In this lesson,
we will learn about data loss prevention, or DLP.
Data loss prevention is used to detect, prevent,
and respond to unauthorized access, transmission,
or use of sensitive data.
Data loss prevention concepts include data discovery,
managing data at rest and in transit,
and policy enforcement.
Data loss prevention systems
are tools used to detect and prevent sensitive data
from being stored on unauthorized systems
or transmitted over unauthorized networks.
By managing data,
DLP, or data loss prevention,
ensures that critical information remains
within an organization's control.
DLP systems play an important role
in protecting data at rest,
like data stored in files,
and data in transit as it moves between systems
or storage devices.
At the core of DLP is data discovery,
which involves recognizing
and labeling sensitive information
based on predefined rules,
then allowing the DLP system to enforce security policies.
A typical DLP solution consists of three main components.
A policy server, an endpoint agent, and a network agent.
The policy server configures rule sets
that classify data based on its confidentiality, privacy,
or sensitivity level.
This server also logs incidents of rule violations
and compiles reports.
This shows how sensitive data is being used or misused
throughout the network.
The endpoint agent enforces these rules
on individual client devices,
even when disconnected from the corporate network.
For instance, if an employee tries to copy sensitive data
to a USB drive while offline,
the endpoint agent can still detect and block that action,
safeguarding the data at rest
regardless of network connectivity.
Meanwhile, a network agent monitors data
in transit across the network
by scanning various protocols,
including web traffic, emails, and messaging platforms.
A network agent can identify
both structured and unstructured data formats
and enforce DLP policies based on predefined rules.
Structured data includes formats
like JavaScript Object Notation, or JSON,
or Comma-Separated Values, or CSV files.
While unstructured data encompasses documents
like Word files, emails, or presentations.
DLP can use additional automated data discovery tools
beyond the tools in the system itself.
These tools conduct data discovery across the network
and apply labels based on predefined rules.
The labels can categorize data according to its sensitivity,
confidentiality, or privacy requirements.
Following data discovery and labeling,
DLPs can be configured
to use either allowlists or denylists.
Allowlists block all data,
except what is explicitly allowed.
Denylists allow all data,
unless it is specifically denied.
In application, DLP systems often also feature
reporting tools to monitor for false positives,
helping administrators fine-tune
the system's accuracy over time.
When a DLP system detects a rule violation,
it can take one of four actions.
Alert, block, quarantine, or tombstone.
In alert mode,
the system logs the incident and notifies administrators,
but still allows the data to be transmitted or moved.
This is considered a detective control
rather than a preventive one.
Next, blocking actively stops the data transfer,
like preventing a user from copying a file
to an external device,
and blocking also includes alert mode actions.
A quarantine action goes a step further
by conducting both alert and blocking mode actions,
as well as removing user access to the data entirely.
Quarantining can be done by encrypting the data
or rendering it unreadable to the user.
Finally, a tombstone action takes alert, block,
and quarantine mode actions
and then replaces the original file
with a message indicating a policy violation.
That's the tombstone.
Tombstone files often include instructions
for regaining access to the data that caused the violation.
DLP systems can also integrate with other security controls
to enhance data protection.
For instance, they can block external media,
preventing users from copying data to devices
like USB drives or CDs,
reducing the risk of mass data exfiltration.
Print blocking can stop sensitive documents
from being physically removed from the workplace.
Remote Desktop Protocol, or RDP, Blocking
ensures that data cannot be transferred
between a remote session and a local machine,
protecting that data in transit during remote access.
Clipboard privacy controls prevent users
from copying and pasting sensitive information
into unauthorized applications or platforms.
Finally, Virtual Desktop Infrastructure, or VDI environments
can also be secured with DLP agents
just as traditional laptops and desktops are.
So remember, data loss prevention, or DLP, systems
are designed to detect, prevent, and respond
to unauthorized access
or use and transfer of sensitive data.
DLP manages both data at rest and data in transit,
ensuring that critical information
stays within an organization's control.
At the core of DLP is data discovery,
which involves identifying
and labeling sensitive information
based on predefined rules.
The system then enforces security policies
through a combination of policy servers, endpoint agents,
and network agents.
By doing so, DLP helps protect data
across different environments,
preventing breaches and unauthorized transfers.