The Best Practices toAvoid Data Lossand SafeguardYour Critical Information

A whitepaper on Data Loss Prevention (DLP)technologies andwhy companies need it

www.seqrite.com

TABLE OF CONTENTS

Executive Summary

Introduction

The Prevalent Risk of Data Leakage

a. External Threats to Critical Data

i. Data storage as an anomaly

ii. The risk of Advanced Persistent Threats (APTs)

iii. Advanced malware and customized Trojans

b. Round the Clock Internal Threats

De�ning Data Loss Prevention Technologiesfor Business

a. Classifying Data for Best Business Practices

A Microscopic Approach to DLP ImplementationPrograms

a. Classi�cation of enterprise information, data location and transfer pathways

b. Establishment of intricate policies and high-level processes

c. Storage-based implementation of DLP protocols and processes

d. Remediation of data classi�cation or policy violations

e. Maintenance and remodeling of ongoing DLP programs

Business Bene�ts of an Integrated DLP Program

Conclusion

01

02

03

03

04

05

06

06

08

09

10

10

11

11

12

12

13

15

www.seqrite.com

An increasing volume of business information assets are distributed digitally today. Organizations simultaneously have to accelerate business processes, which leads to the wide proliferation of documents via digital mediums. Combined with BYOD policies and cloud-based storage services, the ever-growing risk of data leakage has pervaded IT policy makers and CSO’s of enterprises of all sizes.

In this whitepaper we delve into the prevalent security risks of data leakage within an organization. Data security runs the risk of being compromised by myriad di�erent external and internal threats. External threats abound in the form of insecure data storage channels, Advanced Persistent Threats (APTs) or customized Trojans. However, a majority of data leakage incidents occur due to accidental or deliberate data disclosure by employees and company insiders.

Enterprises thus need clearly de�ned data loss mitigation strategies to be implemented within their existing security structure. This is where Data Loss Prevention (DLP) comes into the picture as it provides the technology and tools to achieve this. Business enterprises of all sizes can utilize DLP protocols for data monitoring, auditing, reporting and proactive prevention of critical information disclosure.

DLP tools classify data on the basis of being at rest, in motion or in use. Hence these tools provide enterprises with the �exibility to develop and alter their mitigation strategies. As a result, Data Loss Prevention (DLP) tools protect con�dential data within the company, safeguard Intellectual Property, lower operational costs and bolster the enterprise security of an organization.

EXECUTIVE SUMMARY

1

www.seqrite.com

Traditionally, the notion of data leakage has been associated with the dispossession of device(s) containing con�dential data. However, over the years, data breaches have evolved expeditiously and materialized in far more devious ways with wide reaching rami�cations. To evade losses, enterprises should divert their resources towards the security of the following data types.

Due to the overlapping segregation of critical and vital data, many organizations often overlook the signi�cance of data loss prevention tools. As enterprises have bolstered the channels of data transfer, the need to pinpoint and administer these avenues has become critical.

For business entities, every sliver of data is crucial. The prevalence of cutting-edge data theft technologies now allows attackers to target organizations in ingenious ways and extract vital information and business secrets. Additionally, the pilferage of data also leads to a drop in worldwide market share, a huge blow to reputation, and the possibility of prolonged lawsuits. All this factors culminate in irrecoverable losses for a business enterprise.

Data Loss Prevention (DLP) is one of the most widely discussed but grossly under implemented technologies in the enterprise security portfolio.

1331 incidents of data loss have been reported worldwide

Over 502 million personal records have been exposed

20141st Half

Industry-speci�c Intellectual Property – This includes product design documents, prototype plans, process documentation, source code and more.

Company memorandums and documentation – This includes �nancial documents, employee details, future plans and other con�dential company information accessible only by insiders.

Customer data and buyer details – This includes details of customers such as credit/debit card details, personal information, bank statements and other information meant for company processing only.

2

www.seqrite.com

INTRODUCTION

3

www.seqrite.com

DATA LOSS PREVENTION INTRODUCTION

57%Over the last

10 years,

involved organizational errors,insider abuse or other internalmismanagement.

