Security Confidential S8 E0 Data Loss Prevention

Host: Welcome back to the Dark Rhino Security podcast. Today the team sits down in the studio to talk about data loss prevention and what that means for an organization that’s looking to take it on.

Sitting down today, it’s myself, Jake Fur.

Jack Thomas: This is Jack Thomas. I’m the senior technical engineer over here at Dark Rhino.

Nick Damato: Nick Damato, director of cloud security.

Zach Lawrence: Zach Lawrence, sales and business development manager.

Dark Rhiino Team: All right, let’s talk about DLP. The kinds of DLP: at rest. Let’s talk about storage or I guess that is at rest—data at rest.

Dark Rhiino Team: Yep.

Dark Rhiino Team: Network DLP. Let’s talk about—

Dark Rhiino Team: All right. So, a data loss protection—a proper data loss protection program.

Dark Rhiino Team: Is it protection or prevention?

Dark Rhiino Team: You can go both ways, right?

Dark Rhiino Team: It’s technically data loss prevention. And then you’ll also get the mix-up of people saying data leakage or data leak prevention.

Dark Rhiino Team: Data copy prevention.

Dark Rhiino Team: Yeah, data copy—

Dark Rhiino Team: DCP.

Dark Rhiino Team: DCP.

Dark Rhiino Team: Yeah. It really should have been data copy alerts.

Dark Rhiino Team: Yeah. You know, we never actually got to blocking. That is one thing you can include—that everybody wants to input a DLP program, but very rarely do people actually get to the blocking phase of it because you spend so much time trying to tailor your policies to get rid of false positives that you very rarely get to the point where you’re actually blocking things because there’s so many things coming in.

Dark Rhiino Team: Well, and one of the struggles that I think really every organization has to address is by its nature, DLP as a programmatic thing in your organization—not as a technology—is intended to restrict the movement of information, which is categorically going to impact your business, period.

So we have to talk about this as a risk-reward situation, right? Don’t do it, have a certain amount of risk; do it, have a different amount of risk. Hopefully, the risk that you incur by implementing DLP is going to be sufficiently large that any minor business disruption that comes about as a part of that is worth it, right? That you’re getting some kind of benefit for it.

But it is absolutely—I mean, organizations spend months and years tuning. And I’m doing the air quotes here, right? So they’re tuning, or they’re enhancing, or they’re modifying their DLP program so that it’s going to get only information of value.

But really, if it is only getting information of value, you’re missing a lot of other information that is of value that is just not going to fit that pattern because there’s just too much information in organizations generally that is sensitive.

So you either have to cast a wide net and catch everything, but you’re going to get a lot of false positives, or cast a very narrow net and only address one specific area of the business, and you’re going to miss a lot of other content.

Social Security numbers are nine digits. Is that a nine-digit number? Sure, I can say it has to be separated by hyphens, but then somebody sticks periods in instead of hyphens or puts spaces in and it’s no longer going to catch that. And as soon as you say, “Well, you can use periods or spaces or hyphens,” then there’s some other way they can put spaces in between each character, and you start to—users, if they know what they’re doing, can get around DLP pretty commonly.

It’s not intended to stop the intentional leak. Hopefully it’ll catch it, but it doesn’t do a very good job of stopping it.

Dark Rhiino Team: Yeah, that’s actually—so if you don’t mind me interrupting—that’s my favorite part about DLP is one thing that a lot of people don’t realize: a data loss prevention program is not really a surefire way to stop data loss.

A lot of management, a lot of people have the wrong impression of really what it’s supposed to do, which sure, yes, the goal is to stop data loss. Largely, a data loss prevention program is acting as a deterrent for your staff and people to let them know that you’re watching specific types of activity.

Dark Rhiino Team: Yeah.

Dark Rhiino Team: And just that knowledge of, “Hey, they’re watching if I’m sending confidential stuff out via email,” or, you know, drawings or things that are really pertinent to IP for that company. Once people know that you’re watching, you’re going to see a huge decrease in the amount of things that you’re doing.

Here’s the deal: bad actors are going to find a way to steal stuff. I mean, yeah, you’re always going to find a way if you are a person who’s trying to truly steal data out of a company to do it.

