Data Loss and Data Leakage Prevention Tips
Data Loss Prevention
I had thought that data leakage and data loss are one and the same, until I had a discussion with our CISO, Roger Hale. He gave me his thoughts on the difference between the two. While data loss and data leakage can both result in a data breach, the detection and handling of data loss prevention and data leakage prevention must both be considered.
Data loss prevention focuses on the detection and prevention of sensitive data exfiltration and/or lost data, and includes use cases from a lost or stolen thumb drive, to ransomware attacks. In a data loss, the data is gone and may or may not be recoverable. Data leakage is more complex and includes the risk of sensitive data flowing between an organizations’ critical systems, which are usually systems of records. While safe guards can be assumed to be in place in the “system of record”, data leakage can occur when data is cascaded to complimentary systems unless the same level of data protection is enforced.
Some examples for systems of records are- Human Resources (e.g. PeopleSoft, Workday, etc.), ERP (e.g. SAP, Oracle E-Business Suite, etc.), and CRM (e.g. SAP, Salesforce, etc.) systems. These critical applications may reside within your corporate network or exists as SaaS applications in the cloud. So, what are the capabilities required to detect and prevent data leakage?
Identify, Discover, Classify
First, you need to identify the systems of records that you need to focus on. Then classify what constitutes sensitive data that resides on those systems and discover which are the data elements that are sensitive based on those classifications. The more automated these steps are the easier it will be for you to keep up with the ever-changing application and data landscape within your environment.
Sensitive Data Proliferation
Second, detect and analyze the sensitive data and the functions that can allow sensitive data to flow out of your systems of records. Sensitive data may flow out of these systems for any of the following use cases:
- Analytics and reporting
- Consumption by downstream applications
- Replication to lower environments for dev, test, demo, etc.
- Data processing by partners
A data flow map from these systems of records to downstream and upstream sources is very useful to understand the increased risk due to actual and potential data leakage. Again, the more automated this detection and analysis, the better you can monitor and manage potential changes.
In addition to system data flow maps, you also need to detect sensitive data flows across regulated regions to comply to data privacy laws. Sensitive data may flow across systems in data centers located in different regions, or sensitive data may be accessed by users who are temporarily traveling or permanently located outside the region where the data is stored. Any of these data movements need to be detected.
Visibility to Data Usage
Systems of records such as key applications and data stores are also likely to be where you would want to continuously monitor activities and baseline users for typical vs. anomalous activities. These are where the most sensitive data resides. Internal threats from malicious or rogue users, 3rd party contractors, partners, or usage of stolen credentials should be detected as quickly as possible and would benefit from user behavioral analytics, which combines rules-based and machine learning based analysis.
Data Leak Prevention
When sensitive data is identified or anomalous user activity is detected, data leakage prevention can be based on access controls, encryption, tokenization, alerting, blocking, persistent or dynamic data masking, or quarantine. Defense in depth may be deployed by using a combination of encryption of data at rest as well as dynamic remediation actions triggered by policies that detect violations of high risk conditions or anomalous activities outside of the norm.
Data leakage deserves as much consideration as data loss prevention. The former focuses on sensitive data flows throughout the organization (can be within as well as across firewalls), whereas data loss may only be focused on sensitive data flowing out of the organization. As organizations’ network perimeter becomes less defined, data leakage prevention becomes even more important, and solutions that provide the capabilities described here will become more critical to your organization.
See customer and expert presentation on this data security topic and more at Informatica World 2017.