Data Loss/Leakage Prevention - Diva-portal

1.3 Definition of Security gapIn this part, first the meaning of gap is explained, and then meaning of security gap is described,and followed by the causes of the gap that might lead to a security gap problem. .What is meant by gap? Gap is sometimes called „the space between where we are and where wewant to be‟. The gap analysis is undertaken as means of bridging that space. It is a technique fordetermining the steps that are nee to be taken in moving form a current state to a desired futurestate. It begins with questionnaire “what is” and proceeds to “what should be” and finallyhighlights the „gaps‟ that exist and need to be „filled‟.Here comes what is security gap? Security gaps are nothing but the vulnerabilities or weaknessin the organization which is a threat and can be exploited to make an attack.There are two ways of attacks such as External and Internal. External Attacks are those attackswhich are done by hackers and other people from the outside of an organization network. It isdone by finding the vulnerability and exploiting that to make an attack. Malware infection,DDOS attack, Man in the middle are few types of attack which are done to gain monetarybenefits or to harm the organization assets .Internal Attack is performed from the internal perimeter of the organization by a disgruntledemployee, contractors or vendors either for monetary benefits or to take away some confidential,sensitive data out of the organization. Software code, PCI DSS information, financial reports,NER report are few examples of inside attack which are performed from inside of the network.Why the gap is a problem? The gap becomes a problem when there is a false feel of informationsecurity is created as this false feeling does not protect against threats. This might due to thecauses such as organization may not be aware of information security risk to their operations, bydefault acceptance of unknown level of risk, unconscious deciding on risk level, relaying onineffective controls, not able to justify the spending of security, etc.Though organization has many security frameworks and techniques that are available today butthe overall security structure or measurements is far from acceptance. The false feel of securityhas various causes such as interests, language, education, uncertainty, knowledge, view onprocess control, and methods to handle information (in) security. All these can be looked at invarious ways [47].1.4 Organization DetailsThe organization is one of the fortune 500 companies in the world which has its major businessin payroll processing and human resource solutions along with tax and computing solutions.Master Thesis - Data Loss/Leakage PreventionPage 12

The organization is one of four U.S. companies to get a AAA credit rating from Standard &Poor's (S&P) and Moody's.We have kept the organization name anonymous due to its nature of business as it deals withsensitive (payroll) data of more than 545,000 organizations.1.5 Problem DefinitionData leakage problem became an existing problem in many organizations. This even became amajor problem in organizational view point. This particular problem arises in the context wherethe sensitive data and company documents are protected by a security model. In organization, themajor data loss is mainly happening from insider attack. Though the security technologies suchas Firewall, IDS, IPS etc. (which are already implemented in organization) are very powerful butcan help majorly an outsider attack on data. Since these technologies doesn‟t help majorly oninsider attacks, so this results to a data leakage problem.In looking at the above problem facing the prevention of data leakage problem, doesorganization have what it takes to counter this problem? It is now evident that data must beprotected from data loss problem to give a competitive edge. But given this data leakageproblem, how does the organization supposed to prevent the data leakage problem?1.6 Thesis OutlineChapter II is a literature review of DLP technology and it provides details scenarios of type ofdata loss and what sensitive data DLP can monitor and protect from leakages.Chapter III presents the details of research methodology wherein we have given the details oftype of research and ways of data collection.Chapter IV presents the details of Theoretical study on Data Leakage ProblemsChapter V gives empirical study and data analysis on overview of the organization along withusage of DLP technology in comparison with previously used technology in organization.Chapter VI gives results on the research question which focuses on the security gap filled byDLP in concurrence to previous technologies and also brings in detail about data leakageproblems in case settings, and analysis part which brings out the analysis on DLP existence insolving Data Leakage Problem and analysis of DLP products and its Implementation inorganization.Master Thesis - Data Loss/Leakage PreventionPage 13

Chapter VII contains the conclusion, future research on DLP with cloud computing andreferencesChapter VIII contains Interview questions and appendices1.7 Research QuestionsHow the security gap is filled using the DLP technology compared to previous techniques?1.8 Thesis LimitationLegal issues in adopting Data Loss Prevention in different countries and regions due to variouslaws of Governance, Risk and Compliance.Master Thesis - Data Loss/Leakage PreventionPage 14

