2. # 2
Let me ask 3 questions:
1. How many of us are using (or thinking of implementing) DLP solutions?
2. How many of us think that these are good and needed solutions?
3. How many think that DLPs on their own can effectively and efficiently
prevent data leakage?
− effectively => adequate to deliver the expected result
− efficiently => perform with the least waste of time and effort
3. # 3
In confined and isolated IT environments
it is relatively simple to protect data against leakage
DLP, Firewalls, Routers, … are able to well protect organizations against
information leakage within well defined IT boundaries …
… even application boundaries can easily be audited and protected
against information leakage.
4. # 4
But this is no more the case: we see cracks in the wall.
The established solutions, alone, fail to protect information.
Organizations are becoming distributed and mobile:
• Endless locations
− Inside and outside the Enterprise
− Cloud services / SaaS
• Endless applications
− Standard market apps
− Specific business value apps
• Endless devices
− Enterprise desktops/laptops/devices
− Service providers
− Mobile & Tablets (BYOD)
… and so are the threats:
• Endless cyber attack vectors
− Insider threats, inadvertent data leakage Trojans, spyware, botnets, phishing, social engineering
5. # 5
Data produced & exchanged by organizations
to do and be business is growing exponentially – Big-Data
• Both structured and unstructured data is growing exponentially:
− in volume (Zettabytes)
− in velocity (speed & peaks)
− in variety (unlimited formats)
− in complexity (correlation & matching)
• Perimeter-centric Information Security
Tools on their own have limitations:
− difficult to scale
− difficult to keep up the pace with Big Data
− static solutions (media & locations-based)
− unreasonable monitoring burden (false positives)
6. # 6
In any organisation only a relatively small percentage
of created, managed & exchanged data is sensitive information
The security problem today is to find the needle of sensitive information,
to protect against leakage, within the haystacks of non-sensitive daily
business information in an effective and efficient way!
not effective
&
not efficient
7. # 7
What if we change the approach and proactively
create sensitive information “ differently ”
… we are enabling simple and error free identification of Sensitive
Information anywhere / anytime
By embedding within the data itself it’s sensitive nature …
8. # 8
By concentrating attention on the sensitive information itself, the context in
which it is created and accessed and leveraging its’ “natural” sensitiveness traits
and qualities we can effectively and efficiently protect information:
Focusing on sensitive information identification at creation,
enables to implement data-centric security
THIS IS:
effective,
efficient
& smart
9. # 9
The world is not just black & white !
There is not just Normal or Sensible Information but a number of
different and organisation specific types of Information
Good Information Classification is not a trivial task
10. # 10
Data-centric security is not just classification but also
about enforcing information usage policies
• IRM (Information Rights Management) platforms like AD-RMS, allow to
define, implement and track information usage policies.
• An information usage policy precisely defines, enforces and track:
− WHO can use the information
− WHAT can each person/group/role do with/to the information
− WHEN can the information de used
− WHERE can the information be used
• With IRM security can be embedded within the data protecting it
wherever it is – in motion, at rest or in use
11. # 11
Classification Solution needs
to be integrated into the entire IT landscape, &
into IRM Platforms & Perimeter-Based Solutions…
Identify
Classify
Protection
Format
Appli-
cation
User Device Services Location
As per your
directives
Sub-Classification Flexibel & Dynamical
Usage Tracking
eDiscovery
RMS: Encryption &
Permisson Mangt.
DLP: Feed the right
information
i.e. MS
AD RMS
IP/2Rules
automatic/semi/manual
i.e.
