Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Trustwave SpiderLabs Exposes Unique Cybersecurity Threats in the Public Sector. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
SpiderLabs Blog

The Secret Cipher: Modern Data Loss Prevention Solutions

This is Part 7 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Far too many organizations place Data Loss Prevention (DLP) and Data Protection at the bottom of their priority list due to the perceived difficulty in its deployment. When there are in fact some easy approaches to getting started with protecting your data. Encrypting sensitive data can be automated in just a few steps so this ‘secret cipher’ is hardly noticed until it’s needed.

Today, let’s conduct an overview of the topics of DLP and Data Protection.

 

What is Data Protection and DLP?

First, let’s provide a simple description of the topics at hand:

Data Protection

Data protection has several meanings, but for the scope of this discussion, it is the process of protecting sensitive data from unauthorized access. Consider the scenario where a laptop containing sensitive files is stolen giving the thief access thief or an email included an attachment with a sensitive file, the file should be encrypted and require authentication every time it is accessed.

 

Data Loss Prevention - DLP

DLP is the ability to prevent sensitive data from being passed outside of its assigned trusted zones. For example, a spreadsheet containing financial data is allowed to be viewed by the accounting team, but it is not allowed to be emailed.

 

Why bother with Data Protection or DLP?

Compliance

The simple answer for some is “because I was told to.” If your organization must follow one or more compliance standards, then it’s very likely data protection is part of those controls. For example, NIST has several mentions of data protection under data at rest (SC-28) and in motion categories (SC-8). CIS has a Control 3 named Data Protection.

Intellectual Property Theft Preparedness

Most likely there’s not a company in the modern world that hasn’t heard of ransomware and how much a successful attack can cost an organization. Preparing for IP theft is much cheaper than the alternative of dealing with the cost of recovering from a ransomware attack. Data Protection and DLP are at the center of IP theft preparedness. If the data is protected it will be safe in a worst-case scenario ransomware incident.

Public / Media Exposure

The cost to a company’s reputation can be more than the cost of recovering from a data breach. After all, wouldn’t a corporate executive rather say “our company was breached but all our data was encrypted” as opposed to ‘we were breached and none of our data was encrypted.’

 

What are the Basic Steps to Protecting Data?

Data Protection usually involves the following steps:

  • Create and apply Sensitivity Labels – e.g., the ability to label a document as “Confidential – Internal Use Only.”
  • Use auto-labeling or manually apply sensitivity labels to your data – e.g., “All files in the ‘Accounting’ folder must be labeled as “Highly Confidential – Internal Use Only.”

Figure 1 Applying a sensitivity label in Microsoft Purview Information Protection

Figure 1: Applying a sensitivity label in Microsoft Purview Information Protection

 

What are the basic steps to preventing Data Loss?

DLP is basically a more condition-based application of the data protection mentioned above:

  • Create Sensitivity Labels – just like Data Protection above.
  • Create Policies to determine how DLP rules will apply – e.g., “Files labeled ‘Internal Use Only’ can NEVER be sent via email except to other employees in the Accounting User’s Group.”

Note that when you apply sensitivity labels the associated document(s) are not automatically encrypted unless your label options say the sender must do so.

 

Figure 2 A DLP Policy to block email containing sensitive data. Courtesy Microsoft Purview

Figure 2: A DLP Policy to block email containing sensitive data. Courtesy Microsoft Purview

 

What are the challenges with Data Protection?

Some of the hardest challenges with data protection aren’t the technologies used, but instead:

Finding your sensitive data

If all your sensitive data is stored on a SharePoint drive, then there’s not much effort in finding sensitive data, but that’s hardly a real-world example. Sensitive data can be on-prem, in the cloud, and it can be stored in numerous formats: spreadsheet, database, data lake, etc.

Creating Data Protection Policies

If you’re lucky enough to be a one-person security department, then you’ll only have yourself to argue with about the best data protection policies – again, not real-world, so there’s often much discussion on how to protect data. Depending on the size of your organization, there could be dozens of data protection policies required.

Creating Sensitivity Labels

Data protection tools will provide a default set of common sensitivity labels, for example:

Figure 3 Default Sensitivity Labels Courtesy Microsoft Purview

Figure 3: Default Sensitivity Labels: Courtesy Microsoft Purview

Often, the default labels are a great starting point from where additional labels can be added at a future phase of your data protection deployment.

And Then Some...

Additional challenges will arise such as what actions should be taken if sensitive data policies are violated, and how you test your data protection policies without disrupting operations. So, it’s recommended to plan things out in a spreadsheet before getting to the technical parts.

The bottom line is: Good planning for data protection and DLP can save a lot of meetings and contractor hours!

 

Challenges and Tips with DLP and Data Protection Services

DLP depends on applications that understand the sensitivity labels assigned to the files. For Example, Microsoft’s Purview provides DLP policies that work great with Microsoft Exchange and other Microsoft-based applications. But if you’re using Microsoft Purview with other non-Microsoft applications, those apps likely won’t understand the applied sensitivity labels and be capable of using the DLP policies created in Purview.

The hard truth is that Data Loss Prevention is far from perfect since it’s dependent on the applications it's used with. On the brighter side, Data Protection can be quite effective if all your data is in the cloud and/or your data protection solution has easy access to your data.

Figure 4 Purview DLP Supported Applications – Courtesy Microsoft

Figure 4: Purview DLP Supported Applications – Courtesy Microsoft

 

Summary

Don’t put data loss prevention and Data Protection at the bottom of your priority list. Move sensitive data to the cloud, apply data protection and data loss policies, and evolve your data protection methods over time as priorities allow.

References

 

About This Blog Series

Follow the full series here: Building Defenses with Modern Security Solutions

This series discusses a list of key cybersecurity defense topics. The full collection of posts and labs can be used as an educational tool for implementing cybersecurity defenses.

 

Labs

For quick walkthrough labs on the topics in this blog series, check out the story of “ZPM Incorporated” and their steps to implementing all the solutions discussed here.

 

Compliance

All topics mentioned in this series have been mapped to several compliance controls here.

David Broggy, Trustwave’s Senior Solutions Architect, Implementation Services, was selected last year for Microsoft's Most Valuable Professional (MVP) Award.

 

Operational Technology Security Maturity Diagnostic

 

Latest SpiderLabs Blogs

2024 Public Sector Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies

Trustwave SpiderLabs’ 2024 Public Sector Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies report details the security issues facing public sector security teams as...

Read More

How to Create the Asset Inventory You Probably Don't Have

This is Part 12 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Read More

Guardians of the Gateway: Identity and Access Management Best Practices

This is Part 10 in my ongoing project to cover 30 cybersecurity topics in 30 weekly blog posts. The full series can be found here.

Read More