With the ever-increasing frequency and sophistication of security threats to organisations, business leaders need to have a comprehensive data security strategy to protect themselves. Information security practitioners have to think and plan beyond existing protection capabilities that are aimed at preventing threats only. In this Information Security presentation, you can find out what actions can be taken to identify your most critical information assets, and how a modern day cyber security model needs to focus on prevention and detection of a data breach, and how to respond to a breach in order to reduce damage to brand and reputation. You can also find the full briefing paper on 'Data Leakage Prevention' at https://www.securityforum.org/research/data-leakage-prevention-briefing-paper/

1. Copyright 2018 © Information Security Forum Limited
ISF Presentation 1
A Data Breach Prevention, Detection &
Response Strategy to Combat Today's Threats
Nick Frost,
Principal Consultant
Information Security Forum (ISF)

2. Copyright 2018 © Information Security Forum Limited
ISF Presentation 2
An international association of over 400 leading global organisations
(Fortune 500/Forbes 2000), which...
• addresses key issues in information risk management through research and collaboration
• develops practical tools and guidance
• remains a fully independent, not-for-profit organisation driven by its Members
• promotes networking within its Membership.
T H E L E A D I N G G L O B A L A U T H O R I T Y O N C Y B E R S E C U R I T Y
A N D I N F O R M AT I O N R I S K M A N A G E M E N T
About the ISF

3. Copyright 2018 © Information Security Forum Limited
ISF Presentation 3
ISF Security Model

4. Copyright 2018 © Information Security Forum Limited
ISF Presentation 4
Agenda
Setting the scene1
Identifying critical information assets to protect2
Developing a pragmatic DLP strategy for todays threat landscape3
Questions?5
Implementing a DLP strategy4

5. Copyright 2018 © Information Security Forum Limited
ISF Presentation 5
1. Setting the scene

6. Copyright 2018 © Information Security Forum Limited
ISF Presentation 6
What is Data Leakage Prevention (DLP)?
Definition: DLP can be defined as the practice of detecting and preventing the
unauthorised disclosure of data.
Data Loss Prevention Data Loss ProtectionData Leakage Prevention
Purpose: the main purpose of DLP is to ensure that specific sensitive data is not
leaked.

7. Copyright 2018 © Information Security Forum Limited
ISF Presentation 7
Data Breaches
This year we have over 53,000 incidents and 2,216 confirmed data breaches

8. Copyright 2018 © Information Security Forum Limited
ISF Presentation 8
Data Breaches today
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

9. Copyright 2018 © Information Security Forum Limited
ISF Presentation 9
Data Breaches – What did 2008 look like?
https://www.forbes.com/2008/11/21/data-breaches-cybertheft-identity08-tech-cx_ag_1121breaches_slide/
12.5 million customers
4.2 million customers
1.2 million customers

10. Copyright 2018 © Information Security Forum Limited
ISF Presentation 10

11. Copyright 2018 © Information Security Forum Limited
ISF Presentation 11
Operations
- Information relating to delivery of the organisation’s products and services
- Logistical arrangements/operational information
- Manufacturing specifications
- Production costs
- Pre-programmed commands
IT infrastructure
- Infrastructure information (including information regarding the hardware, software,
network and facilities)
- Cryptographic information/private encryption keys//licensing and activation keys
- Network topology
- Password files
Financial
- Unannounced financial results
- Information relating to the financial management of the organisation
- Cost structure and price calculations
- Profit margin strategy
- Contractual agreements
Sales and marketing
- Product pipeline/market strategy
- Brand / logos (protected legally)
- Business intelligence/market analysis
- Market research and analysis
- Information relating to promoting and selling an organisation’s products and services
- Competitor analysis
- Sales pipeline
- Customer information / leads
- Non-competition agreements
Personal
- Information or details relating directly to an individual, such as
employees, customers or citizens
- Personally identifiable information (PII)
- Financial/customer information
- Sensitive personal information
- Customer lists/master files/price lists
- Medical records
- Tax records
- User credentials
External party
- Information belonging to individuals or external parties, such as
suppliers, business partners or customers.
- Distribution plans
- Software source code
- Non-competition agreements
Regulated
- Information subject to or covered by legal or regulatory
requirements
- Customer profile database (containing PII)
- Cryptographic algorithms (subject to export control)
- Blueprints or designs for new aircraft
Business and governance
- Information relating to current and future trading
- Board papers and resolutions
- Mergers, acquisitions & divestment details
- Business strategy/plans
- Business negotiations/bidding details
- Contractual details
- Cost structure, margin strategy, price calculations
Research and development
- Early phase research for new products/results of studies or
investigations
- Ideas and concepts relating to possible and planned future
products and services, which are generated, modelled and
developed
- Trade secrets
- Patent applications/registered designs
- Pre-patent/legally protected information
- Prototype details
- Unregistered engineering designs/product blueprints and
schematics
- Algorithms/source code/formulas/techniques
- Planned exploration locations
- Development plans/technology roadmaps
Intellectual property
- Original information solely generated and owned by the
organisation
- Proprietary algorithms
- Trade secrets
- Unregistered/pre-patent information
Examples of information / data types

12. Copyright 2018 © Information Security Forum Limited
ISF Presentation 12
Types of data ISF Members protect using DLP
Based on 147 participants