What a data loss prevention program really is for is metrics for management, because it’s a great system to show you how many things are coming in and getting flagged where your biggest issues are. But furthermore, it’s really just an educational thing for your users to say, “Hey, you’re doing a lot of stuff this way. This isn’t super safe for our company, and just let you know, we’re watching when you do this.”

So that’ll curb like the 98% of the people who are actually using it innocently.

Dark Rhiino Team: Right. So I was going to ask—obviously, you’re preventing data loss. Does the data loss come majoritarily from—

Dark Rhiino Team: Majoritarily? That’s not a word.

Dark Rhiino Team: I’m pretty sure majoritarily—

Dark Rhiino Team: Definitely not a word.

Dark Rhiino Team: Definitely not a word. I like it. Keep it in.

Dark Rhiino Team: Definitely not a word. You could say “majority of the time.”

Dark Rhiino Team: Majoritarily? Does that happen by employees leaking information, whether it’s intentionally or not, or does it happen by people, you know, phishing attacks or data breaches, that kind of thing?

Dark Rhiino Team: So, more often than not, these are simple mistakes that your everyday user has made.

Dark Rhiino Team: Okay.

Dark Rhiino Team: Their husband left their credit card at home and he wants to buy a pizza for his team. So, you shoot over via email your credit card credentials.

Dark Rhiino Team: Uh-huh.

Dark Rhiino Team: That’s an example of a quick thing that a data loss prevention program is going to see: a credit card number or something like that and flag it in the system.

Dark Rhiino Team: Okay.

Dark Rhiino Team: It’s little stuff like that where people have done certain things. It’s usually a cultural shift.

So, another thing about a DLP program is it requires a big cultural shift. With a customer that I worked with in the past, they had a really huge issue with this “bring your own device” type culture, where they didn’t provide company flash drives or external drives or things like that, and everybody just sort of brought their own devices to the company and were able to plug in a USB device and throw whatever they want on it and take that wherever they go.

So, if you leave that behind at a coffee shop or whatever, you’re potentially leaving behind pertinent confidential information.

So, really, the second thing I really want to address with a DLP program is that you need to provide a solution if you’re going to take stuff away from the customers. And I think this is another big fail for companies that are trying to implement a data loss prevention program.

If you’re going to say as a company, “We’re going to move forward with a cloud-type program like a Box, OneDrive,” whatever—G Suite, all of these cloud services that are out there—if you are as a company saying that this is the route that we want to go—we only want to use Box now or only want to use OneDrive—then you need to find a solution for those people that are using USB to actually get off of that, and you need to provide the right amount of education.

So start using the program, right? So education is a really big gap right there that a lot of other companies also lose focus on: you need to give them the tools so that they can stop doing what culturally they’ve done for the past 10 years before all of the cloud stuff existed and move on to the right thing.

Dark Rhiino Team: So when you talk about opening doors for users, do you find the most success in user education, technology solutions, policies, and procedures? How does that kind of stack up?

Dark Rhiino Team: So, it all depends on how you kind of start out. Every DLP program that you implement is going to have an out-of-the-box policy that you can just apply to, say, catch PII. So, you know, catch people’s Social Security numbers, date of birth, those types of things. There’s out-of-the-box solutions that you can put together.

What you really want to do is, right off the bat, you also want to have some custom things. So, if I know that we have some sort of file extension name that we send back and forth that’s always confidential, you want to start to custom tailor those policies to include that within your DLP scope so that way each time it comes through, you’re automatically flagged as sending confidential information.

Looking at false positives, the most important thing to do is to find legitimate positives and then understand from the business why that’s a legitimate thing that happened and was it necessary for business to function.

So you work for a manufacturing company and you have determined that your 3D image files, your AutoCAD files, are sensitive or intellectual property in some capacity. So you have to send those out to somebody to manufacture or to your different departments. And if those can’t move through email, you come up with this situation where you say, “You can’t send this document. You can’t put it on a flash drive. You can’t put it on this,” but the business demands that it gets sent to a different party than the person who created it. It doesn’t just live on that one computer forever.

And so, you might find that your policies are just too restrictive to enable business to be effective. So it comes back to that whole thing we’ve talked about in previous podcasts: create policies that are practical, right? Like that’s the number one thing. If you create a policy, it’s a kind of happy medium between still functional but not totally restricting on business activities.

