"Protect the Data" -- What Data?

This is another follow-on from my "Protect the Data" Idiot! post. If you think about the "protect the data" mindset, it's clearly a response to the sorts of data loss events that involve "records" -- credit card records, Personally Identifiable Information (PII), and the like. In fact, there's an entire "product line" built around this problem: data loss prevention. I wrote about DLP earlier this year in response to the rebranding effort taken by vendors to make whatever they sold part of the DLP "solution."

What's interesting to me about "protect the data" in this scenario is this: "what data?" Is your purpose in life to keep PII or other records in a database? That's clearly a big problem, but it doesn't encompass the whole security problem. What about the following?

  • Credentials used to access systems. For example, intruders often compromise service accounts that have wide-ranging access to enterprise systems. Those credentials can be retrieved from many locations. How do you protect those?

  • Systems that don't house PII or other records, but do serve critical functions. Your PBX, HVAC control system, routers, other network middleboxes, etc., are all important. Try accessing "data" without those devices working.

  • Data provided by others. The enterprise isn't just a data sink. Users make decisions and work by relying on data provided by others. Who or what protects that data?


Those are three examples. If you spend time thinking about the problem you can probably identify many other forms of data that are outside the "DLP" umbrella, and outside the "protect the data" umbrella.

Comments

Kevin Rowney said…
Here:
"the protect the data mindset, it's clearly a response to the sorts of data loss events that involve 'records' "

...you invoke one of the more common misconceptions concerning the limits of Data Loss Prevention tech. The innovation that got this space off the ground: new search algorithms for detection of both unstructured IP and database records.


Highly accurate search and protection is now possible on engineering design documents, source code, M&A transaction terms, exec memos, etc....

Furthermore, you go on to ask:

"What about the following?
* Credentials used to access systems. [..]
* Systems that don't house PII or other records, but do serve critical functions. [..]
* Data provided by others. [..]"

Point by point:
>> Login credentials can in fact be indexed and searches unleashed to detect exposure. The new (well new as of 2001) algorithms I mentioned above are highly effective at running accurate search on exactly this kind of case.

>>Systems that don't house PII that have no data of any sort are obviously not a ICRM risk management target, but frankly, availability issues are rarely a reason to pursue such protections. Confidentiality is usually primary.

>> Data flow provided by third parties is often a big reason enterprises are engaging in DLP deployments. Primary reason here is the identification of broken business processes.


We may have done a poor job at getting the word out far and wide on this matter, but DLP is now widely in use protecting a broad range of classes of data far outside of just PII/records/CC#s etc..



Kevin
5:57 PM
Anonymous said…
Inaugural NetWitness user conference November 4&5, Ronald Reagan Building, Washington DC

NetWitness is holding its inaugural user conference next month and we'd like you to attend as a VIP!
This action-packed two-day event will include a FULL DAY of advanced NetWitness NextGen training, followed by a rich day of customer presentations and panels, problem-solving use cases, and lots of new information about upcoming NetWitness innovations.
• Meet key NetWitness development and engineering staff and executives.
• Exchange ideas and use cases with fellow NetWitness government and commercial customers, partners, and end users.
• Dramatically improve your skills and learn new and valuable uses for NextGen.
• Discover advanced topics such as FlexParser, Rule Creation, and Live Feed development...and much more.
Cost for NetWitness Customers and Freeware Users: FREE!
(you just need to get to Washington DC).
Please feel free to pass this invitation to any of your staff members who may be interested in the event. Advance registration is essential as space is limited.

The conference information page contains additional details regarding the conference, area hotels, and the preliminary agenda. If you need additional information, please contact: userconference@netwitness.com or your NetWitness Regional Sales Manager.
http://www.netwitness.com/userconference.html

Agenda Located at:

http://www.netwitness.com/userconference_agenda.html

NetWitness Corporation, the leading provider of next generation network monitoring and threat analysis solutions, announced several milestones today demonstrating major momentum in the U.S. Government market
2:31 PM
Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more