13. Copyright 2018 © Information Security Forum Limited
ISF Presentation 13
Information as an asset
“Our employees
are our most
valuable asset”
CEO

14. Copyright 2018 © Information Security Forum Limited
ISF Presentation 14
Benefits of a DLP programme
Supporting
compliance
Visibility of the
usage of sensitive
data
Improving security
awareness and
behaviour
Detecting
exfiltration of data
by external threats
DLP 77% of surveyed ISF
Members implement DLP to
reduce the frequency and
magnitude of accidental data
leakage; almost the same
implemented DLP to mitigate
malicious data leakage (76%)

15. Copyright 2018 © Information Security Forum Limited
ISF Presentation 15
2. Identifying critical information assets to
protect

16. Copyright 2018 © Information Security Forum Limited
ISF Presentation 16
The format of information

17. Copyright 2018 © Information Security Forum Limited
ISF Presentation 17
The life cycle of information

18. Copyright 2018 © Information Security Forum Limited
ISF Presentation 18
The footprint of an information asset

19. Copyright 2018 © Information Security Forum Limited
ISF Presentation 19

20. Copyright 2018 © Information Security Forum Limited
ISF Presentation 20
Identify mission critical assets
- Merger and acquisition details
- Early phase research
- Trade secrets
- Manufacturing specifications
- Logistics information
- Cryptographic information
- Registered designs / patents
- Market analysis
- Non-competition agreements
- Pre-programmed commands
- Unregistered / pre-patent data
- Infrastructure information
- Financial results
- Prototype information

21. Copyright 2018 © Information Security Forum Limited
ISF Presentation 21
3. Developing a pragmatic DLP strategy for
todays threat landscape

22. Copyright 2018 © Information Security Forum Limited
ISF Presentation 22
Core activities that make up a DLP strategy

23. Copyright 2018 © Information Security Forum Limited
ISF Presentation 23
Identify mission critical assets
Fingerprinting (indexing)
Described content matching
Optical character recognition (Image recognition)
Machine learning (Statistical analysis)

24. Copyright 2018 © Information Security Forum Limited
ISF Presentation 24
Monitor data leakage channels

25. Copyright 2018 © Information Security Forum Limited
ISF Presentation 25
Coverage of data leakage channels
Based on 147 participants

26. Copyright 2018 © Information Security Forum Limited
ISF Presentation 26
Actions taken in response
Act to prevent data from leaking

27. Copyright 2018 © Information Security Forum Limited
ISF Presentation 27
Actions taken in response
“Start with monitoring and detecting before implementing
any protective controls”

28. Copyright 2018 © Information Security Forum Limited
ISF Presentation 28
DLP tools and policies
• Technical DLP policies provide a set of
rules governing the handling of data
• The rules in the policy determine the
action to initiate when the conditions
are met
• Different rules depend on the level of
risk (transfer of 20 or 20000 records)

29. Copyright 2018 © Information Security Forum Limited
ISF Presentation 29
DLP tools and policies

30. Copyright 2018 © Information Security Forum Limited
ISF Presentation 30
Main types of action
Notifying BlockingLogging violations
Hard block
Soft block

31. Copyright 2018 © Information Security Forum Limited
ISF Presentation 31
Actions taken in response to policy violations
Based on 147 participants

32. Copyright 2018 © Information Security Forum Limited
ISF Presentation 32
4. Implementing a DLP strategy

33. Copyright 2018 © Information Security Forum Limited
ISF Presentation 33
Actions taken in response to policy violations
Governance Preparation Implementation

34. Copyright 2018 © Information Security Forum Limited
ISF Presentation 34
Actions taken in response to policy violations
– Obtain executive support
– Define DLP programme
objectives
– Assign roles and
responsibilities
Governance Preparation Implementation
– Involve business stakeholders
– Prioritise what data to protect
– Select DLP tools
– Integrate DLP tools into
existing environment
– Improve security awareness
of data leakage
– Determine how to respond
to policy violations
– Deploy DLP incrementally

35. Copyright 2018 © Information Security Forum Limited
ISF Presentation 35
Summary

36. Copyright 2018 © Information Security Forum Limited
ISF Presentation 36
Key messages from this presentation
• Increasing adoption of collaboration platforms, cloud services and social
media has introduced a host of new ways for sensitive data to leak
• Media headlines are making organisations aware of the importance of
taking a systematic, structured approach to detect and prevent the
leakage of sensitive data
• DLP tools alone cannot prevent the leakage of all types of sensitive data
across every possible channel
• A prerequisite of a successful DLP programme is support from executive
management and ongoing collaboration with business representatives
Get the ‘Data Leakage Prevention’ briefing paper at www.securityforum.org/research/data-
leakage-prevention-briefing-paper/

37. Copyright 2018 © Information Security Forum Limited
ISF Presentation 37
Nick Frost
Principal Consultant, ISF
nick.frost@securityforum.org
UK: +44 (0)7584 756212
Web: www.securityforum.org
ISF Twitter: @securityforum
ISF LinkedIn: linkedin.com/groups/760947
ISF Webcasts available on demand:
https://www.brighttalk.com/channel/9923/isf-managing-cyber-
security-for-cisos
ISF Podcasts available on:
www.securityforum.org/podcasts-videos/
or download on iTunes: www.itunes.apple.com/gb/podcast/isf-
podcasts/id1180646163?mt=2