Europeof data lossincidents in

Data Loss Prevention (DLP) software gains precedence here as it grants a set of tools and methodologies that forestall the leakage of con�dential information. DLP also frames compliance policies and rules that protect data and �ag incidents when information is compromised or leaked.

The proliferation of Internet facing devices within enterprises has also led to the demand for persistent DLP mechanisms. In addition to their designated workstations and laptops, employees today actively utilize multiple smartphones, tablets, smartwatches and soon, even Internet enabled glasses. An inherent side e�ect to the ‘Internet of Things’ is that hordes of data is now broadcasted and shared over insecure networks. Without critical security infrastructure in place, these channels are often rendered vulnerable and exposed.

Companies are compounding their security risks by overlooking crisply de�ned security policies, by imposing impractical and easily reversible processes and by inadequately training employees in security matters. This intensi�es disparate avenues for data leakage and renders age-old practices of safeguarding con�dential information as unfeasible. Today, enterprises cannot a�ord to sustain the repercussions of data loss or repel the penalties of violating regulatory policies.

With such potential rami�cations seething under the surface, business enterprises must begin to actively embrace and implement DLP systems. Diverting resources towards imbedding the technology within existing IT security infrastructure should not merely de rigueur; it should be indispensable. This white paper presents an overview of Data Loss Prevention (DLP) and Seqrite's implementation of the technology. We also take an in-depth look into the bene�ts, the risks and the deployment mechanisms of DLP.

145 million recordsstolen from eBay

May 2014

53 million recordsstolen from HomeDepot

September 2014

76 million recordsstolen fromJP Morgan

October 2014

While the nature of critical data is often underestimated, the problem of data leakage gets exacerbated. SMBs in particular, often believe that they are too small to be targeted. However, data breaches do not occur based on size alone. Moreover, not all breaches are caused by malicious attackers or corporate saboteurs.

While the nature of critical data is often underestimated, the problem of data leakage gets exacerbated. SMBs in particular, often believe that they are too small to be targeted. However, data breaches do not occur based on size alone. Moreover, not all breaches are caused by malicious attackers or corporate saboteurs.

Since employees themselves contribute to the majority of data leakage cases, a set of policies that monitor, regulate and enforce data preservation tools are essential. This is where Data Loss Prevention (DLP) comes into the picture and its implementation depends on the nature of vulnerable data, the size of the enterprise and the degree of danger posed to the data by insider and outsider threats.

External Threats to Critical Data

Critical data silos are often earmarked as high priority targets by company outsiders and rival enterprises. They focus advanced and intensive espionage methods to amass information from vulnerable sources. Government entities have the additional onus of dealing with the threat of Advanced Persistent Threats (APTs) developed by nation states and non-nation attackers.

Data storage as an anomaly

As the volume of big data has increased exponentially, storage technologies have fallen behind those advances. As per predictions, global big data is foreseen to rise by a factor of 50 by 2020, but storage drives are only going to expand 15-fold in the stipulated timeframe. Simultaneously, storage costs are not diminishing either. These two trends have fused to make it challenging for companies to purchase or lease storage space for data demands.

4

www.seqrite.com

THEPREVALENTRISK OF DATALEAKAGE

Employees/Insiderswho accidentallylose data

The instigators of data loss can beclassi�ed as follows:

Employees/Insiderswho deliberatelyleak data

Attackers/Outsiderswho target speci�csilos of data

5

www.seqrite.com

DATA LOSS PREVENTION The Prevalent Risk of Data Leakage

Consequently, more data is being stored on smaller spaces. This escalates server loads and ampli�es the impact of data loss if the storage space is compromised.

Backup policies are not unconditionally reliable either. These processes operate under the inferences that hardware and storage media seamlessly work together, that data is incorruptible, and that backups are taken in a timely manner. In real world scenarios, most of these conditions are not met, thus augmenting data loss.

The risk of Advanced Persistent Threats (APTs)

APTs are perilous because they evolve slowly but steadily. They often go undetected for years at a stretch as they do not render discernible damage. They stay still and monitor data and follow the motto “Go Low and Go Slow”. Most notorious APTs have been found to be dispatched by nation states to spy on or sabotage rival nations’ infrastructural or operational capacities.

