Data Loss Prevention (DLP) (OBJ 4.4)

Data Loss Prevention Overview

Data Loss Prevention is a strategy employed to monitor and protect data across various stages:
- In use: When data is actively processed or accessed.
- In transit: When data is being transmitted over a network.
- At rest: When data is stored and not being actively accessed.

Past Data Storage Methods:
- Traditionally, data was stored physically, e.g., printed documents kept in filing cabinets.
- Security threatened by physical theft: breaking into offices and physically stealing files limited theft to what an individual could carry.
Evolution of Data Theft:
- Laptops: Introduction of personal computing raised new vulnerabilities, e.g., remote work increased risk of theft through left-behind laptops in cars.
- External Hard Drives: Provided convenience for storing large data amounts, but were cumbersome and easy to detect.
- Thumb Drives: Offered portability, allowing individuals to carry vast quantities of data discreetly without detection.
Current Data Theft Methods:
- Cloud storage services like Dropbox and Google Drive allow large amounts of data (terabytes) to be easily uploaded and accessed globally, increasing the risk of inadvertent data loss or theft.

Data and intellectual property are crucial assets for businesses, essentially functioning as their currency in the current economy.

Endpoint DLP Systems:
- Usually software installed on workstations or laptops that monitors data usage.
- Functions:
  - Prevents unauthorized file transfers by stopping or alerting admins based on pre-defined rules and policies.
  - Operates similarly to Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS) but focuses specifically on data protection.
- Modes of operation:
  - Detection Mode: Identifies potential data loss incidents.
  - Prevention Mode: Actively blocks data from being transferred without authorization.
Network DLP Systems:
- Installed at the perimeter of a network, either as software or hardware.
- Function: Monitors all data entering and leaving the network, specifically aiming to detect unauthorized data transmissions.
Storage DLP Systems:
- Software installed on servers in data centers focused on inspecting data at rest.
- Security features:
  - May work with encrypted or watermarked data to ensure regulatory compliance and protection against unauthorized access.
  - Can identify suspicious activities, such as large downloads during off-hours (e.g., 2 AM).
Cloud-Based DLP Systems:
- Offered as a software as a service solution integrated into cloud storage services.
- Example: Google Drive includes native DLP functionality to safeguard data stored within its cloud.

DLP solutions aim to be accurate in preventing unauthorized data leakage from networks by scrutinizing:
- Data at rest
- Data in use
- Data in transit
Security administrators can leverage these tools to enforce policies that protect the company’s assets.