Symantec
12. # 12
With IP/2 IMTF is offering an enterprise solution to protect
all sensitive data and documents of any organization
Any data and document in electronic format
• Files, enterprise systems
• Emails, cloud data, web content
Protection through the entire information lifecycle
• From creation through collaboration and storage
• Beyond application and IT environment boundaries
Policy-based IRM protection and security
• Simple policy generation, application and enforcement
• Application of enterprise-level encryption and key management tools
13. # 13
Information protection is achieved by first classifying sensitive
information and then applying the appropriate protection policy
14. # 14
IP/2 first key feature is an effective and performant
classification engine to correctly classify information
• An integrated rule based engine allows for flexible and comprehensive
“classification policy authoring” referring to:
− Content and metadata
− Time criteria
− User identity and actions
− Locations
− Dynamic and static values
− Events or other attributes
• Instant, zero false-positive, automatic, identification and classification
− New, modified, or accessed sensitive data
− From any origin
− To any destination
− Via any channel
15. # 15
Once sensitive information assets are identified and classified,
IRM protection can be effectively implemented to avoid
unauthorized usage and leakage
• Effective enforcement of data protection mechanisms
− Data encryption (based on «your» encryption engine and PKI)
− Strict access rights management (permissions)
− Strict usage rights management (actions)
− Enable existing and trusted IT systems and applications to
work seamlessly with secured and encrypted data
16. # 16
The technology is based on an “agent to server architecture”
that triggers the IP/2 event driven classification and protection
Multi Source Data Acquisition System
ClassificationPolicy
ProtectionPolicy
Optimized Classification and
Protection Mechanism
Optimized classification cycle is triggered upon
intercepted events like: create, open, save,
close, download, upload, copy, etc.
17. # 17
Simple IT protection Use Case:
Secure enterprise solutions interfaces that, need to share
potentially reserved and sensitive information
All sensitive data is identified and protected (encrypted) at all time and anywhere
NO RISK OF LEAKAGE !!!
18. # 18
Data Centric information security has 2 parts:
• A technical solution enabling embedded data classification and IRM
enforcement to effectively and efficiently prevent sensitive data leakage
• A business process and methodology to correctly identify and classify
sensitive information within the specific and unique enterprise context
19. # 19
Sensitive Information identification and classification can help
organizations adherence to many international standard for
information security (e.g. ISO 27001) …
20. # 20
… and can help comply with many specific industry regulations
over Information Protection & Control (e.g. PCI-DSS)
21. # 21
What is to be considered sensitive information mainly depends
on the enterprise activity domain and operational exposure
• The financial world is focused in protecting CID information:
− Direct Identifying Data (name, signature, address, email, phone, … )
− Indirect Identifying Data (customer num., account num., card num., passport num., …)
− Potentially indirect Identifying Data (birth info, memberships, wedding date, profession, …)
• In the health insurance industry PHI customer data are key assets
• In chemical industry formulas and production processes are key
information assets to identify, classify and protect
• In HighTech companies R&D and technology innovations are key
assets
22. # 22
All sensitive information assets of a company can be considered
as one (or many) of 4 main sensitive data types:
• PCI-DSS (Payment Card Industry – Data Security Standard)
• PHI (Personal Health Information)
• PII (Personally Identifiable Information)
• IP (Intellectual Property)
• BI (Business Information)
23. # 23
Data Leakage Prevention
Source?
- Employees
- Business units
- Applications
- Locations
- etc.
Processes/
Use Cases?
Final destination?
- eMail
- Repositories
- etc.
How do we help our clients classify their digital assets and
identify the organization Crown Jewels
IRM / RMS
end-point
DLP etc.
Classification
encryption
IAM
context
Parameter
context
B
labeling
What to be protected?
- Information types
- Assets
- etc.
Why to be protected?
- Regulations
- Intelectual
Properties
- Defence
- Reputation
- etc.
Protective
Mechanism?
Generic
context
A
Processes
1
Classification
2
24. # 24
We truly believe that Data-Centric-Security is the way to go:
the information (metadata) itself can trigger suitable protection mechanisms!
Secure Creation
& Access Points
Open Creation
& Access Points
Open Creation
& Access Points
Secure Creation
& Access Points
Open Creation
& Access Points
Secure Creation
& Access Points
perimeter
100% accurate LifeCycle Classification
flexible & dynamic
considering context
automatic to manual = protecting vs teaching
To derive suitable protection mechanism
technical
processes
RMS / IRM
25. # 25
A take away for you: Are you thinking to Go Cloud?
Once sensitive data is identified and protected it can go anywhere…
… even in the CLOUD !
26. # 26
Thank You !
Gianmarco Ferri
Business Development
Direct +41 26 460 66 41
Mobile +41 79 776 47 26
Mail gianmarco.ferri@imtf.ch
Skype ferrig
www.imtf.com