Dark Rhiino Team: And that’s why that education piece is so important. Without a program to tell people—hey, you know, you can slap them on the wrist and say, “Don’t do that,” but you need to provide them a way to say, “If we’re going to tell you you can no longer—you can’t do it this way.” Here’s how you need to put just as much time in the educational piece to it.

Dark Rhiino Team: So, what have you seen expedites user adoption the best? Because it seems like ignorance over malice is more prevalent, right?

Dark Rhiino Team: I would say a good educational program. Honestly, any DLP rollout should start with a full-on educational program on what DLP is, what we’re after, why this company actually cares about their intellectual property or whatever they’re trying to protect. So, you need to educate your user base on why that’s important and what’s at stake.

And then again, if the main goal of the DLP program—usually they’re not being put in with no goal in mind. The companies are deciding to implement a data loss prevention program because they’ve experienced some sort of data loss in some sector or they know that they’re kind of vulnerable.

So you really need to find out what’s important to them. For example, if they know that there’s a lot of people out there that are using USBs within their organization that are completely unaccounted for, that might be something that they want to focus on.

So if their replacement strategy is going to be something like a Box or a OneDrive or a Dropbox, then you need to provide the proper education for those users to start using that tool instead of the thing that they were doing.

So, you really can’t start to get out of the false positive realm until you’ve actually truly educated your users to hop off of the thing that they were doing that they never even knew was technically wrong.

Dark Rhiino Team: Yeah. So, you know, and another thing I think that a lot of organizations make the mistake of is—in my experience, culture shifts and organizations start from the ground up. They start from the low level and they move upwards, but they die very quickly when your most senior levels of leadership—your C-suite, your VPs, your EVPs, your board of directors—don’t support that culture shift.

So, it’s kind of a two-headed snake there. So, you’ve got to address this by getting buy-in from your most senior levels of leadership, and then you have to start that grassroots culture change of how we’re going to handle sensitive data from the first level.

Dark Rhiino Team: Yeah, we’re going to handle sensitive information in a certain way. It’s always felt as draconian. I know everybody here has had a job somewhere, has worked somewhere in their career where they have been told that this is the new policy and this is the way we’re going to do things, and it just seems unreasonable.

Dark Rhiino Team: It’s that immediate eye roll.

Dark Rhiino Team: Jack said it earlier: “why” is always more important than “what.” If you explain to people why you’re doing something, the what becomes pretty irrelevant.

Dark Rhiino Team: Correct.

Dark Rhiino Team: I mean, absolutely. And that’s what I’m saying. You get the leadership to agree that—when you get everyone on board with why we’re doing this, they’re not going to say, “No, no, we don’t agree.”

But then you bring it up from the bottom and you encourage the lowest level of the organization to be participatory and engaged, which requires a lot of finesse. That’s another huge major failure of data loss prevention programs anywhere—and this is security 101. I mean, you have to put a customer service person in as your DLP program manager because DLP is not a hands-off security tool.

You are contacting customers all day—emailing, Skype, whatever—reaching out to users all day to talk about their usage. And we’re all in security, so we know that many of us don’t want to talk to customers. And, I mean, if you have an engineer in there—they’re not people-oriented.

So when a DLP program fails a lot, it is also because you don’t put the proper person in place that can go out and speak to everyday users without laying down a whole bunch of layman’s terms and all of that stuff. So you really need to have that customer service aspect in it.

That’s actually why I personally really like it—my background bridges tech with customer service. So, in security, this is one of the most hands-on, customer service-centric programs because each day you’re reaching out to so many different people.

And often, again, it’s very rarely am I reaching out to them to tell them what they’re doing is malicious and yelling at them. It’s really just educational, which is a super cool thing in security: to know I’m not doing this to yell at you and tell you that this is pointless; I’m trying to educate you.

“Hey, I saw that you’re doing this; just to let you know, we could do it this way, this way, this way. If you have any more questions…” and you get to form these relationships with those users. And that also, if you’re implementing this program pretty early, gives your security team a really good impression to the rest of your users—that you guys aren’t just coming from on high and dropping rules on them.

Dark Rhiino Team: Yeah.

Dark Rhiino Team: So, I mean, you catch more flies with honey than you do with vinegar.