CHAPTER II2. Literature Review on Data Loss/Leakage Prevention2.1 Introduction on DLPIn this chapter we have tried to bring the facts that are behind the engineering of Data LossPrevention technology. This chapter though it looks like a problem statement but it generallyspeaks about the overall issues in and around the organizations. In a broader sense it gives anunderstanding of the security breaches as examples which happened with various organizations,the source of threat to data loss. It also focus on what type of data to be considered as sensitive tothe organization which can be monitored to avoid data leakages since all data/information cannotbe considered as sensitive.The issue of data loss or data breach has been one of the biggest fears that most of theorganizations face today. The term DLP stands for Data Loss/Leakage Prevention, which wasintroduced in 2006. Like numerous security products, DLP has improved and is beginning toinfluence the security industry worldwide. While doing my research I came across a paper thatthis DLP technology had been known to bear Information loss Prevention/Protection,Information Leak prevention/Protection, and Extrusion Prevention. Later this DLP technologygained some popularity in the early year 2007 [2].In some organizations, there is a wide hole in controlled and in secure environment which wascreated to protect electronic assets. This hole is the way where the business and individualscommunicate with each other over the Internet.Whether if it is an email/instant message/webmail/website form/file transfer/electroniccommunications that are existing in the company still it is uncontrolled and unmonitored on theirway to their destinations along with the potential for confidential information to fall into thewrong hands.Data loss prevention (DLP) is interested in identifying sensitive data and also is one of the mostcritical issues facing CIOs, CSOs and CISOs. DLP is now today‟s strict regulatory and ultracompetitive environment. In creating and implementing a DLP strategy, the task can seem to beintimidating. For this the effective solutions are available. This thesis presents best practices forpreventing leaks, enforcing compliance, protecting company‟s brand value and reputation inorganization[3].2.2 Defining the Data LossThe data loss issue is being exposed from confidential information about a customer to dozens ofcompany‟s product files and documents being sent to a competitor. This can be caused in manyMaster Thesis - Data Loss/Leakage PreventionPage 15

ways either accidental or deliberate, or even with insiders in realizing sensitive data aboutcustomer‟s personal information, intellectual property, or other confidential information inviolation of company policies and regulatory requirements.Here considering few of high-profile examples:- AOL posts search engine data contains personal information about its members- DuPont employee leaks 400 million in intellectual property- Former Ceridian employee who accidentally posts ID and also bank account data for 150employees of an advertising firm on a websiteLike the above there are many more data loss problem occurred and the list goes on [4].In organization, today‟s employees with available access to electronically expose sensitive data,the scope of sensitive data loss problem is greater than outsider‟s threat protection.In order to cover all the loss bearings, an organization has the potential to encounter: Data in motion – Any data that is moving through the network to the outside via theInternet Data at rest – Data that resides in files systems, databases and other storage methods Data at the endpoint – Data at the endpoints of the network (e.g. data on devices such asUSB, external drives, laptops, mobile devices, etc)[3,4].2.3 What Data is Sensitive?The two important firms such as, regulatory compliance and intellectual property protectionairing data loss prevention efforts.Regulatory Compliance: Almost very organization falls under one or more local, or Internationalregulatory mandates. The companies are required to take measurements to protect private andpersonally-identifiable information, in whatever regulations they belongs too. Personallyidentifiable information can be used to uniquely identify a particular person (whether a customer,employee, student or patient, etc). For example, in U.S., thirty-five states presently behest thenotification of individuals by the company who suffers a data loss in the event that theirpersonally identifiable information is breached[4].Data loss is not only a fundamental problem data-sensitive field companies, but also for theorganization conducting the business worldwide.Simple missteps can constitute regulatory violations. Missteps such as, sending a legitimateemail which contains unencrypted ATM password or credit card information or sharing a reportwhich includes employee personal data or medical data with an unauthorized person.Master Thesis - Data Loss/Leakage PreventionPage 16

Intellectual Property Protection(IP): In today‟s environment, IP is a major concern for allorganizations. In protecting important assets of the business such as one trying to obtain secretinformation and employee taking sensitive information with them, is a key driver of data lossprevention efforts.From 2006 report of United States Trade Representative, U.S. businesses are losingapproximately 250 billion annually cause of trade secret theft. The trade secrets can bediagrams, flowcharts, program devices, formulas, patterns, techniques, supplier, etc. With theseconsiderations, the chances are good that employees may not even know they are handling IP [5].Companies are in response to take necessary steps to better protect valuable IP from situationssuch as; Sending unreleased pricing information to the unauthorized or wrong email address. Sending customer information by an employee without their knowledge to a third partyfor financial gain,. Sending ownership information to a distributor who might can forward it on tocompetitors. Forwarding an email containing business plans to another email address.2.4 Why Data Loss is so prevalent?Now the world is connected using electronic communication where we are electrically connectedin numerous ways. It doesn‟t matter where we are around the globe. Accessing the electronicdata has become more crucial in day-to-day business.For instance, many companies have development offices at offshore level, and /or internationallevel in which all were exponentially increase the opportunity for data loss. Confidentialinformation can travel even to the far corners of the earth using simple email communication.Over the years, organizations have spent large amount of resources in a motive to protect theirinformation. In their effort, majority was focused on preventing outsiders from hacking into theorganization. Unintentional information loss from employees and partners are the results ofmajority of all leaks in leading firms. Research conducted on data loss prevention indicates thatmore than half of security breaches are caused by insiders. In an organization, employees cancause a sudden damage for their company even with the simple click of a mouse[3,5].2.5 Sizing Up the Data Loss ProblemAs companies exit safety procedure, the companies are paying for not monitoring and controllingelectronic communications. Most of the organizations scan inbound email for dangerous content,Master Thesis - Data Loss/Leakage PreventionPage 17

