Research

Data Loss Prevention is one of the most hyped, and least understood, tools in the security arsenal. With at least a half-dozen different names and even more technology approaches, it can be difficult to understand the ultimate value of the tools and which products best suit which environments. This series of posts will provide the necessary background in DLP to help you understand the technology, know what to look for in a product, and find the best match for your organization. I won’t be providing product ratings, I suggest the Gartner Magic Quadrant for that, but will provide you the tools you need for the selection process. DLP is an adolescent technology that provides significant value for those organizations that need it, despite products that may not be as mature as other areas of IT. The market is currently dominated by startups, but large vendors have started stepping in, typically through acquisition. The first problem in understanding DLP is figuring out what we’re actually talking about. The following names are all being used to describe the same market: Data Loss Prevention/Protection Data Leak Prevention/Protection Information Loss Prevention/Protection Information Leak Prevention/Protection Extrusion Prevention Content Monitoring and Filtering Content Monitoring and Protection And I’m sure I’m missing a few. DLP seems the most common term, and while I consider its life limited, I’ll generally use it for these posts for simplicity. You can read more about how I think of this progression of solutions here. Even a clear definition of DLP can be confusing and hard to find. I generally consider them, “products that, based on central policies, identify, monitor, and protect data at rest, in motion, and in use through deep content analysis”. I used to restrict myself to network-based monitoring and blocking solutions, but we’ve recently seen advances in endpoint protection. I’ll detail all these nuances as we dig deeper into the subject. The DLP market is also split between DLP as a feature, and DLP as a product. A number of products, particularly email security solutions, provide some basic DLP functions, but aren’t necessarily real DLP products. The difference is: A DLP Product includes centralized management, policy creation, and enforcement workflow dedicated to the monitoring and protection of content and data. The user interface and functionality are dedicated to solving the business and technical problems of protecting content through content awareness. DLP Features include some of the detection and enforcement of DLP products, but are not dedicated to the task of protecting content and data. This distinction is important because DLP products solve a specific business problem that may or may not be managed by the same business unit/user responsible for other security functions. We often see non-technical users responsible for the protection of content, such as a legal or compliance officer. Even human resources is often involved with the disposition of DLP alerts. Some organizations find that the DLP policies themselves are highly sensitive or need to be managed by business unit leaders outside of security, which also supports a dedicated product. Because DLP is dedicated to a clear business problem (protect my content) that is differentiated from other security problems (protect my PC or protect my network) most of you should look for dedicated DLP solutions. This doesn’t mean that DLP as a feature won’t be the right solution for you, especially in smaller organizations. It also doesn’t mean that you won’t buy a suite that includes DLP, as long as the DLP management is separate and dedicated to DLP. We’ll be seeing more and more suites as large vendors enter the space, and as we’ll discuss in a future post it often makes sense to run DLP analysis or enforcement within another product, but the central policy creation, management, and workflow should be dedicated to the DLP problem and be isolated from other security functions. There are a few last terms I want to define before finishing off this post. The first is content awareness. One of the distinctions of DLP solutions is that they look at the content itself, not just the context. Context would be sender/recipient. Content is digging into the pdf embedded in the Word file, embedded in a .zip file, and detecting that one paragraph matches a protected document. In a later post I’ll describe the major detection techniques, and which ones work best for which kinds of content. We also need to discuss what we mean by protecting data at rest, data in motion, and data in use. Data-at-rest includes scanning of storage and other content repositories to identify where sensitive content is located. We call this content discovery. For example, you can use a DLP product to scan your servers and identify any documents with credit card numbers. If that server isn’t authorized for that kind of data, the file can be encrypted or removed, or a warning sent to the file owner. Data-in-motion is sniffing of traffic on the network (passively or inline via proxy) to identify content being sent across communications channels. For example, this includes sniffing emails, instant messages, or web traffic for snippets of sensitive source code. In motion tools can often block based on central policies, depending on the type of traffic. Data-in-use are typically endpoint solutions that monitor data as the user interacts with it. For example, they can identify when you attempt to transfer a sensitive document to a USB drive and block it (as opposed to blocking use of the USB drive entirely). Data in use should also detect things like cut and paste, or use of sensitive data in an unapproved application (such as someone attempting to encrypt data to sneak it past the sensors). The last thing to remember about DLP is that it is highly effective against bad business processes (unencrypted FTP exchange of medical records with your insurance company) and mistakes. While DLP offers some protection against malicious activity, we’re at least a few years away from these tools really protecting against a knowledgeable malicious attacker. Fortunately for us, most of our risk doesn’t fall into this category. That’s it for today; as