Dark Rhiino Team: Flies or bees?

Dark Rhiino Team: Flies. Yeah. Cool.

Dark Rhiino Team: One of them.

Dark Rhiino Team: Sure. Both, I think.

Dark Rhiino Team: So, outside of just a robust education program, what sort of incentive programs have organizations implemented to get user adoption as opposed to just being purely punitive?

Dark Rhiino Team: Well, it’s really hard to incentivize good behavior because, to a DLP program, doing everything right looks like you’re doing nothing at all. Right?

So if I never send an email, I won’t breach the DLP policy. And also, if I send a million emails and don’t breach a DLP policy, then I’ve done equally well as far as a DLP program is concerned.

So it is difficult to incentivize good behavior when it comes to DLP. There are ways where you can reward teams that have the lowest threshold of incidents, or where you can reward employees for going through training and becoming—and again, air quotes here—a “super user” or a tech chair, or some variable kind of title where they have been given some sort of responsibility to buy into this and encourage them to be an evangelist for security as well as DLP in their teams and their departments and their office, wherever they may be.

That’s one that organizations tend to overlook. You know, you see these phishing campaigns: you fail a phishing campaign once, you fail a phishing campaign twice, and you’re fired or your vacation day is docked.

One of the things that I was sitting at a talk at a conference maybe a year ago, and someone was saying that their organization took an entirely different approach: every time that you reported a phishing attempt through the phishing campaigns—you forward that to their phishing email, reportphishing@whateverxyz.com—that entered you into a raffle for a chance to win different prizes.

Every quarter they changed: $100 gas gift card, $100 restaurant gift card. I think the person who won the year-long one got $1,000. I mean, that’s an incentive to look intently at what your emails are showing you, question every one of them, and send an email and say, “Hey, I think this might be fishy.” No pun intended.

Dark Rhiino Team: You intended it. Don’t lie.

Dark Rhiino Team: I absolutely didn’t, but I love that it happened.

Dark Rhiino Team: I’ve received two phishing attempts by text in the last 24 hours. One that said “PayPal assist at something something dot com” and then another one, “Apple login.” It’s both asking me to log in real quick—”something’s wrong with your account,” yada yada.

But I’m just more used to seeing them from email. I don’t think I’ve received many text phishing attacks in the past.

Dark Rhiino Team: Yeah. No, I mean, that’s one of the reasons why I really like password managers—turning off of DLP for a moment—or single sign-on, right?

Because if you’re using a password manager and you go to what you think is the Apple website to sign in because you’ve been phished, it’s not going to populate because the password manager is looking at the URL. And so it doesn’t populate. That should be a “Wait a second, something’s not right here. Check again.” Right?

And single sign-on is awesome because I go to this site, I don’t even know my password or my username for it because I’m going through single sign-on, and it didn’t redirect me to our company’s single sign-on page. And if it does look like the single sign-on, that’s somebody who’s targeting your organization.

That’s obviously a concern because you could expose credentials to a lot of systems at once. So it doesn’t relieve the need for a user to be engaged in what they’re doing, but it does help, right?

Because if you clicked on that and you have an iPhone, your Safari has your password for your Apple ID stored. Pull it up; it doesn’t auto-populate. You might think, “Well, what’s going on here?”

Dark Rhiino Team: Yeah.

Dark Rhiino Team: It’s that “stop and be critical of everything,” too.

Dark Rhiino Team: Question everything.

Dark Rhiino Team: Trust no one, question everything.

Dark Rhiino Team: That’s security.

Dark Rhiino Team: Classic security.

Dark Rhiino Team: Yeah. Trust but verify, I think, is a better approach.

And that comes back to the DLP thing, right? You’ve got to trust your users are doing what they’re doing because they believe it’s the right course of action or because they believe it’s necessary.

When you see that things are happening that aren’t supposed to be happening, or that you believe are against written policy, that gives you an opportunity to follow back up with those users and say, “Why is this happening?” instead of, “You’re doing this and it’s wrong.”

My favorite is—the worst feedback in the world is, “You’re bad and should feel bad.” Right? That kind of feedback is not actionable. They can’t get better.

So start with understanding where they’re coming from. Seek to understand before you seek to be understood. And then you can really bridge that gap between security and your users—or, as Jack calls them, customers—because they are in security. They’re our customer, right? You are providing a service to the business.

