Enterprise Paradigm for Controlling Data Leakage by Deepak Rout

1. Enterprise Information Security... a Different view Nullcon (Dwitiya) Goa 26 Feb 2011 Deepak Rout

3. IBA instead of RBA …turning ‘The Standard’ around

4. What’s in store for us!

7. Statutory and Regulatory Imperatives

8. Contracts and Agreements

9. Data Protection - a Security Manager’s KPI

10. Avoiding the Silver Bullet Syndrome

12. Suggested Data Leakage Prevention Framework

13. DLP - Do Not & Do Do Not As a remedial measure in the aftermath of a particularly nasty incident Business doing well &security gets to push through security investment Getting entangled with a silver bullet DLP solution Pure selling by DLP solution providers As a mail filtering mechanism Do Deploy a comprehensive set of DLP technologies and processes as a risk mitigation measure which emerges from a systematic Risk Assessment based on business and security objectives

15. IBA instead of RBA …turning ‘The Standard’ around

16. What’s in store for us!

18. 'Incident based approach' (IBA) is an alternate to RBA - PDCA cycle based on incident prevention

19. On occurrence follow steps - Triage, Investigate, CAPA, RCA, Implement

20. Digital Forensics play a anchoring role in all stages:

21. Triage - Preserve incident parameters

22. Investigation, CAPA & RCA - Diagnostics & Analysis

25. Suspect can claim that incriminating evidence was planted

26. Specialised tools to wipe off past data (e.g. DriveWiperVoom)

28. Includes all files (OS, deleted, encrypted, password protected & hidden)

29. Data hidden surreptitiously within other files is also retrieved

30. OS independent tools, do not require a dedicated drive

31. Rapid imaging

32. Original hard drive is then sealedACQUIRE

34. Unique fingerprint created for each hard drive (hashing)

35. Suspect hard drive is seized along with hash value, known to suspect

37. Then onwards, the drive can only be read but not written to

39. Password-cracking tools are used on password-protected files

40. Steganography (camouflaging files within another file) can be countered with tools conforming to judicial and evidential requirements (analysed for hidden messages) AUTHENTICATE ANALYSE

42. Minimum & potent internal capability (imaging, packet capture, logging etc)

43. Advanced capabilities on-demand (image analysis, link analysis, heuristics etc):

44. As appropriate for specific industry

45. Pre-configured per management/regulatory requirement

46. Pre-negotiated & with SLA

47. RoI & industry considerations for configuring model

48. Optimum model - limited internal & bulk outsourced capability

51. Q&A rout.deepak@gmail.com 0-95821-58042