understanding data loss prevention
Post on 27-Aug-2014
112 Views
Preview:
DESCRIPTION
TRANSCRIPT
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved.
Best Practices for Implementing Data Loss Prevention (DLP)
• Michael Avdeev DLP Solution Architect, McAfee
• John Callaghan Sr. Mgr. Engineering Research , SilverSky
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 2
Welcome! • Type in questions using the Ask A Question button
• All audio is streamed over your computer
– Having technical issues? Click the ? Button
• Click Attachments button to find a printable copy of this presentation
• After the webinar, ISACA members may earn 1 CPE credit – Find a link to the Event Home Page on the Attachments button – Click the CPE Quiz link on the Event Home Page to access the quiz – Once you pass the quiz, you’ll receive a link to a printable CPE
Certificate
• Tell us what you thought of this event! – By using the FEEDBACK button – Complete the Webinar Survey on the Attachments button
• Question or suggestion? Email them to eLearning@isaca.org
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 3
Today’s Speakers
Michael Avdeev DLP Enterprise Solution Architect
McAfee
John J. Callaghan, CISM, Senior Manager
Security & Engineering Research, SilverSky
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 4
Motivations
“A world of needs… … essential considerations”
What • Another Tool or Governance approach
Why • Mandate, IP, Regulatory, Compliance
When • Immediately .vs. Planned
Where • Across the business, by geography
How • “By Policy”, Training, Top-Down, Inter-organizational
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 5
Considerations
“The obvious... … and not so obvious”
• Business Goals
• Company Primary IP
• Industry & Legal Requirements
• Corporate Security Policies
• New Projects ‘rollout’ history
• Secondary IP concerns
• Business unit Practices & Repositories
• Varying adherence to Corporate Policy
• Exposed IP
• Extranet/sharing issues
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 6
Challenges
“Securing the Data… … loss / theft / corruption”
• Today: Data = Dollars • Crime: Cybercrime is simply Crime • News: Success stories need to outweigh breaches • Statistics: At the close
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 7
Data-in-Motion
Data-at-Rest
Data-in-Use
Data Types
WI
LD
WI
LD
WE
ST
Data Loss Vectors
Email Web Post Network IM Chat
Desktop/Laptop Database
Removable Media
Screen Printer
File Share
Clipboard
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 8
DLP
Governance
Risk Assessment
Compliance
Classification
Policies
Discovery
Remediation
Awareness
DLP Elements
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 9
Governance Summary: • Data Governance = confidentiality, integrity and availability of data
• Monitor the flow/storage of data in your environment
Action: • Develop a governance structure
• Define roles & responsibility
• Create a communication plan
• Create governance metrics
Examples: • Centralized vs. De-Centralized
• Set up a central site for document
storage & communications
• Use DLP policies to generate
metrics
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 10
Risk Assessment Summary: • Identify all data types, threat vectors, and potential business impact
• Prioritize ranking of risks and a list of initiatives to mitigate the risk
Action: • Execute the RA
• Create a detailed action plan
• Assign owners to RA results
• Formalize a recurring RA plan
Examples: • Use asset management tools to
catalog assets
• Use DLP to identify risk in systems,
applications, lines of business, etc.
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 11
Compliance Summary: • Sensitive information regulated by governmental and industry statutes
• Avoid fines, increased audit costs, embarrassment, or prosecution
Action: • Identify governing bodies
• Identify statutes
• Create a data element mapping
• Create compliance metrics
Examples: • Monitor PCI data movement both
within and outside of the company
• Use IT GRC tools to manage
compliance
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 12
Classification Summary: • Classify data according to its value and risk
• Protect classes of data; not individual elements
Action: • Gather initial and new data
elements
• Develop a standard framework
• Identify data owners and users
• Identify approved data storage
systems
Examples: • Set up workshops to gather initial
data elements
• Use DLP data discovery scans to
gather new data elements
• Catalog locations and move data
to approved storage locations
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 13
Policies
Summary: • Flexible policies that grows with the organization over time
• User education on policies, standards, and guidelines
Action: • Review existing policies
• Create new policies
• Socialize polices with users
• Evaluate effectiveness
Examples: • Educate key stake holders (HR,
compliance team, biz units)
• Set up a recurring update program
to measure policy effectiveness
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 14
Discovery
Summary: • Find sensitive data in areas you don’t expect it to.