and fail to check their outgoing email, IM and allowing the unauthorized transfer of sensitiveinformation outside of the organization.Below is the estimation stated by Deloitte‟s Global Security Survey report [6]; 49% of companies have experienced an internal security breach in the past year.31% experienced a breach from a virus/worm incident.28% through insider fraud.18% by means of data leakage.96% of respondents reported that they are concerned about employee misconductinvolving their information systems.FIGURE 1: Nearly half of all companies surveyed have experienced an internal security breachin the past year. The most common breach causes are outlined in the chart above [6].(Source: Deloitte‟s Global Security Survey)Data loss can cause an organization to violate compliance regulations. It can be a threat to aconsiderable brand value that a company has built. In order to protect its investment in its assetssuch as brand, products, partnerships and employees, a company can no longer bear to ignorethis hole in the corporate protection.The prevalence of electronic communications, data in motion (i.e., data that is traveling throughand out of the network) is one of the most significant data loss vectors to address today. Forinstance if an employee send a document to their personal email address, so that the employeecan work from home. Likewise if a working employee in a hospital sends patient information toa wrong person.There are also many accesses in which confidential data can leave an organization via theinternet: Email WebmailMaster Thesis - Data Loss/Leakage PreventionPage 18

HTTP (message boards, blogs and other websites) Instant Messaging Peer-to-peer sites and sessions FTPFirewall and other network security solutions which are currently being used not inc lude dataloss prevention capabilities in order to secure data in motion. Organization employee can stillleak confidential information if appropriate controls are in place within the company to addressthe data loss problem.In order to prevent company‟s employee, consultant and any other authorized user who transmitsthe sensitive information outside the organization, companies should start to implementcomprehensive data loss prevention solutions and also the company must encompass multiplelayers such as email, Web, instant messaging and many more. The data loss solutions address therisks inherent in data at rest and also data at the end-point[7].DLP Traffic CopIn order to tackle the vulnerability of data in motion, the companies are in need of traffic cop formonitoring and controlling each and every communication that leaves the company.A DLP solution prevents confidential data loss by monitoring communications which goesoutside of the organization, encrypting the email which contains confidential information,enabling conformity with global privacy and data security mandates, in securing outsourcing andalso partner communications, by protecting intellectual property and preventing malware -relateddata harvesting, enforcing acceptable use policies and also in providing a deterrent for malicioususers. In addition to this, DLP solution can also be instrumental in helping companies complywith regulations.An outbound email which contains personally identifiable information or personal informationcan be encrypted automatically. Keeping DLP as best practices in mind can help the organizationto determine the right solution for a company‟s specific requirements on data loss problem [8].A censorious component of data loss prevention is the definition and enforcement of acceptableuse policies for electronic communications. Appropriate use areas add policies against activitiessuch as illegal activities, or sending communications to certain parties without legal disclaimers.In order to enforce appropriate use policies, DLP solution is the requirement for organizationswith the capabilities such as: Blocking unlawful activitiesProhibiting the distribution of copyrighted contentsMaster Thesis - Data Loss/Leakage PreventionPage 19

Preventing the use of gambling websitesEnforcing the message policyAdding legal denials to outgoing mails.2.6 DLP key featuresDLP allows enterprise to:Monitor all network transmissions for sensitive content.Block or Quarantine transmissions in violation of policy.Protect all types of data within your enterprise.Monitoring - DLP identifies a wide range of sensitive enterprise content, from information inconfidential documents, to customer and privacy related information, to content specified bycustomers, or provided out-of-the-box.Enforcing - DLP uses information gathered from monitoring to enforce enterprise data privacypolicies and to meet designated compliance requirements.Analysis - DLP recognizes over 900 different file types. Analysis of the data is based on theactual content of the file and not the extension that is used with the file [8].2.7 DLP LimitationsWhat DLP can't find: DLP tools can only monitor encrypted content when they have access to the key, which istypically limited to e-mail and Web traffic (with the use of a specialized SSL proxy). Most tools are limited in their ability to detect "stealth" traffic (i.e., tunneled protocols),unless a local host DLP agent is installed. Endpoint tools are nascent, and many vendor offerings are limited in terms of scanningand blocking capabilities.Keeping the above mentioned limitation, a DLP technology has to be identified as no empiricalresearch has been taken on this area.2.8 Previous Research on DLPPR1: On exploring through web we have find a Thesis on Data Loss Prevention by HannesKasparick done in 2008 in which the author has highlighted the data loss issue in theorganizations and there causes.Master Thesis - Data Loss/Leakage PreventionPage 20

Most companies are not aware of industrial espionage and loss of intellectual property until ahigh quality copy of one of their

Master Thesis - Data Loss/Leakage Prevention Page 3 ABSTRACT In today‟s business world, many organizations use Information Systems to manage their sensitive and business critical information. The need to protect such a key component of the organization cannot be over emphasized. Data Loss/Leakage Prevention has been found to be