensitive data
  • Alerts the infosec team to policy violations or anomalous activity
  • Maintains an audit log of when sensitive, cloud-based data is accessed and the user’s identity that accessed it
  • Provides a single pain of glass and end-to-end visibility of all the organizational data in the cloud

Cloud-Based DLP: A Modern Approach

As businesses move more data to the cloud, traditional DLP solutions designed for on-premises networks become insufficient. Cloud DLP addresses the unique challenges of securing sensitive data within cloud environments:

• Increased data sharing and collaboration across various cloud services.
• Shadow IT risks, where employees use unauthorized cloud applications.
• Evolving compliance regulations requiring robust data protection measures.

Cloud DLP Solutions offer the following benefits:

• Scalability:
  • Cloud-based solutions can easily scale to accommodate your growing data volumes and user base.
• Reduced IT Overhead:
  • There’s no need to manage or maintain DLP infrastructure, freeing up your IT resources.
• Automatic Updates:
  • Cloud providers handle software updates, ensuring you always have the latest security features.
• Accessibility:
  • Cloud-based DLP can be accessed from anywhere, making it ideal for a remote workforce.
• Simplified management:
  • Centralized control over data security policies across cloud applications.
• Improved compliance:
  • Cloud Provider have stringent compliance requirements and must adhere to data privacy regulations like GDPR and HIPAA.
• Enhanced data visibility:
  • Gaining a comprehensive understanding of where sensitive data resides in the cloud.
• Reduced data loss risks:
  • Mitigating the potential for accidental or malicious data exposure.

Cloud DLP Solutions from CSPs

The following list is a short summary of DLP solutions offered by the major Cloud Service Providers:

• Amazon Web Services (AWS):
  • Has two offerings that play roles in data security but focus on different stages of the security process
    • Amazon Macie
      • Focuses on data discovery and classification
      • Discovers and classifies sensitive data across S3 buckets, DynamoDB tables, and other AWS services.
      • Classifies data based on pre-built and custom criteria (e.g., PII, financial data).
      • Provides data lineage information to understand how sensitive data flows within your AWS environment.
    • Amazon Detective
      • Focuses on security investigation and threat analysis
      • Analyzes data from various AWS sources (CloudTrail logs, VPC Flow Logs) to identify potential security incidents.
      • Uses machine learning and graph theory to connect events and identify the root cause of security issues.
      • Helps you investigate suspicious activity and potential data breaches.
• Microsoft Azure
  • Microsoft Purview Data Loss Prevention
    • Integrates seamlessly with Microsoft 365 for effortless discovery and protection of sensitive data in email, documents, and cloud storage.
    • Leverages machine learning for data classification and supports a wide range of data types including PII, financial data, and intellectual property.
    • Offers content inspection across endpoints and cloud applications to prevent data exfiltration.
• Google Cloud Platform (GCP)
  • Cloud Data Loss Prevention (now part of Sensitive Data Protection)
    • Provides data discovery, inspection, and de-identification capabilities to protect sensitive data in GCP storage and big query datasets.
    • Offers pre-built and custom detectors for various data types and supports redaction and masking of sensitive information.
    • Integrates with other GCP security services for comprehensive data protection throughout the cloud environment.
• IBM Cloud:
  • IBM Cloud Data Loss Prevention (Guardium)
    • Discovers and classifies sensitive data across cloud storage, databases, and applications deployed on IBM Cloud.
    • Offers pre-built and custom data loss prevention policies to prevent unauthorized data exfiltration.
    • Integrates with IBM Cloud Activity Tracker for audit logging and investigation of data access attempts.
• Alibaba Cloud
  • Data Security Service (DSS)
    • Provides data discovery, classification, and masking functionalities for sensitive data stored in Alibaba Cloud.
    • Offers pre-defined data loss prevention policies and integrates with Alibaba Cloud Security Center for centralized security management.
    • Supports data loss prevention across cloud storage, databases, and Alibaba Cloud-based applications.

Conclusion

Data Loss Prevention is no longer a luxury, it’s a necessity. By implementing a DLP strategy, you can safeguard your sensitive data, ensure compliance, and build trust with your stakeholders. Cloud-based DLP solutions offer a modern and efficient way to achieve these goals, making them a compelling choice for businesses of all sizes.