Instructor: In this lesson,
we will learn about vulnerabilities and data security.
Vulnerabilities
and data security involve identifying system weaknesses
and ensuring sensitive data
is protected from unauthorized access or loss.
Vulnerability and data security concepts
include vulnerability scans and data loss prevention,
or DLP, tools.
Vulnerability scans are automated applications used
to scan for
and detect security flaws, misconfigurations,
or unpatched software on the enterprise network.
DLP is a security strategy that monitors, detects,
and prevents unauthorized transmission
or exposure of sensitive data.
Let's learn more about vulnerability scans
and data loss prevention tools.
First, we have vulnerability scans.
Vulnerability scans are used
to identify potential security flaws in a network or system.
Vulnerability scans search
for weaknesses throughout a network,
such as unpatched software, incorrect configurations,
or other issues that could be exploited
by an attacker.
In an enterprise environment,
vulnerability scans should be used regularly
to ensure systems remain secure
and compliant with industry standards,
where the primary goal is to catch vulnerabilities
before they are exploited,
allowing IT teams to patch or reconfigure IT systems.
For example,
a company may run automated weekly vulnerability scans
on their network to detect any new weaknesses,
and ensure the weaknesses are addressed
before they become serious threats.
As implied, vulnerability scans should be scheduled
and automatic in an enterprise setting
to maintain consistent security.
Running scans regularly,
often weekly, or even daily depending upon the system,
ensures that new vulnerabilities are identified
as soon as they arise.
Enterprises should also schedule vulnerability scans
after significant changes to the system,
such as software upgrades
or configuration changes,
to ensure these updates haven't introduced
any new weaknesses.
Automating this process reduces the risk of human error,
and ensures that scans are conducted on time
without the need for manual initiation.
Finally, regularly reviewing
and analyzing scan reports allows the security team
to prioritize patches
and fixes based on the severity of detected vulnerabilities.
Several tools are widely used for vulnerability scans,
including OpenVAS, Nessus, and Qualys.
OpenVAS,
the Open Vulnerability Assessment Scanner,
is an open-source tool
that is commonly used in enterprise environments
to perform network scans and identify vulnerabilities.
Nessus, on the other hand,
is a popular commercial tool known
for its extensive vulnerability database,
ease of use,
and powerful plugin system.
Nessus plugins allow users to customize scans
based on the specific needs of the organization,
such as checking for particular vulnerabilities,
or ensuring compliance with regulatory standards.
For example,
an enterprise may use a Nessus plugin to check
for vulnerabilities related
to Payment Card Industry Data Security Standard,
or PCIDSS, compliance.
Finally, Qualys offers a cloud-based solution
that continuously scans an enterprise's infrastructure
and integrates with asset management systems
to monitor potential vulnerabilities in real time.
Second, we have data loss prevention, or DLP, tools.
Data loss prevention tools are used
to prevent sensitive data from being accidentally
or intentionally shared with unauthorized parties.
DLP tools monitor data in transit, at rest,
and in use across various enterprise systems,
detecting when sensitive data is at risk.
In an enterprise,
DLP solutions are integrated into workflows
to protect sensitive data,
such as customer records,
intellectual property,
and financial information.
These systems monitor data
as it moves through various channels,
such as email, cloud storage,
and internal applications,
to ensure that it isn't accidentally
or intentionally shared
with unauthorized parties.
To do this,
DLP solutions are designed to automatically detect,
classify, and protect sensitive information
as part of the day-to-day processes within the business,
ensuring compliance with regulatory requirements
and internal security policies.
Then, DLP tools enforce policies
that define how sensitive data should be handled
within the organization.
These policies may include actions,
such as alerting security teams, blocking transmission,
quarantining the data for review,
or using a technique known as tombstoning,
which replaces sensitive content
with information about the policy violation
and how to remediate.
For example, a DLP system may block the sending
of an email containing credit card numbers
while simultaneously alerting the security team
to investigate the incident.
During this process, the system scans the content
of outgoing emails in real-time,
identifying any sensitive data, like credit card numbers,
based on predefined patterns or keywords.
Once detected, the DLP system
enforces the organization's security policies.
So if the policy is set to block,
the email is immediately stopped
before it leaves the organization,
preventing the accidental
or malicious transmission of sensitive data
to an unauthorized recipient.
Or if the DLP policy is set to quarantine,
the email is not delivered,
but instead held in a secure queue for further review
by the security team or compliance officer.
This allows the team to inspect the email's content,
evaluate the context,
and decide whether to release it, modify it,
or permanently block it.
In cases where the DLP policy uses tombstoning,
sensitive information, like credit card numbers,
could be automatically replaced
with a placeholder, such as redacted,
ensuring the document
or email can still be shared internally
without exposing sensitive data.
This method ensures
that business workflows continue smoothly
while maintaining compliance and protecting critical data
from unauthorized exposure.
Several data loss prevention tools are available
to enterprises,
including Symantec DLP and Microsoft Purview.
Symantec DLP has robust capabilities
to monitor data across multiple channels,
such as endpoints, email, and cloud environments.
It provides granular control over sensitive information
by applying predefined policies that detect
and prevent data loss.
Microsoft Purview, on the other hand,
integrates DLP functionality directly
into Microsoft applications,
such as SharePoint, Teams, and Outlook.
This integration makes it easy
for enterprises using Microsoft's suite of tools
to protect sensitive data as it moves within
and outside the organization.
Both tools enable enterprises
to enforce data protection policies effectively
across various platforms.
So remember, vulnerability scans
and data loss prevention, or DLP, tools
are key components of an enterprise's security strategy.
Vulnerability scans help identify weaknesses in systems,
such as outdated software
or misconfigurations that attackers could exploit.
These scans should be scheduled regularly,
and automated to ensure consistent security monitoring
and timely remediation.
Next, DLP tools focus on protecting sensitive data
by monitoring its movement across different channels
within an organization.
DLP tools enforce policies
that prevent unauthorized sharing of data
to ensure compliance
with regulatory requirements,
using actions such as alerts, blocking, quarantining,
and tombstoning data when necessary.
Together, vulnerability scans and DLP tools
help businesses proactively secure their IT systems
and protect valuable information.