An APT attack often utilizes spear phishing (a type of social engineering) to in�ltrate a network via legitimate means. Once inside, an APT establishes and opens a back door. The APT then gathers authentic user credentials and moves laterally within the network to establish more back doors. By the end of it, the APT installs bogus utilities and creates a "ghost infrastructure" to distribute malware that remains hidden from security protocols.

Associated Costs to Companies of Advanced Persistent Threats

Diminished Brand &Reputation Costs

$9.4 million

Productivity LossCosts

$3.1 million

Technical SupportCosts

$2.5 million

Business DisruptionCosts

$3 million

4

6

www.seqrite.com

DATA LOSS PREVENTION The Prevalent Risk of Data Leakage

Characteristics of an APT

Targeted

APTs steadily work on targeted organizations or entities with the sole purpose of stealing speci�c data or causing operational damage.

Persistent

APTs gradually evolve in multiple phases over a long period of time. Attackers �rst need to single out vulnerabilities, appraise existing security measures, gain access to privileged hosts, �nd the targeted data and, �nally, extract the data. This entire process frequently takes months or even years to bear fruition.

Evasive

APTs are methodically designed to circumvent traditional security products that most enterprises have relied on for years.

Complex

APTs apply a complex blend of attack methods to target multiple vulnerabilities that are identi�ed within the targeted organization. These attacks involve telephone-based social engineering tricks to pinpoint key individuals within an organization; phishing emails sent to those personnel with links that execute custom JavaScript codes to install remote access tools; binary command-and-control codes; and custom made encryption technology.

Advanced malware and customized Trojans

The complete failure or dramatic slowdown of a business network can be either premeditated or accidental. A destructive malware can delete critical system �les and thus disable the Operating System, bomb the network with a DDoS (Distributed Denial of Service) attack, or hamper the system's operability in multiple ways.

In certain scenarios, malware turns out to be incompatible with system speci�cations, resulting in server failure or radical increases in spam tra�c, thereby paralyzing the enterprise network.

When a virus in�ltrates a corporate network, the wreckage caused by it is measured in terms of the losses associated with the downtime necessary for disinfecting the network. An inactive Trojan's mere presence can also be a deterrent for smooth operability. The Trojan may only be a zombie server that broadcasts spam, but consumes internal resources to do so. Systems that have been compromised by Trojans can also allocate spam which is highly likely to be pointed towards the network's own corporate mail server.

Round the Clock Internal Threats

With expansive communications options and the extension of the work environment to homes, cars, airports, and co�ee shops, the balance between work life and personal life has disappeared. A critical side e�ect of this revolution is that employees are now sharing critical enterprise data over insecure networks and failing to comply with security policies regarding equipment, facilities, and sensitive information.

Employees are now sharing critical enterprise data over insecure networks and failing to comply with security policies regarding equipment, facilities and sensitive information. Employees or insiders are often the cause

4

7

www.seqrite.com

DATA LOSS PREVENTION The Prevalent Risk of Data Leakage

of deliberate or accidental data breaches in established industries all around the world. Premeditated cases of sabotage are highly risky as employees have inside access and knowledge pertinent to critical infrastructure and processes. Accidental leakage is no less pervasive as it can release critical data unbeknownst to the organization and cause extensive damage. Just as companies make it mandatory to keep inventory of all physical goods, data should also be monitored and stocked with the same scrutiny.

The common sources of accidental data leakage by employees can be attributed to the following:

Employees underestimate the risks of data leakage

Employees think that their IT policies are foolproof and secure

Employees don’t actively think about security as an issue

Employees are not overly concerned with security protocols

Employees are unable to comprehend security policies due to their complexity

Employees have not been adequately educated with regards to security

Employees are hard pressed for time, hence they overlook security measures

4

8

www.seqrite.com

DEFININGDATA LOSS

PREVENTIONTECHNOLOGIESFOR BUSINESS

In the market scenario, Data Loss Prevention (DLP) goes by many nomenclatures. While DLP variants manage comparable fundamental activities to varying degrees, it is far more prudent to focus on what DLP does and its core competencies instead. In the broadest sense, DLP implements deep content analysis, centralized compliance management, provides expansive coverage across numerous platforms and unassailable remediation processes.

