Cyberstudy
PDF p.430 In progress

Data Loss Prevention

Open PDF at p.430 15 flashcards

Summary

PDF p.430

Data Loss Prevention (DLP) products automate the discovery and classification of data types and enforce rules to prevent unauthorized viewing or transfer of data. DLP solutions typically include policy servers, endpoint agents, and network agents to ensure data protection across various environments.

In plain words

Supplementary — not from your PDF

DLP products discover and classify data, then enforce rules to stop unauthorized viewing or transfer. Components: a policy server (rules, logging, reporting), endpoint agents (enforce policy on clients, even offline) and network agents (scan traffic at the border). DLP scans structured (databases) and unstructured (emails, documents) data and can block transfers to removable media, email, IM or social media. Remediation options: alert only (log), block (prevent the copy), quarantine (deny access, encrypt or move the file) and tombstone (replace the file with a policy-violation notice).

Detailed explanation

PDF p.430
  • Components of DLP Solutions
    • Policy Server
      • Function: Configures classification, confidentiality, and privacy rules and policies.
      • Tasks: Logs incidents, compiles reports.
    • Endpoint Agents
      • Function: Enforces policy on client computers, even when offline.
    • Network Agents
      • Function: Scans communications at network borders.
      • Tasks: Interfaces with web and messaging servers to enforce policy.
  • DLP Agents
    • Structured Formats: Scans content in databases with formal access control models.
    • Unstructured Formats: Scans content in emails, word processing documents.
    • Data Transformation: Renders unstructured data in a consistent, scannable format for policy enforcement.
    • Blocking Unauthorized Transfers: Prevents data transfer to removable media, email, instant messaging, or social media if it violates policy.
    • Cloud Storage Protection: Extends protection to cloud services using proxies or cloud service provider APIs.
  • Remediation Mechanisms
    • Alert Only
      • Action: Allows copying but logs the incident and may alert an administrator.
    • Block
      • Action: Prevents copying the original file but retains access.
      • Logging: Logs the incident, may or may not alert the user.
    • Quarantine
      • Action: Denies access to the original file, either by encrypting it or moving it to a quarantine area.
    • Tombstone
      • Action: Replaces the original file with a notice of the policy violation and instructions for release.
  • Email Protection
    • Client-Side Mechanisms: Prevents attaching files to emails before sending.
    • Server-Side Mechanisms: Scans email attachments and message contents, strips out certain data, or stops the email from reaching its destination.

Important terms

taken from the text above
Structured Formats
Scans content in databases with formal access control models.
Unstructured Formats
Scans content in emails, word processing documents.
Data Transformation
Renders unstructured data in a consistent, scannable format for policy enforcement.
Blocking Unauthorized Transfers
Prevents data transfer to removable media, email, instant messaging, or social media if it violates policy.
Cloud Storage Protection
Extends protection to cloud services using proxies or cloud service provider APIs.
Logging
Logs the incident, may or may not alert the user.
Client-Side Mechanisms
Prevents attaching files to emails before sending.
Server-Side Mechanisms
Scans email attachments and message contents, strips out certain data, or stops the email from reaching its destination.
DLP Data Loss Prevention

Examples & real-world scenarios

Supplementary — not from your PDF
  • An endpoint agent blocking a file copy to a USB stick.
  • A network agent scanning outbound email.
  • Tombstoning a file and leaving release instructions.

Scenario

An employee tries to email a spreadsheet full of card numbers externally. The DLP network agent detects the card data and blocks the email, logging the incident for review.

Common mistakes

Supplementary — not from your PDF
  • Confusing quarantine (denies access to the file) with block (prevents the copy but keeps access).
  • Deploying only network agents and missing offline endpoint activity.

Practical skills

Supplementary — not from your PDF
  • Match a DLP remediation action to a goal.

What I should remember

Key Points PDF p.430
  • Components of DLP Solutions
    • Policy Server: Configures rules, logs incidents, compiles reports.
    • Endpoint Agents: Enforces policy on client computers.
    • Network Agents: Scans communications, interfaces with servers.
  • DLP Agents
    • Formats: Structured and unstructured data.
    • Data Transformation: Consistent, scannable format.
    • Blocking Transfers: Prevents unauthorized data transfer.
    • Cloud Protection: Extends to cloud services.
  • Remediation Mechanisms
    • Alert Only: Logs incident, may alert administrator.
    • Block: Prevents copying, logs incident.
    • Quarantine: Denies access, encrypts or moves file.
    • Tombstone: Replaces file with notice.
  • Email Protection
    • Client-Side: Prevents attaching files.
    • Server-Side: Scans, strips data, stops email.