- [Instructor] Organizations handle many different types
of sensitive information on a regular basis.
This includes trade secrets, proprietary business plans,
health records, and the personal identifying information,
or PII of employees and customers.
Unwanted disclosures of sensitive information
could lead to very serious security incidents
that expose and organization to fines, sanctions
and reputational damage.
Data loss prevention or DLP solutions
provide technology that helps an organization
enforce its information handling policies
and procedures in order to prevent data loss and theft.
DLP solutions search systems for stores
of sensitive information that might be unsecured
and they also monitor network traffic
for potential attempts to remove sensitive information
from the organization.
DLP solutions can act quickly to block transmissions
before damage is done and alert administrators
to attempted security breaches.
DLP systems work in two different environments,
host-based DLP uses software agents installed
on a single system that search that system
for the presence of sensitive information.
These searches often turn up social security numbers,
credit card numbers, and other sensitive information
in the most unlikely places.
Detecting the presence of stored sensitive information
allows security professionals to take prompt action
to either remove it or secure it with encryption.
Taking the time to secure or remove information
now may pay handsome rewards down the road
if the device is later lost, stolen or compromised.
Other DLP systems focus on protecting network connections.
They monitor outbound network traffic
watching for any transmissions that contain
unencrypted sensitive information.
Network-based DLP solutions can then block
those transmissions preventing the unsecured loss
of sensitive information.
DLP systems may simply block traffic that violates
the organization's policy or in some cases,
they may automatically apply encryption
to the content.
This automatic encryption is commonly used
with DLP systems that focus on email.
DLP systems also have two mechanisms of action.
First they can perform pattern matching,
watching for the telltale signs of sensitive information.
For example, if they see a number that is formatted
like a credit card or social security number,
they can automatically trigger based upon that pattern.
Similarly, they may contain a database
of sensitive terms such as top secret
or business confidential and trigger when they see
those terms in a document being sent outside
of the organization.
The second way that DLP systems work is through the use
of watermarking.
In a watermarking approach, systems or administrators
apply electronic tags to sensitive documents
and then the DLP system can monitor systems
and networks for unencrypted content containing those tags.
Let's take a quick look at DLP in action.
Here we're looking at a host-base DLP tool
called Identity Finder running on a Windows system.
Identity Finder is a user-friendly tool
that scans drives for the presence
of sensitive information.
Let's go ahead and kick off a scan.
I'm going to press the start button here.
And then Identity Finder actually begins the scan
almost immediately.
It's going to take a little bit to finish.
What's happening right now is Identity Finder
is scanning every single file on this system's hard drive
searching for any sensitive information.
As you can see in this window, I have the scan
set to search for social security numbers,
credit card numbers, passwords, bank account numbers
and driver's license numbers.
It's going through and looking at files,
email messages, browser data and other information
on this system for any of those types
of sensitive information.
The scan's now finished and Identity Finder's
giving me a summary of the results.
You can see that it searched 981 different locations
and it's found 15 individual locations
that contain at least one match.
And there's a total of 548 fields matching
that look like some of the sensitive information
we were searching for.
Let's go ahead and click the advanced view here
and you can see Identity Finder now gives me a window
where I can scroll through the results.
It shows me for each location, here looks like
a Word document that it found, a little bit
of information about the file,
when it was modified and the size,
and then the actual matches that it contained.
And as you can see here, these look like
social security numbers.
Now the information in these files is all test information.
These are dummy social security numbers
that aren't actually real.
I'm just using them here for testing purposes.
You can see this file, this 2009 class.doc
contains 26 different matches, and they're all
listed out here.
These are the actual social security numbers
contained in the file that match the pattern.
If I click on one of these, you can see
Identity Finder gives me a preview of the file itself
and highlights where that match was found.
This is very useful for going through
and trying to determine whether a match
is a false positive or a legitimate result.
And looking at this file, I get a very good sense
that this is probably a legitimate result.
It's a big list of names.
Each one has an identification number.
It looks like some employment information next to it,
and I'm pretty confident that these are
probably social security numbers.
So I have two options at this point.
I might want to delete this file entirely
because I don't want it, or I might want
to encrypt it because I'm going to need it later.
If I right click on the file, Identity Finder
gives me some options here.
I can shred the file, which is Identity Finder's
terminology for securely deleting it
and making sure the contents are completely removed
from the drive, or I can secure it,
which will apply strong encryption to the file
to protect it in the event the device is later
lost, stolen or compromised.
I also have the option to go ahead and ignore the file
if I think this is a false-positive result.
I can either ignore the entire file
or I can ignore this particular match.
Once I've finished and chosen an option for that,
I can scroll through this list and see all
of the different results that it found.
And Identity Finder provides me with
all those details on the sensitive information
that it found in the file.
Data loss prevention tools such as Identity Finder
provide administrators with a way to locate
and secure sensitive information stored
on systems in their enterprise
or traveling across their networks.