DLP is the methodology to identify and forestall the

unauthorized communication or

disclosure of confidential data. In order to ensure

that sensitive information is utilized in its intended

manner, DLP consolidates people, technology and

processes.

Today, progressive business enterprises expect Data Loss Prevention to be an integral part of any endpoint security solution. As DLP tools extend the in�uence of traditional security suites, they serve a de�nitive purpose and o�er the following bene�ts:

The possibility of data ex�ltration through applications or third-party software is eradicated.

Company-wide application surveillance policies are consistently implemented.

Installed software and inserted devices are scanned for security holes or blind spots.

Targeted attacks using advanced malicious techniques are thwarted.

While contemporary DLP technologies di�er with regards to their functionality, their key capabilities can be classi�ed as follows:

1. DLP tools monitor and enforce compliance policies within the existing network stack. This enables enterprises to enforce network-wide policies without opting for a standalone network appliance.

2. DLP technologies facilitate data surveillance within existing system kernels. It functions in conjunction with the operating system kernel in order to monitor user actions such as the copying and pasting of sensitive content.

3. DLP tools audit and implement security protocols within the existing �le system. This permits monitoring and enforcement of universal compliance rules regardless of data storage locations.

Conventional endpoint security o�ers divergent, but equally important features, such as Network Firewall, IDS/IPS, Web Security, Antivirus and more. While data leakage is a small part of enterprise security, it is an integral aspect which cannot be neglected. Business enterprises need to allocate their resources towards the complete spectrum of all these protocols for thorough protection and security.

4

9

www.seqrite.com

DATA LOSS PREVENTION Defining Data Loss Prevention Technologies for Business

Data at rest

Data in motion

Data in use

CLASSIFICATION OF DATA

Stored physically in any digital form – databases, data warehouses, archives, spreadsheets, o�-site backups, tapes etc.

Data that traverses a network or temporarily resides in computer memory – emails, downloaded �les, VPN data sharing etc.

Active data stored in non-persistent digital state – in RAM, CPU caches, registry entries etc.

Classifying Data for Best Business Practices

Implementing DLP strategies requires enterprises to gauge the lifecycle of their data. The following aspects of data storage need to be taken into consideration here.

sni�ng of network tra�c to single out sensitive content that is being transmitted across predetermined communication channels. The sni�ng out of speci�c ‘Data in motion’ occurs either passively or via inline proxies. The communication channels that can be inspected range from emails and Instant Messages to source code snippets within incoming/outgoing web tra�c.

Data in use (in endpoints)

Such data modules are directed by traditional endpoint solutions as well. ‘Data in use’ is scrutinized as a user interacts with the data in question. For instance, DLP protocols raise alerts whenever a sensitive document is being transferred to a USB drive and subsequently block the �le vis-à-vis blocking the drive in its entirety. These protocols detect illicit copy or pasting, and recognize when sensitive data is being executed on unwarranted applications.

Amidst the elimination and selection of DLP products, organizations must narrow down on tools that correspond with their requirements and scale as the business expands. Every organization has unique commitments so a meticulous analysis of employee habits, prevalent security protocols and liable data theft/transmission channels is mandatory.

Data at rest

Data that is reserved in silos on enterprise servers and content repositories is termed as ‘Data at rest’. DLP tools undertake active content discovery to scan these servers and pinpoint sensitive content, for instance, credit card numbers. If an unauthorized server is found to contain such data, the sensitive �le is deleted, encrypted or a security alert is sent to the owner of the �le.

Data in motion

DLP technologies facilitate the

10

www.seqrite.com

A MICROSCOPIC APPROACH TO DLPIMPLEMENTATION PROGRAMS

Prior to embedding Data Loss Prevention programs, enterprises must strategize preliminary tasks such as policy development, critical business process analysis, intricate systems audit and segregation of data types. It is also mandatory to include multiple stakeholders from IT verticals within the enterprise and their supported business units in these preparatory e�orts. The following considerations must also be competently addressed.