• Identify broken process, bad actors, and “data drift”
Action: • Create a data discover program
• Define data storage type
• Define data categories
• Define data owners
Examples: • Identify “data drift” in “data-at-rest”
(file servers, database)
• Identify “data drift” in “data-in-use”
(local disks on laptops and
desktops)
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 15
Remediation
Summary: • More than fixing the data – look at the people and the process
• Remediation is NOT done until root causes are identified and risk is
mitigated
Action: • Develop data/incident response
programs
• Perform system/data clean-up
• Implement mitigation actions
Examples: • Root caused PCI data leakage due
to a broken business process
• Automatically encrypt all patient
data via outbound email traffic
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 16
Awareness
Summary: • Your employees are a critical line of defense
• Embed employee education into your DLP program
Action: • Develop a security awareness
program for employees
• Develop specific data protection
training for data owners
Examples: • Posters
• Webpage with guidelines
• Quick situational videos
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 17
Approaching the Task
Deployment Best Practices • Solid preparation • Understand the data & rules • Be realistic with the project plan • Communication, communication, communication
Protecting Data is a Process Problem…
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 18
Deployment Best Practices • Scope the hardware appropriately • Get buy-in from key stakeholders early • Evaluate DLP endpoint strategies • Have a realistic test environment so you can see problems early
Solid Preparation
• Privacy rules differ state by state, country by country • Understand how data is being used in your company before building policies • Understand chain-of-custody implications of collecting evidence in a DLP
solution
Understand the Data & Rules
• You can’t watch everything - prioritize what’s important • Start small and grow your coverage • Know what you need to watch for and what you cannot watch for • Document well and define key statistical performance metrics
Be Realistic
• Weekly calls (technical level & governance level calls with senior management) • Define departmental champions to help overcome roadblocks • Keep the CISO actively involved • Train downstream – don’t limit it to just security
Good Communication
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 19
Who? What? When? How?
Data Type Risk Level Findings PCI Data Exposed User Ignorance of Policy
PII Data Exposed PII data sent, received and stored UNENCRYPTED
Intellectual Property Leaks “Confidential” files sent to questionable destinations
State Privacy Law Violations Broken business process
You cannot protect the data you don’t know about!
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 20
Streamline Policies
Fine tune and test policies without interrupting business
Define Policy
Test Policy
Tune Rules
Data Analytics
Violations
Data
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 21
Inventory with Metadata
Categorization & Classification
Remediation Prioritized
Discovery Best Practices
PCI Data
Sensitive IP
Encrypt
Delete
Move
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 22
Management Model P
roac
tive
Rea
ctiv
e
Decentralized Centralized
• Complex IP environment • Business driven needs • Small security team
Business Flex Dedicated Team
Light Coverage Part-Timer
• High regulatory requirements • Mature business model • Strong security team
• Low regulatory environment • Low business drivers • Small security team
• High business drivers • Little management buy-in • Strong security team
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 23
What You Learned Today
• The 8 Essential DLP Elements
• DLP Deployment Best Practices & Examples
• Different DLP Management Models
Remember … You cannot protect the data you don’t know about! Start small and be realistic about your project plan. Get buy-in from business users early. Protecting data is a process problem.
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 24
Resource & Tools
• Verizon Data Breach Investigation report: http://www.verizonenterprise.com/DBIR/2013/
• “Implementing and Managing a DLP Solution” Whitepaper http://mcaf.ee/dphvg -> White Papers
To find out more about McAfee DLP solution • Public page http://mcaf.ee/dphvg
• Regulation link http://www.mcafee.com/data-protection-laws
• Data Risk Assessment http://dataprotection.mcafee.com/forms/RiskAssessment
• Blogs http://siblog.mcafee.com/category/data-protection
• Videos http://www.youtube.com/McafeeDLP
• Twitter handle @McAfeeDLP
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 25
Questions?
2013 ISACA Webinar Program. © 2013 ISACA. All rights reserved. 26
Thank You!
Michael Avdeev, michael_avdeev@mcafee.com John Callaghan, jcallaghan@silversky.com
top related