Dark Rhiino Team: Yeah, absolutely.

Dark Rhiino Team: So how much of a DLP program is targeted towards internal company users as opposed to your outside malicious actors? Because, like, does the DLP program incorporate your firewalls, your endpoint protection, and all that jazz, or is it much more internal policy, internal education, internal tools?

Dark Rhiino Team: It’s going to be all internal.

Dark Rhiino Team: Okay.

Dark Rhiino Team: Yeah. So, I mean, everything you do in security is to prevent the loss or leakage of sensitive information, right? So, I guess in some capacity, everything is DLP. But factually, DLP, when you talk to a security person, is a specific item. So if everything’s DLP, nothing’s DLP. There we go. Right.

Dark Rhiino Team: I mean, the external piece of that, too, is let’s use Box for example, or something like that. DLP is catching when one of our internal users maybe sends an email out to a competitor with some valuable IP that has now leaked to another customer.

What we could replace that with instead is to have them use a program like Box or a Dropbox instead of using regular email.

“Hey, let me drop you a secure link that’s only a one-time link that can’t be forwarded, that I can control your rights over, and that has an audit trail behind it.”

So that way, that’s a completely secure link for sharing that IP. Again, it’s just an educational conversation: “Hey, I saw that you sent this over email to Jim at Gmail. Probably not super safe. In the future, let’s walk through how you can do this in OneDrive, Box,” whatever.

So it’s that customer service aspect, and that’s why getting the education at the beginning of the program is so important—because you can tell the users, “Hey, we went over this a couple of months ago. In case you’ve forgotten, here are the steps on how to do this,” instead of just saying, “Use OneDrive” or “Use Box.”

You talk about why it’s important not to plug your mobile phone into your computer just to charge it. If you want to do that, get one of those—you know, they’re the devices that you plug your charging cable into, and it prevents sync because it only passes the power cable components through.

Those are huge. Pass those out, hand them out to your employees and say, “Hey, this will protect your phone from us. It’ll protect us from your phone.” It’s a two-way street there, right?

Dark Rhiino Team: So, realistically, when you talk to folks in the IT community and to your client base, how long does it take to go from, “Hey, I need a DLP program,” to an actual mature, smooth-sailing DLP program?

Dark Rhiino Team: Years, depending on the size of the organization. I mean, obviously smaller companies are going to be easier. The types of devices they’re using are also important. All of those types of things are to consider.

If they already have a good culture in place—if they’ve already switched over from using USBs and now they’re using a cloud solution like OneDrive or something like that—those are opportunities where you don’t have to necessarily involve that education piece as much.

But for those companies that maybe have existed for a while doing everything quote “wrong,” that’s going to take a lot longer because you really have to spend a much longer time on that educational piece.

And that educational piece is twofold. Again, like I said, you can point back to that educational piece later down the road to help educate your users, but it also covers your butt later, too, because you can say—when you have some of those users that might say, “Well, what do you mean USB is blocked? We’ve—this is the way we’ve always—”

Dark Rhiino Team: Exactly.

Dark Rhiino Team: You can say, “Well, actually, over the past couple of months, we’ve done this educational program that had to go out to everybody. You had to complete it because we gave you a quiz,” or something like that, because you can enforce these types of things on users as well.

So it just kind of—it’s a kind of twofold thing where you can get that education out and you can point back to it, but it also covers your butt for later when those customers—like some of those customers that refuse the change—are like, “Well, no, we’ve always done it this way.”

And it’s like, “Yeah, but we’ve been telling you for six months that it’s no longer going to be that way.”

Dark Rhiino Team: So, and “and” is better than “or,” typically. So it’s onboarding and, you know, semi-annually or annually just as friendly reminders or additional education, updates on policies.

Dark Rhiino Team: Yeah, certainly. Just the practical situation of it is that you’re going to have to target one of those first because you’re often only going to have one resource or maybe two resources.

But back to how long it takes: it’s a—you know, in my experience, it’s an 18-month program to get it stood up and collecting valid information, and then you’re looking at somewhere between six and another 12 months to start moving and phasing in blocking activities.