Computerworld yesterday reported on a US-CERT advisory for the popular Quickbooks Online Edition. I know it’s popular because I use it. And I’m popular. Aren’t I? Really? Oh… Don’t tell my mom, okay? I just started using QuickBooks Online to run the business side of Securosis. I think it’s a great idea, but they REALLY need to re-think the architecture. IE only ActiveX controls are like totally 1990s. I have to run Parallels to enter expenses (since I’m on a Mac). Web 2.0 guys, it’s totally “in”. Either that, or update QB Pro on the Mac to have all the features of the Windows version, instead of a subset. Like they’re reading this blog. Oh well, that’s what I get for giving them money even though I’m not totally happy with the service. I only have myself to blame. Where’s that shaker of salt again? Share:

Securosis, L.L.C. is a security consulting practice dedicated to thought leadership, objectivity, and transparency. Our consultants have all held executive level positions and are dedicated to providing the highest value strategic consulting available. We provide services in four main areas: Publishing and Speaking: including independent, objective whitepapers, webcasts, and in-person presentations. Strategic Consulting for Vendors: including market and product analysis and strategy, technology guidance, product evaluations, and merger and acquisition assessments. Strategic Consulting for End Users: including product selection assistance, technology and architecture strategy, education, and security management evaluations, and risk assessments. Investor Consulting: including product and market evaluations, available in conjunction with deep product assessments with our research partners. Our clients range from stealth startups to some of the most well known technology vendors and end users. Clients include large financial institutions, institutional investors, startups, mid-sized enterprises, and major security vendors. Securosis is partnered with security testing labs to provide unique product evaluations that combine in-depth technical analysis with high level product, architecture, and market analysis. Share:

Since most of you blog readers don’t care about how I feed myself I don’t intend on using the blog for boring corporate updates, but I’m going to indulge myself for a moment. Securosis, L.L.C. is up, running, and available for any of your security consulting needs. I’ll be keeping the About Securosis page updated with services and programs as I get them more formalized. For now, I’m filling in a good pipeline of project based work, with some webcasts. Although I’m no longer an analyst, I still feel that objectivity is the most important trait I bring to the table. Once my name loses value, this gig is over. To that end any content you see with my name on it was developed in isolation from the vendor community. Not that they’re evil, but I want to minimize any concerns of “selling out” as much as possible. I have some webcasts coming up, and although sponsored by vendors I develop the content on my own, and it’s their option to use it as is, or to walk away from the table. I may not get paid, but in the long run I think it’s the best approach to maintain my “brand”. I’m also lining up some longer-term consulting projects. One thing I’m looking forward to is helping out with some in-depth strategy development and the occasional product evaluation. A downside of being an analyst is you never get to work a project from start to finish, and I’ve missed that from my pre-analyst consulting days. I’m talking with some security research teams to combine my higher-level product/market analysis with their in-depth product testing, which could end up being pretty interesting. Finally, feel free to ping me on email or IM with your random security questions. I’m securosis on AIM, and rmogull on Skype. Have a great day, and thanks for all the early support. Share:

I had a little back and forth with rybolov in the comments on my military post, and he introduced me to something called the Business Reference Model right out of some government publications and NIST 800-60. Kicking ass, as only a Guerilla CISO can, he responded with two great blog posts showing how we can steal from this model and adapt it to the enterprise world. On the surface (haven’t had time to dig in yet) it looks like an interesting way to help align business priorities, data classification, and security priorities. While I’m not a fan of complex models, I’m a big fan of anything that can help bridge the language divide between the business and IT. Check out his posts here and here. Share:

For those of you who don’t know, this is a blog with an editor. Chris Pepper is a long-time friend, UNIX wizard, web host, and tech writer himself. You can track his work at Extra Pepperoni, his somewhat-recently revamped blog. Chris is also one of the most in-depth Mac guys I know, and has submitted 1300 bug reports to Apple, many for Mac OS X 10.5 (the next version of the Mac operating system). They aren’t all “bugs” in the traditional sense, but when you peel off that shrink wrap from your colorful operating system upgrade, the odds are really darn high that the software you install will be better thanks to Chris. To boost his ego a little, when I was at DefCon I met up with a support guy at Apple who knew Chris from his bug reports and blog. Share:

