Solved

DLP and Encryption

Posted on 2015-02-03
9
252 Views
Last Modified: 2016-02-25
In order to become compliant my small business needs to incorporate DLP and Encryption -
Data Loss Prevention while files on fileservers are at rest, in use, and in motion
Encryption while files on fileservers are at rest and in motion.

Has anyone had experience with this? I see that Symantec Endpoint offers a suite of products that might work or might be overkill,
Cisco Ironport has also popped up in searches,
and Sophos gateway.

anyone have any experience or suggestions on how to accomplish this?
Windows Server domain controller...
0
Comment
Question by:dnetsol
9 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 40587789
DLP is easily bypassed if someone knows your running DLP. Changing a document from a normal font to windings for instance bypasses all DLP products I tested. Saving documents to the draft folder of your email client can also be a bypass. DLP's use case is to "catch stupid" or laziness. I'm not familiar with regulations or laws that require you to run DLP, esp since they are in their infancy. Symantec does have DLP, many organizations use it, again it does not catch insiders, it catches people emailing data they shouldn't, it catches people sharing documents or ftp'ing them when they shouldn't. A zip file and a password can get past any DLP.
Read this article about encryption to better understand that subject: http://www.experts-exchange.com/Security/Encryption/A_12134-Choosing-the-right-encryption-for-your-needs.html
Can you list the mandate or law you are trying to comply with?
-rich
0
 
LVL 54

Expert Comment

by:McKnife
ID: 40588051
DLPs can also be setup this way: only tagged documents may leave the company network. The tagging would have to be done by authorized persons of course. So you would have a piece of hardware between your company and the internet gateway that does content inspection - what is not tagged, may not get out.
Years ago, I saw a presentation about this, it was the product mimesweeper, if I remember correctly.
0
 
LVL 17

Expert Comment

by:Learnctx
ID: 40588435
We've implemented McAfee DLP (regulator requirement). Here are a bunch of demo videos and other info:

http://www.mcafee.com/us/products/total-protection-for-data-loss-prevention.aspx#vt=vtab-DemosTutorials

There are others as well like Symantec, RSA, etc.

But really DLP is really best effort and easily bypassed (password protected/encrypted files for example). Unless you block them going out which comes with its own problems like admin overhead... You need to look at SSL interception to pick up data transfers going back and forth, you can be selective like targeting known cloud storage sites or cloud storage classified sites if you have a next gen firewall.

Even after you end up spending all this money, with the prevalence of personal smart phones that have great cameras (not to mention CHEAP high resolution spy cameras) you could have a staff member sit there and video or take photos of documents. To this end for some of our sites we basically ban any equipment coming or going. They walk in for a check with their clothes on and they leave with just their clothes on.

In the end though, if a trusted insider REALLY wants your data...they're going to get it if they have the access. Your best best is detection of abnormal behaviour or unexpected or unauthorised data access. Consider DLP as an OK first line of defence and don't tell your staff you have it to avoid people going to far to bypass it :)
0
Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

 

Author Comment

by:dnetsol
ID: 40588778
Thanks for the replies! I understand that DLP can easily be bypassed.
Many of my clients are trying to achieve all these standards for ALTA Best Practices (Title companies) and this requires DLP & encryption.
So any more suggestions on ways to achieve this would be appreciated instead of all the ways I can tell a client why it's stupid :)
0
 
LVL 54

Accepted Solution

by:
McKnife earned 500 total points
ID: 40588832
I thought I  did tell you they are nit easy to fool and I also named one: Clearswift minesweeper.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 40589721
Why did you already close the question - was it answered? Did I even touch the second topic "encryption"?
0
 

Author Comment

by:dnetsol
ID: 40591391
i think we might go with native bitlocker for encryption. do you have any suggestions for encryption?
0
 

Expert Comment

by:Joe Bene
ID: 40596476
We use GTB Technologies DLP - excellent solution with complete channel coverage (not just TCP traffic), detection accuracy is great plus you get content visibility to SSL transmissions. (haven't seen that with the others.)  We just upgraded to their full on premise, off premise (network scanning included) agent solution.
Worth checking out
0
 
LVL 54

Expert Comment

by:McKnife
ID: 40596695
What is important for you concerning the capabilities of an encryption software?
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
There are many Password Managers (PM) out there to choose from. PM's can help with your password habits and routines, but they should not be a crutch you rely on too heavily. I also have an article for company/enterprise PM's.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

713 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question