Dark Rhiino Team: Yeah, absolutely. I mean, it definitely, like I said, requires a lot of finesse. It requires a lot of customer support. It by no means is one of those security implementations where you turn it on and you can walk away. It’s an everyday thing. You need the right amount of staff to do it.

I mean, if you’re a company that’s a decent size. Any way that you start out a DLP program is you throw out a big net at first just to see everything that’s coming in. So you essentially open up the out-of-the-box and you turn everything on, and all of a sudden, you have a million alerts. Now, 99.99% of those are not going to be malicious. You’re just throwing out a wide net to help narrow down what those false positives are.

So it certainly can get shorter, but I would agree with Nick: it’s usually around a year to a year and a half before you’re really set up to start catching the realistic things. And then even then, I mean, things are changing so fast that you really have to adjust.

Dark Rhiino Team: So how problematic and impactful is it when the IT community itself is so consultant-laden, and given the fact that security unemployment is negative and is projected to be that way for the near future?

So the fact that folks working in a DLP program standing that up can pretty much dictate where they want to work and how much they want to get paid—or they’re on a contract and there’s less of that perceived loyalty with the actual client.

Dark Rhiino Team: I mean, I think that that’s one of those things that can derail any security or IT project freely if you have your primary assets, your primary resources, prone to leaving.

And security is one where they’re being engaged—I mean, you’re having recruiters reach out to people constantly saying, “Hey, I’ve got a better gig. I’ve got more money. I’ve got this other opportunity for you.”

And in regards to hitting back earlier, too, with the incentive thing: as Nick said, it’s really hard to incentivize the users behind DLP, but leadership loves a program like DLP. And one of the main reasons is it’s really tough to pull accurate measurements out of a lot of security tools that an executive-level person can truly get a hold of. They can read.

I’ve always gone under the impression if you’re presenting to executive leadership, you have to act like you’re presenting to a 5-year-old. Well, DLP is a great way.

Dark Rhiino Team: Is it because it has to be simple or because they have a 10-second attention span?

Dark Rhiino Team: Yes, maybe both.

Dark Rhiino Team: A little bit of both.

Dark Rhiino Team: Maybe so.

Dark Rhiino Team: So yeah, I mean, you really have to—it can pull reports that are super easy to read. It can give you a good scope of where problems are within your company. And again, it’s acting as a deterrent so that you can try to fix those problems via other means.

But I know in regards to places that I’ve implemented DLP at before, one of their main purposes was to get a better idea of what they were working with so that they can get metrics. And it’s one of the best programs out there to get metrics.

Dark Rhiino Team: So, I mean, we’ve obviously had a couple of podcasts at Dark Rhino talking about artificial intelligence, machine learning, that type of thing. So, in a DLP program, how available is AI and machine learning to get insights in order to help mature even maturely existing programs?

Dark Rhiino Team: I mean, as it stands today, that’s still pretty infantile.

Dark Rhiino Team: I just—please God, don’t let us get the NGDLP. I don’t want to see “Next-Gen DLP.” I mean, that’s security. You got your NGAV, you got your NGFW. I mean, just don’t with the “next-gen” everything, right?

But in all seriousness, that is the logical conclusion of where we are. But because DLP is a 95% people issue and a 5% technology issue, I think that it’s going to be something we see probably on the near horizon. And it’s not going to make a massive impact in the implementation of DLP. It’ll make a massive impact in the efficacy of it.

Sure, it’ll be super efficient, super effective, but it’s still going to be coaching your users. Unless you go in and say, “Every time you violate, I’m going to fire you,” you’re not going to get rid of the violations. And as soon as you start doing that, you’re going to get rid of your team. So you won’t really have a company to work with anyway.

Dark Rhiino Team: Yeah. Like I said, DLP is one of those programs that you need an analyst on. I mean, a lot of these AI programs and things like that are going to put folks like myself and Nick probably out of jobs at some point, because you can automate those first couple levels of tasks with a lot of these tools that exist.

But DLP is one of those programs that you probably aren’t going to be able to do that with. Sure, you can have it send out an automated email that says, “Hey, you sent out an email that contained confidential information,” but any smart user is just going to delete that right away anyways.

Dark Rhiino Team: So that was kind of what I was thinking: how could you implement like a JS with a Demisto to launch a response for—

Dark Rhiino Team: You can have automated—yeah, you can have automated email responses. You could probably have automated text responses, maybe an automated phone call response.