Mr. Rothman was concerned that Mr. Hoff may, perhaps, have a little too much spare time on his hands. I’ve seen Senior Hoff at work, and he definitely isn’t winning any Slacker of the Year awards. I personally have a theory that he’s really just the earthly expression of a multidimensional being beyond our comprehension. Chris definitely outdid himself on this post. A short excerpt, (Read to the cadence of ‘Twas the Night Before Christmas) Remember when firewalls were firewalls, my friend? it suggested our security problems would end. They promised the perimeter breach to abate, but alas became products we just loved to hate. The attackers got smarter, and the exploits malicious, the perimeter’s holes made the threatscape pernicious. Sadly the breaches were never quite stopped, whilst we measured our value in per packets dropped! (read the rest here) Share:

If you read the security blogs, you may have seen that I have a stalker- Rob Newby over at IT Security, The View From Here. Rob’s a data security weenie like myself. Rob just left Spain to return home to the UK for a new job with Ingrian (database encryption). Congrats Rob, and glad to see you happy and healthy in your home nation again… Share:

There’s been a lot of debate lately on quantitative vs. qualitative risk, frameworks, models, metrics, certifications, standards, and all sorts of other organizational junk we seem to burden ourselves with. Oh, I’m no better, having authored a risk management framework, data security hierarchy, and similar tools in my past. At times, I step back and realize we’re losing the big picture in this morass of acronyms and long documents with words like “Section 248, Subsection B, Paragraph A, Revision 42”. While I hate to knock my own industry off its pedestal, we sometimes forget that we are just the complex implementation of a very basic need. Thus it’s time to dumbify security and kick it old skool. Here’s my n-step guide for the perfect, basic, security program: Figure out what’s important, and why: We often get wrapped up in pet projects, personal biases, or other distractions. When you look at your business, what’s really important, and what can you live without? Yes, I’m over-simplifying, but that’s the point of this post. I’ve seen n-degree complex risk analyses that still fail to capture what’s important. You’ll use those models later, but at some point just take a step back and really look at what could hurt you in a big way. That’s the most important stuff, and it deserves more attention than everything else. Decide if anyone stands to gain by stealing it or breaking it: Just because it’s important to you doesn’t mean it’s important to anyone else. In this step, just ignore the noise of the constant background threats (what my friend Richard Stiennon calls background radiation) and focus on directed threats- where someone has something financial to gain. Know how it’s protected: What security is in place? Figure out where the holes are: There are always holes; where are they? How hard are they to find and use? Back in physical security days we’d walk around the facility before an event, figure out all the ways in… including obscure ones like climbing buildings (those Dead Heads are seriously dedicated), and how hard they’d be to take advantage of. Block the holes, until it’s too expensive to block the holes: At this point you know your priorities, you know the threats, and you know the weaknesses. Now it’s just a matter of layering security until risk is reduced to an acceptable level. That’s all we do. We figure out what’s important, what the risk is to it, and how to best reduce that risk. Every single one of you reading this knows that, but we still get so wrapped up in agendas, frameworks, internal politics, and compliance that we sometimes forget we’re just there to help the business take the greatest amount of risk it wants to take, in the safest way possible. I don’t care what complex risk/security framework you’re using… stick to the basics. Know what’s important, have a rough idea of how much it’s worth to you, and drop in enough layers until you think it’s protected well enough. All those complex models should be tools to help you achieve the basics, not the other way around. We protect stuff, pure and simple. Yes, you still need metrics and frameworks, but you can’t define security as just a bunch of metrics and checklists. I also highly recommend a good 12 step program… Share:

Just a day after I talked about how it takes sustained failures for consumers to leave a company and go to a competitor, we have an example where switching isn’t really an option. Over at Dark Reading we learn that Phizer has suffered it’s third employee privacy breach in a row. At least they’re doing the “right” thing by involving law enforcement and offering credit monitoring. I suspect, since these made the press, they’re also improving security. That said, you have to feel for the employees who don’t have much of a choice to go anywhere “more” secure. Actually, neither do you. The last time my info was breached was at the student healthcare center at the University of Colorado. My SSN was stolen out of old records. How about you? I suspect every one of you has personal data sitting around old healthcare providers, never mind financial institutions, retail stores, government databases, old utilities providers, and subscriptions to “those” services under fake names, still billed to your real credit card. You no longer have a relationship with these providers (or one you can’t sever), yet they still represent a real risk to your security. Market forces can’t fix this one. Share: