Solved

DLP and Encryption

Posted on 2015-02-03
9
236 Views
Last Modified: 2016-02-25
In order to become compliant my small business needs to incorporate DLP and Encryption -
Data Loss Prevention while files on fileservers are at rest, in use, and in motion
Encryption while files on fileservers are at rest and in motion.

Has anyone had experience with this? I see that Symantec Endpoint offers a suite of products that might work or might be overkill,
Cisco Ironport has also popped up in searches,
and Sophos gateway.

anyone have any experience or suggestions on how to accomplish this?
Windows Server domain controller...
0
Comment
Question by:dnetsol
9 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 40587789
DLP is easily bypassed if someone knows your running DLP. Changing a document from a normal font to windings for instance bypasses all DLP products I tested. Saving documents to the draft folder of your email client can also be a bypass. DLP's use case is to "catch stupid" or laziness. I'm not familiar with regulations or laws that require you to run DLP, esp since they are in their infancy. Symantec does have DLP, many organizations use it, again it does not catch insiders, it catches people emailing data they shouldn't, it catches people sharing documents or ftp'ing them when they shouldn't. A zip file and a password can get past any DLP.
Read this article about encryption to better understand that subject: http://www.experts-exchange.com/Security/Encryption/A_12134-Choosing-the-right-encryption-for-your-needs.html
Can you list the mandate or law you are trying to comply with?
-rich
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40588051
DLPs can also be setup this way: only tagged documents may leave the company network. The tagging would have to be done by authorized persons of course. So you would have a piece of hardware between your company and the internet gateway that does content inspection - what is not tagged, may not get out.
Years ago, I saw a presentation about this, it was the product mimesweeper, if I remember correctly.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40588435
We've implemented McAfee DLP (regulator requirement). Here are a bunch of demo videos and other info:

http://www.mcafee.com/us/products/total-protection-for-data-loss-prevention.aspx#vt=vtab-DemosTutorials

There are others as well like Symantec, RSA, etc.

But really DLP is really best effort and easily bypassed (password protected/encrypted files for example). Unless you block them going out which comes with its own problems like admin overhead... You need to look at SSL interception to pick up data transfers going back and forth, you can be selective like targeting known cloud storage sites or cloud storage classified sites if you have a next gen firewall.

Even after you end up spending all this money, with the prevalence of personal smart phones that have great cameras (not to mention CHEAP high resolution spy cameras) you could have a staff member sit there and video or take photos of documents. To this end for some of our sites we basically ban any equipment coming or going. They walk in for a check with their clothes on and they leave with just their clothes on.

In the end though, if a trusted insider REALLY wants your data...they're going to get it if they have the access. Your best best is detection of abnormal behaviour or unexpected or unauthorised data access. Consider DLP as an OK first line of defence and don't tell your staff you have it to avoid people going to far to bypass it :)
0
 

Author Comment

by:dnetsol
ID: 40588778
Thanks for the replies! I understand that DLP can easily be bypassed.
Many of my clients are trying to achieve all these standards for ALTA Best Practices (Title companies) and this requires DLP & encryption.
So any more suggestions on ways to achieve this would be appreciated instead of all the ways I can tell a client why it's stupid :)
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 53

Accepted Solution

by:
McKnife earned 500 total points
ID: 40588832
I thought I  did tell you they are nit easy to fool and I also named one: Clearswift minesweeper.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40589721
Why did you already close the question - was it answered? Did I even touch the second topic "encryption"?
0
 

Author Comment

by:dnetsol
ID: 40591391
i think we might go with native bitlocker for encryption. do you have any suggestions for encryption?
0
 

Expert Comment

by:Joe Bene
ID: 40596476
We use GTB Technologies DLP - excellent solution with complete channel coverage (not just TCP traffic), detection accuracy is great plus you get content visibility to SSL transmissions. (haven't seen that with the others.)  We just upgraded to their full on premise, off premise (network scanning included) agent solution.
Worth checking out
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40596695
What is important for you concerning the capabilities of an encryption software?
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolve DNS query failed errors for Exchange
This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

947 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now