But I don’t foresee it going down that road because, like I said, this is a very customer-centric security program, which makes it very different than a lot of the other ones that are out there.

I don’t foresee this type of program moving away from having a true Tier 1 or Tier 2 analyst involved, so that they can get out there and educate the users, because it’s a pretty constant flow.

Dark Rhiino Team: Yeah. And I think that—I mean, even you look at Symantec, you look at Digital Guardian, you look at Bitglass, you look at any number of different on-prem DLPs, endpoint DLPs, cloud DLP tools—no matter what it may be, you’re going to see that they often have the “we can send an email on an alert to an admin or to the user,” or tell them that we blocked their email.

It doesn’t stop the behavior; it just tells them to start hiding it, right? Because if it’s not a human being saying, “Hey, I noticed this happened. Talk to me about what’s going on here.”

It is an unfortunate situation: it’s just, “If I do it this way, I don’t get the email, so the system’s not tracking me.” And so—I know if I put it on a flash drive, they’re going to catch me, but I also know that if I print it, I can take it home and I can work on it and no one will know.

That’s the stuff you want to avoid. There is no compassion, there’s no seeking to understand. There’s just seeking to be understood by that email that comes out of the system and says, “Do it this way” or “You can’t do that.”

So I think automation is going to be really about cleaning up false positives. I think it’s going to be really about understanding user behavior. Right?

So you’ve got those new UEBAs that are going to be looking at—and “new” in the past couple of years is not that’s not a particularly recent thing, but they are looking at what’s abnormal behavior for a user. So that’s going to be starting to tie into your DLPs.

I think even Symantec is starting to do that with some of their add-on components to DLP, where they’re looking at user behavior, where you’re starting to understand what is a baseline. This user sends credit card information every single day, all day long via email to outside parties. There’s a good chance that’s part of their job. You know, I mean, maybe it’s a really crappy way to do things, but there’s a very good chance that it is part of their job.

I’ve never sent an email with a credit card number in my life to anybody ever—won’t do it. And if I do that today, or I start doing it a whole bunch today, the system should go, “Something’s fishy about that. Let’s really investigate that.” And that’s, I think, where you’re going to start seeing artificial intelligence jumping into the DLP space.

Dark Rhiino Team: Some of those engines are ancient, too, right? Regular expressions…

Dark Rhiino Team: So we touched on or talked about a little bit earlier the relationship between DLP and CASB. How does—is it a Venn diagram? Some of it fits within both. Is DLP within CASB? Is CASB within DLP?

Dark Rhiino Team: Yeah. So—

Dark Rhiino Team: Or is it more one of those “all thumbs are fingers, but not all fingers are thumbs”?

Dark Rhiino Team: It’s a little bit of all of that.

So, I tell people there are four primary areas of DLP. People will get nitpicky and call email a different kind of DLP. I don’t care.

There are endpoint DLP, there’s network DLP, there’s storage or data-at-rest DLP, and there’s cloud DLP. Right? I mean, everything else is traversing your network, or it is going to a cloud service for your email, or it’s on your endpoint and it’s leaving from your endpoint. You look at your egress points there. Those are the primary DLP areas as far as I’m concerned.

You know, I’d love to have that “prove me wrong” meme. In my opinion, prove me wrong.

Dark Rhiino Team: “Change my mind.”

Dark Rhiino Team: Yeah, “change my mind.” That’s it. Thank you.

But if you look at those four areas of DLP, you have your endpoint, you have your network, and you have your storage or data-at-rest DLP options or components.

When you talk about cloud, there are DLP solutions that are specifically targeted at protecting your cloud. And a lot of times, organizations—and anymore you’re starting to see organizations looking at the fact that you can do just DLP or you can do more.

And the “more” is some DLP components, many of which organizations are caring about today, and malware inspection, and identity and access management, and multi-factor authentication, and step-up authentication, and device restriction, and all of those other components that you start seeing out of a CASB.

So CASBs have components of DLP. They are not entirely full-blown DLP solutions. They don’t protect a lot of the areas which DLP is concerned with. And then they also provide a lot more than just DLP when you talk about your cloud components.

