data loss prevention data protection Giacomo Lanzi

Data Loss Prevention: definition and uses

Estimated reading time: 7 minutes

Data loss prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused or accessed by unauthorized users. DLP software classifies regulated, confidential and business-critical data and identifies violations of policies defined by organizations or within a predefined policy package. Default policies are typically dictated by regulatory compliances such as HIPAA, PCI-DSS, or GDPR.

Once these possible violations are identified, the DLP applies “remediation” with alerts, encryption, and other protective actions. The goal is simple: prevent end users from accidentally or maliciously sharing data that could put the business at risk.

Data loss prevention software and tools monitor and control endpoint activity, filter data flows across corporate networks, and monitor data in the cloud to protect data at rest, in motion, and in use. DLP also provides reports to meet compliance and auditing requirements. A very useful tool also for identifying areas of weakness and anomalies for incident response.

data loss prevention data protection

Is it necessary to use DLP tools?

Data loss prevention addresses three main objectives that are common pain points for many organizations: personal information protection/compliance, intellectual property protection, and data visibility.

Personal Information Protection / Compliance

Does your company collect and store personally identifiable information (PII), protected health information (PHI), or payment card information (PCI)? If so, you are more than likely subject to compliance regulations, such as HIPAA (for PHI) and GDPR (for personal data of EU residents), that require you to protect your customers’ sensitive data.

Data loss prevention can identify, classify and label sensitive data and monitor activities and events surrounding that data. Additionally, reporting capabilities provide the details needed for compliance audits.

Intellectual property (IP) protection

Does the company hold important intellectual property and trade or state secrets that could jeopardize the financial health and/or image of your brand in the event of loss or theft? A DLP solution can classify intellectual property in both structured and unstructured forms.

With policies and controls in place, you can protect against unwanted exfiltration of this data.

Data visibility

Is the company looking to gain additional visibility into data movement? A comprehensive enterprise DLP solution can help you see and track your data across endpoints, networks and clouds. This will provide visibility into how individual users within your organization interact with data. As we have seen other times when talking about social engineering, knowing how users behave is very useful. It is used to draw a basic profile and monitor that there are no anomalies that could indicate compromise of the account.

The ones listed above are main use cases. But DLP can address a variety of other pain points including insider threats, user and entity behavior analytics, and advanced threats.

data loss prevention servers

Why adopt data loss prevention?

In the 2017 Gartner Magic Quadrant for Enterprise DLP, the total data loss prevention market was estimated to reach $1.3 billion in 2020. The size was approximately $2.64 billion. The DLP market is not new, but it has evolved to include managed services, cloud capabilities, and advanced threat protection, among other things.

This, combined with the increasing trend of major corporate breaches, has skyrocketed the adoption of DLP as a means to protect sensitive data. Here are nine trends that are driving DLP adoption.

Growth of CISOs

More and more companies are hiring Chief Information Security Officers (CISOs) who report to the CEO. The latter want to know the strategic plan for preventing data leaks. Data loss prevention tools provide clear value in this regard and give CISOs the reporting capabilities needed to provide regular updates.

Evolution of compliance requests

Global data protection regulations are constantly changing and every organization must be adaptable and prepared. In recent years, EU legislators have approved the GDPR. In the USA a similar event occurred when the State of New York adopted the NYDFS Cybersecurity Regulation. These new regulations have both tightened data protection requirements. DLP solutions allow organizations the flexibility to evolve with changing global regulations.

Increase in “places” where data is kept

The increased use of the cloud, complicated supply chain networks and other services over which you no longer have full control has made data protection more complex. Visibility into events and context surrounding data before it leaves your organization is important to prevent your sensitive data from falling into the wrong hands.

Frequency of data breaches

Nation-state adversaries, cybercriminals, and malicious insiders target your sensitive data for a variety of reasons, such as corporate espionage, personal financial gain, and political advantage. Data loss prevention can protect against all types of adversaries, malicious or otherwise.

In recent years, there have been thousands of data breaches and many other security incidents. Billions of records have been lost in giant data breaches such as: the database misconfiguration that leaked nearly 200 million US voter records in 2015, the Equifax data breach that continued to grow, and the Yahoo breach which affected 3 billion users. These are just a few of the many headlines that highlight the need to protect your organization’s data.

data loss prevention breach

The value of the data is very high

Stolen data is often sold on the Dark Web, where individuals and criminal groups can purchase it and use it for their own benefit. With some types of data selling for up to thousands of dollars, there is a clear financial incentive for data theft.

There is more data to steal

The definition of what is sensitive data has expanded over the years. Sensitive data now includes intangible assets, such as pricing models and business methodologies. From 1975 to 2015, the amount of intangible assets grew from 17% to 84% of market value, according to a study by Ocean Tomo. These assets also reached a record $21 trillion in 2018. This means that your company has a lot more data to protect and using data loss prevention could only help in this regard.

There is a shortage of specialized personnel

The security talent shortage isn’t going away anytime soon, and there has likely already been an impact on your business. In fact, in a 2017 ESG and ISSA survey, 43% of respondents said their organizations were affected by a lack of skilled staff. The shortage is worsening with 3.5 million unfilled security positions expected by the end of 2021. Managed data loss prevention services act as remote extensions of your team to fill this staffing gap.

Adopt a SIEM to implement DLP

Ormai il prodotto di più alto valore di un’azienda sono i dati che gestisce. Il rischio di data exfiltration e conseguente perdita economica e d’immagine è dietro l’angolo. È facile a dirsi che basta proteggere i propri dati, la realtà è che diventa ogni giorno più complicato.