Classi�cation of enterprise information, data location and transfer pathways

Organizations should mandatorily pinpoint and classify sensitive data within the company, and its �ow and transmission pathways before setting up a DLP solution. Usually, extensive audits of data and its locations on servers and business assets are not readily available in a standardized fashion, so supplemental resources need to be diverted here. This helps achieve data taxonomy which further aids scanning and remedying data leakage within the organization.

Critical business units and processes should also be scrutinized to segregate data as customer data, employee data, �nancial data, Intellectual Property or more. Locating primary data silos and key data transfer pathways is also recommended. While maintaining multiple data copies of servers, workstations and other media is useful, this process often presents enterprises with challenging hurdles. Removing these stumbling blocks is advisable before investing in complex Data Loss Prevention architecture.

These copies are useful for application testing but sensitive data should be removed �rst. All this helps in selecting and placing a good DLP solution.

It is critical to understand and de�ne Data Life Cycle for enterprises. The lifecycle of information determines its

www.seqrite.com

11

criticality from the point of origin of the data through processing, maintaining, storing and disposing of said data. This aids companies to discover new data repositories and transfer channels. Comprehensive analysis of �rewall and router rules can also support the process of conducting inventory checks of all data egress points. Enterprises should remember that not all data moves through well-de�ned processes and not all company processes are well documented, making these steps necessary.

Establishment of intricate policies and high-level processes

Establishing simpli�ed and scalable data classi�cation policies is the next step. Each data category must be clearly de�ned and modi�ed so that data handling and inventory can be achieved with ease.

Subsequently, a high-level work�ow plan should demonstrate the segregated categories to target, the nature and personnel for desired actions, the expected outcomes and more. This helps address discrepancies, policy violations, escalation methodologies and setting up the process for establishing exceptions, if any. DLP tools also enable companies to establish after-hour processes and review procedures that emanate from appropriate stakeholders.

Crucially, e�ective incident management processes should be re�ned to make them ubiquitous for every data category and rule.

Stage-based implementation of DLP protocols and processes

For best results, DLP tools and programs should initially be launched in a monitor-only mode. This permits the �ne tuning of the system from a scaled up point of view. Moreover, this enabled enterprises to accurately predict the impact of DLP tools and processes on the business. Precise system-driven alerts need to be gained in order to inculcate security awareness and behavioral changes. If all tra�c �ow is haphazardly blocked at �rst, critical business processes are highly likely to be derailed.

At �rst, organizations may be concerned about the amount of

DATA LOSS PREVENTION A Microscopic Approach to DLP Implementation Programs

12

sensitive data “�oating around the place” at �rst, but ensuring system activation at the initial stages is of paramount importance. Initially overlooked or neglected concerns come to light later when the DLP protocols are �rmly placed and activated.

Remediation of data classi�cation or policy violations

In-depth scrutiny of the location and transmission of sensitive data can lead an enterprise to be taken aback by the volume and extent of visibility. Digital footprints of this critical data can cause consternation and lead to steps that may prove detrimental in the long run.

Enterprises are thus advised to utilize a risk-based approach which helps to prioritize and address problems e�ciently. Including all critical stakeholders since the initiation of the DLP process is vital as there are usually multiple issues to tackle. Moreover, the remediation process of dealing with violations should be properly documented so that audits, inquiries and violations in the future can be handled with increasing e�ectiveness.

Maintenance and remodeling of ongoing DLP programs

Periodic reviewing of implemented DLP protocols is highly advocated as new hazards, compliance issues and privacy audits provide tremendous data for enterprises to work with. Optimization of classi�cation rule sets and policies can also be enhanced in this manner.

Enterprises are also counseled to maintain diligence while pinpointing loopholes and narrowing down on the breadth of upgrades possible. This is vital as new data formats or information sets can appear occasionally. Upholding a testing and staging environment helps implement patches and upgrades without security glitches. Security training, awareness and education of employees should also be imparted frequently.

