A Practical Approach to Data Loss Prevention - PowerPoint PPT Presentation

A Practical Approach to Data Loss Prevention

Richard Trezza, CISSP

DLP Enterprise Solution Architect

McAfee, an Intel Company

Institute of Internal Auditors

Long Island Chapter Annual Conference

Melville Marriott Hotel

May 10, 2013

• Welcome to the Wild West 2.0
• Privacy versus Protection
• Different Languages
• “Private Data” or “Personal Data”
• Best Practices

• Does a Reasonable Expectation of Privacy Exist in Cyberspace? What about at Work?

It depends where in the world you are:

• Australia = Personal Information
• India = Sensitive Personal Data
• Canada = Personal Information
• Brazil = Personal Information
• Germany = Personal Data
• Netherlands = Dutch Works Council Definition
• United States = Varies Based on State Laws

What is kind of data is “Private” or “Personal”?

Some details are obvious:

Name, Address, Phone, Gender, Religion, Age, Identity Number (SSN), Primary Account Numbers (PAN), etc.

Some details are not:

MAC Address, IP Address, Computer type, Browser, Smartphone Brand, City

Defines what data is “Private”, “Personal” or “Company Confidential” and how said data shall be protected. It also specifies who does what if data is breached.

Data-in-Motion

Data-in-Use

Data-at-Rest

Data Loss Vectors

Data Types

Network

IM Chat

Email

Web Post

File Share

Database

Desktop Laptop

Removable Media

Printer

Screen

Clipboard

People have numerous accounts

People have multiple devices

People don’t perceive they have data to lose

Data is co-mingled all over the cloud

People don’t perceive they have data to lose

Similarities to PC

Unique to Mobile

Mobile OSes are closed and diverse

CPU, memory, battery and performance limitations

New and expanded privacy concerns (lost devices, permission abuse)

More attack channels (SMS, 4G, Bluetooth, NFC, WiFi, SD Card...)

Increasing reliance on the cloud

Critical mass of devices with rich data…attractive to cybercriminals

Valuable personal and business data resides and flows through the devices

Software vulnerabilities that create exploit opportunities

Traditional threats (Phishing, Rootkits, Key Loggers, Polymorphics)

Text here

Text here

Source: McAfee Labs April 2012

People have numerous accounts

People have multiple devices

People don’t perceive they have data to lose

Data is co-mingled all over the cloud

People don’t perceive they have data to lose

• A comprehensive approach is needed…
• A combination of:
• Technologies
• Best practices
• Business processes
• Well Defined & Communicated Policies

Data remains on server, in your datacenter

Users view/consume data, but cannot download to their system

Loss vectors are reduced (USB, DVD) and transmissions controlled through Organization’s Data Center

• Welcome to the Wild West 2.0
• Privacy versus Protection
• Different Languages
• “Private Data” or “Personal Data”
• Best Practices

• Understand your Business
• Are you a data broker selling information?
• Are you a marketing firm buying data?
• Are you a manufacturer with Intellectual Property to protect?
• Identify the data are you collecting and storing
• Customers, Employees, Users of your Web Site
• Only collect data that you NEED or USE
• Don’t collect data that you don’t NEED or USE
• Do customers, users or employees have an expectation of privacy?
• What do your policies say? Revise as needed

• Do you have a privacy policy and does it clearly state what data is collected, how it will be used and how it will be protected (adequate security)?
• Has the policy been communicated to employees, customers and partners?
• Do they understand the policy?
• Do you audit for compliance with the privacy policy?
• Monitoring for compliance is complicated because European Nations have “Works Councils” that must approve monitoring for data loss and compliance
• Germany, Netherlands, Belgium are examples
• Always seek approval in local Countries

• European Laws prohibit transmission of EU Citizen data outside of the EU
• Unless the recipient maintains the same levels of protection and privacy safeguards as the EU
• Anonymous data is safest
• Don’t combine Names, Account Numbers unless absolutely necessary
• If monitoring for compliance, clearly identify what is being monitored and require “four eyes” to identify users transmitting data
• Always Encrypt “personal data” when stored or transmitted

• Seek Legal Advice and Executive Sponsorship
• Utilizing and protecting data without compromising privacy in Global markets is among the most complex, dynamic IT problems today
• Communicate these considerations with Management

A Practical Approach to Data Loss PreventionQuestions? Richard Trezza, CISSPDLP Enterprise Solution ArchitectMcAfee, an Intel CompanyRichard_Trezza@mcafee.com