Nowadays, a company’s highest value product is the data it manages. The risk of data exfiltration and consequent economic and image loss is just around the corner. It’s easy to say that protecting your data is enough, the reality is that it becomes more complicated every day.

The places where data are used and stored, as well as the methods of access and consultation, are increasing. Technology, in general, makes our lives easier while at the same time exposing our data. Corporate infrastructures are no exception, indeed, precisely due to the highly valuable nature of the data collected, they are subject to greater risk.

The adoption of an adequate security system is essential and there are many solutions available. We at SOD, speaking of data loss prevention, recommend adopting a SIEM that includes the tools necessary to implement DLP techniques. For even better protection and more granular control of user data, SOC as a Service also provides behavioral analysis performed by an artificial intelligence system (UEBA).

To find out how these services can help your company protect your data and infrastructure, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

Machine learning and cybersecurity: UEBA applications and security

Avoid Ransomware: That’s why it’s best not to take any risks

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 June 16, 2024
    Posted by Andrey Stoykov on Jun 15# Exploit Title: Business Logic Flaw and Username Enumeration in spa-cartcmsv1.9.0.6 # Date: 6/2024 # Exploit Author: Andrey Stoykov # Version: 1.9.0.6 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html Description - It was found that the application suffers from business logic flaw - Additionally the application is vulnerable […]
  • APPLE-SA-06-10-2024-1 visionOS 1.2 June 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Jun 11APPLE-SA-06-10-2024-1 visionOS 1.2 visionOS 1.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT214108. Apple maintains a Security Releases page at https://support.apple.com/HT201222 which lists recent software updates with security advisories. CoreMedia Available for: Apple Vision Pro Impact: An app may be […]
  • CyberDanube Security Research 20240604-0 | Multiple Vulnerabilities in utnserver Pro/ProMAX/INU-100 June 9, 2024
    Posted by Thomas Weber via Fulldisclosure on Jun 09CyberDanube Security Research 20240604-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| SEH utnserver Pro/ProMAX / INU-100 vulnerable version| 20.1.22 fixed version| 20.1.28 CVE number| CVE-2024-5420, CVE-2024-5421, CVE-2024-5422 impact| High homepage| https://www.seh-technology.com/...
  • SEC Consult SA-20240606-0 :: Multiple critical vulnerabilities in Kiuwan SAST on-premise (KOP) & cloud/SaaS & Kiuwan Local Analyzer (KLA) June 9, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Jun 09SEC Consult Vulnerability Lab Security Advisory < 20240606-0 > ======================================================================= title: Multiple critical vulnerabilities product: Kiuwan SAST on-premise (KOP) & cloud/SaaS Kiuwan Local Analyzer (KLA) vulnerable version: Kiuwan SAST
  • Blind SQL Injection - fengofficev3.11.1.2 June 9, 2024
    Posted by Andrey Stoykov on Jun 09# Exploit Title: FengOffice - Blind SQL Injection # Date: 06/2024 # Exploit Author: Andrey Stoykov # Version: 3.11.1.2 # Tested on: Ubuntu 22.04 # Blog: https://msecureltd.blogspot.com/2024/05/friday-fun-pentest-series-6.html Steps to Reproduce: 1. Login to application 2. Click on "Workspaces" 3. Copy full URL 4. Paste the HTTP GET request into […]
  • Trojan.Win32.DarkGateLoader (multi variants) / Arbitrary Code Execution June 9, 2024
    Posted by malvuln on Jun 09Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/afe012ed0d96abfe869b9e26ea375824.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Trojan.Win32.DarkGateLoader (multi variants) Vulnerability: Arbitrary Code Execution Description: Multiple variants of this malware look for and execute x32-bit "urlmon.dll" PE file in its current directory. Therefore, we can...
  • SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) June 9, 2024
    Posted by InfoSec-DB via Fulldisclosure on Jun 09Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3) Google Dork: inurl:"Powered by Boelter Blue" Date: 2024-06-04 Exploit Author: CBKB (DeadlyData, R4d1x) Vendor Homepage: https://www.boelterblue.com Software Link: https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US Version: 1.3 Tested on: Linux Debian 9 (stretch), Apache 2.4.25, MySQL >= 5.0.12 CVE:...
  • CyberDanube Security Research 20240528-0 | Multiple Vulnerabilities in ORing IAP-420 May 30, 2024
    Posted by Thomas Weber via Fulldisclosure on May 29CyberDanube Security Research 20240528-0 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| ORing IAP-420 vulnerable version| 2.01e fixed version| - CVE number| CVE-2024-5410, CVE-2024-5411 impact| High homepage| https://oringnet.com/ found| 2024-01-19 by| T. Weber...
  • HNS-2024-06 - HN Security Advisory - Multiple vulnerabilities in Eclipse ThreadX May 30, 2024
    Posted by Marco Ivaldi on May 29Hi, Please find attached a security advisory that describes multiple vulnerabilities we discovered in Eclipse ThreadX (aka Azure RTOS). * Title: Multiple vulnerabilities in Eclipse ThreadX * OS: Eclipse ThreadX < 6.4.0 * Author: Marco Ivaldi * Date: 2024-05-28 * CVE IDs and severity: * CVE-2024-2214 - High - […]
  • SEC Consult SA-20240527-0 :: Multiple vulnerabilities in HAWKI didactic interface May 28, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on May 27 SEC Consult Vulnerability Lab Security Advisory < 20240527-0 > ======================================================================= title: Multiple vulnerabilities product: HAWKI (Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany) vulnerable version: 1.0.0-beta.1, versions before commit 146967f     fixed version: Github commit 146967f...

Customers

Newsletter

{subscription_form_1}