So data inspection gives you the ability to look for malware; it gives you the ability to look for DLP. So why not do both of those things? But it is not a solely DLP solution. So it’s kind of hard to answer.

CASB—cloud access security broker, right? Security includes DLP. That’s really the best way I can say it. It’s a part of a CASB. Not the whole thing, and it is not necessarily all of the DLP components you would want.

Dark Rhiino Team: It’s a very small piece within it. It’s essentially segmenting out, especially if you’re a cloud-heavy organization.

A normal DLP program is going to—maybe as deep as it’s going to go with the cloud is say people are uploading or downloading documents to this website or just from this agent.

Dark Rhiino Team: Exactly.

Dark Rhiino Team: You know, so if they’re using Dropbox, we don’t want them to use Dropbox. It doesn’t go any deeper than that. So, a CASB is kind of filling that gap: there are specific things within these cloud services that we maybe don’t want our users to do because it has a potential for data loss.

Dark Rhiino Team: Yeah.

Dark Rhiino Team: You can turn those types of things on with a CASB. So a company that’s very cloud-heavy—it’s certainly a good idea to have.

Dark Rhiino Team: Shout-out Bitglass. I’m a huge fan of Bitglass. Full disclosure, Bitglass is a partner of Dark Rhino. But candidly, I’m a fan of their product because their technology works in a way that offers organizations a lot of capability for a relatively minor amount of disruption to their users.

Right? So, you can have control over your cloud without turning their worlds on their end. And that’s what every security organization—whether you’re a technology vendor, a managed service provider, or a security arm of some company—that’s your goal, right?

It is to gain a significant degree of control, capability, and visibility into your sensitive information and protect your data without totally turning your company on its head.

I know this is not entirely true, but I can secure a lot of computers by sinking them in concrete and dropping them in the ocean. It’s going to stop them from being used. Your people aren’t going to be able to write their reports, but not many people are going to hack that.

And the people who do are probably going to get in anyway. There’s not a whole lot you can do to stop someone who can get the data off a computer sunken in concrete in the bottom of the ocean.

Dark Rhiino Team: That would be impressive.

Dark Rhiino Team: It’s a motivated individual.

Dark Rhiino Team: I mean, that’s my point. Given enough time and enough resources, anybody’s computer can be compromised.

Dark Rhiino Team: 100%.

Dark Rhiino Team: Anybody who’s motivated to steal something—a DLP program is not going to do almost anything for those people that truly want to steal something.

There’s a great example of a three-letter agency a few years back where you have all these physical controls in terms of metal detectors, all that good stuff getting into the building. You have all these IT controls: no flash drives, no downloads, etc.

So a guy just brought in one of those disposable cameras, took literal screenshots, and then went home. Got the photos processed, good to go.

Dark Rhiino Team: Yeah. Bingo.

Dark Rhiino Team: I mean, Edward Snowden stole stuff from the federal government. Was it the NSA at the time?

Dark Rhiino Team: Yeah.

Dark Rhiino Team: So, Edward Snowden got stuff out of them. Stuxnet got into the Natanz nuclear enrichment facility. I mean, there are countless examples of a dedicated or intent individual compromising a secure system or what is believed to be a secure system.

Dark Rhiino Team: Exactly. DLP is for the 99% of the people that have no idea that what they’re doing is potentially harmful.

Dark Rhiino Team: Yeah.

Dark Rhiino Team: And you’re just educating those users so that they can be safe, so that those bad actors that are outside of the company don’t have an easier way to prevent those easier attacks.

Dark Rhiino Team: It’s locks open.

Dark Rhiino Team: Uh-huh. 100%. It’s not about—and it’s not entirely about preventing theft. If somebody is hell-bent on stealing your IP, they’re probably going to steal it. Even if they just sat there at their computer all day and memorized it, and then left your company and went somewhere and shared it.

I mean, the human brain is remarkable. We will find ways—we find the path of least resistance to do what we want to do. And that’s why, again, the whole “you did something bad and you should feel bad” is terrible feedback, because you’re just encouraging them to hide what they’re doing, not to do better, not to fix it.

Dark Rhiino Team: Yeah, I agree. Well, thank you as always for joining us. Make sure to hit that subscribe button and visit us at darkrhinosecurity.com.