DATA LOSS PREVENTION A Microscopic Approach to DLP Implementation Programs

www.seqrite.com

13

BUSINESS BENEFITS OFAN INTEGRATED DLPPROGRAMInvesting in a scalable and exhaustive DLP program should gain antecedence for corporations of all sizes. In the midst of their implementation of DLP policies, an enterprise also gains the added bene�t of a company-wide audit of data storage and security policies. It is advisable to understand the DLP needs and scale of the organization before laying the foundations for DLP architecture. Here are the bene�ts of an integrated DLP program:

www.seqrite.com

Bene�ts of DLP What Organizations Get

Insulates critical business units and Intellectual Property (IP).

Organizations maintain various kinds of data for competitive, regulatory or reputational purposes. Such data repositories contribute towards the sustenance of critical business units and IP which are safeguarded by DLP protocols.

Forestalls incidental or deliberate data leakage from transfer channels.

Data leakage potentially occurs through assorted transfer channels such as emails, printouts, IMs and more. DLP tools scan these channels for critical data, even if it is disguised by encryption mechanisms.

Diminishes operational and restoration costs associated with data leakage.

Companies endure huge �nancial hits from investigating the extent of data compromised and the source of the leakage after a data breach. DLP tools push back these incidental costs and provide companies with leeway to be cost e�ective.

Detects and mitigates complex data risks for enterprises.

DLP protocols enable enterprises to mitigate future risks by classifying and segregating data repositories. With predictive strategies companies can strengthen their weak spots and not be blindsided by unforeseen intrusions.

Perpetuates conformity with current and subsequent regulatory compliances.

DLP rule sets condition organizations to conform to their exclusive regulatory policies. In case of policy renewal or amendments, the enterprise can easily adapt to the transition and alter data storage or contents.

Optimizes bandwidth and storage management for superior e�ciency.

As DLP tools execute intensive audits of stored data, they identify stagnant or obsolete �les, and other unwanted IT resources. These �les and processes are phased out so as to optimize storage space and bandwidth.

Detects covert APTs and high risk malware that siphon away crucial data.

APTs gradually embezzle information by remaining undetected for years. DLP tools detect anomalies to unearth APTs and other high risk malware or rogue software that transmits data from within the organization.

Bolsters data security training and awareness of employees.

Data security education is routinely provided to employees but often forgotten. With real-time alerts and active blocking, DLP reinforces this learning and advises employees about what they should or should not share.

14

DATA LOSS PREVENTION Business Benefits of an Integrated DLP Program

www.seqrite.com

CONCLUSION

15

Critical information within an enterprise ranks amongst its most valuable assets and a DLP program o�ers the capability to mitigate security risks to these critical business assets. Hurried or improperly implemented DLP tools can also disrupt established business processes and corporate culture. It is essential for enterprises to implement accurate planning, in-depth communication and awareness training before DLP deployment.

Adhering to a structured selection process also helps enterprises navigate the confusing market of Data Loss Prevention tools. Companies should know which business units are more vulnerable to potential data breaches and how to deal with policy violations before deployment of DLP tools.

Enterprises should also possess intricate knowledge about location, utilization and access of stored data. Aligning this information with practical business situations ensures e�ective policy development and compliance enforcement. The �exibility to alter policies and business processes when needed is also a crucial requirement.

Data-driven companies require e�ective DLP tools and strategies for the protection of sensitive data. This data drives future growth that grants these companies a competitive advantage. Data Loss Prevention also lowers expenses which can alternatively be invested in other avenues of strategic business growth. Data which remains within the company retains its value and becomes exponentially more valuable over time.

www.seqrite.com

To �nd out how your business can derive the bene�ts of information security and prevent unsolicited data leakage, inquire about

SEQRITEDATA LOSS PREVENTIONOn +91 - 7028009844 or send an email tocorporate@seqrite.com

Seqrite DLP is integrated with Endpoint Security 6.0

Request a Demo

Quick Heal Technologies Pvt. Ltd.

Headquarters:

603, Mayfair Towers-II, Wakdewadi, Shivaji NagarPune-411005, Maharashtra, India.

Phone: +91-20-41060400 / 66025985Fax: +91-20-41060401Email: info@seqrite.com