Solved

DLP and Encryption

Posted on 2015-02-03
9
234 Views
Last Modified: 2016-02-25
In order to become compliant my small business needs to incorporate DLP and Encryption -
Data Loss Prevention while files on fileservers are at rest, in use, and in motion
Encryption while files on fileservers are at rest and in motion.

Has anyone had experience with this? I see that Symantec Endpoint offers a suite of products that might work or might be overkill,
Cisco Ironport has also popped up in searches,
and Sophos gateway.

anyone have any experience or suggestions on how to accomplish this?
Windows Server domain controller...
0
Comment
Question by:dnetsol
9 Comments
 
LVL 38

Expert Comment

by:Rich Rumble
ID: 40587789
DLP is easily bypassed if someone knows your running DLP. Changing a document from a normal font to windings for instance bypasses all DLP products I tested. Saving documents to the draft folder of your email client can also be a bypass. DLP's use case is to "catch stupid" or laziness. I'm not familiar with regulations or laws that require you to run DLP, esp since they are in their infancy. Symantec does have DLP, many organizations use it, again it does not catch insiders, it catches people emailing data they shouldn't, it catches people sharing documents or ftp'ing them when they shouldn't. A zip file and a password can get past any DLP.
Read this article about encryption to better understand that subject: http://www.experts-exchange.com/Security/Encryption/A_12134-Choosing-the-right-encryption-for-your-needs.html
Can you list the mandate or law you are trying to comply with?
-rich
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40588051
DLPs can also be setup this way: only tagged documents may leave the company network. The tagging would have to be done by authorized persons of course. So you would have a piece of hardware between your company and the internet gateway that does content inspection - what is not tagged, may not get out.
Years ago, I saw a presentation about this, it was the product mimesweeper, if I remember correctly.
0
 
LVL 16

Expert Comment

by:Learnctx
ID: 40588435
We've implemented McAfee DLP (regulator requirement). Here are a bunch of demo videos and other info:

http://www.mcafee.com/us/products/total-protection-for-data-loss-prevention.aspx#vt=vtab-DemosTutorials

There are others as well like Symantec, RSA, etc.

But really DLP is really best effort and easily bypassed (password protected/encrypted files for example). Unless you block them going out which comes with its own problems like admin overhead... You need to look at SSL interception to pick up data transfers going back and forth, you can be selective like targeting known cloud storage sites or cloud storage classified sites if you have a next gen firewall.

Even after you end up spending all this money, with the prevalence of personal smart phones that have great cameras (not to mention CHEAP high resolution spy cameras) you could have a staff member sit there and video or take photos of documents. To this end for some of our sites we basically ban any equipment coming or going. They walk in for a check with their clothes on and they leave with just their clothes on.

In the end though, if a trusted insider REALLY wants your data...they're going to get it if they have the access. Your best best is detection of abnormal behaviour or unexpected or unauthorised data access. Consider DLP as an OK first line of defence and don't tell your staff you have it to avoid people going to far to bypass it :)
0
 

Author Comment

by:dnetsol
ID: 40588778
Thanks for the replies! I understand that DLP can easily be bypassed.
Many of my clients are trying to achieve all these standards for ALTA Best Practices (Title companies) and this requires DLP & encryption.
So any more suggestions on ways to achieve this would be appreciated instead of all the ways I can tell a client why it's stupid :)
0
Are your corporate email signatures appalling?

Is it scary how unprofessional your email signatures look? Do users create their own terrible designs and give themselves stupid job titles? You can make this a lot easier for yourself by choosing an email signature management solution from Exclaimer today.

 
LVL 53

Accepted Solution

by:
McKnife earned 500 total points
ID: 40588832
I thought I  did tell you they are nit easy to fool and I also named one: Clearswift minesweeper.
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40589721
Why did you already close the question - was it answered? Did I even touch the second topic "encryption"?
0
 

Author Comment

by:dnetsol
ID: 40591391
i think we might go with native bitlocker for encryption. do you have any suggestions for encryption?
0
 

Expert Comment

by:Joe Bene
ID: 40596476
We use GTB Technologies DLP - excellent solution with complete channel coverage (not just TCP traffic), detection accuracy is great plus you get content visibility to SSL transmissions. (haven't seen that with the others.)  We just upgraded to their full on premise, off premise (network scanning included) agent solution.
Worth checking out
0
 
LVL 53

Expert Comment

by:McKnife
ID: 40596695
What is important for you concerning the capabilities of an encryption software?
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Healthcare providers, insurance companies and other covered entities trust eFax Corporate to transmit their most sensitive documents. eFax Corporate can help your organization implement a HIPAA compliant cloud faxing solution.
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
This tutorial will walk an individual through the process of installing of Data Protection Manager on a server running Windows Server 2012 R2, including the prerequisites. Microsoft .Net 3.5 is required. To install this feature, go to Server Manager…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now