Technology Overview - Symantec Data Loss Prevention (DLP)

SYMANTEC: SOLUTION OVERVIEW SERIES
Symantec Data Loss Prevention
Iftikhar Ali Iqbal
https://www.linkedin.com/in/iftikhariqbal/
Valid till May 2016

Agenda
Company Overview1
Solution Portfolio2
Features, Architecture, Design and Licensing4
SYMANTEC: Data Loss Prevention
Look and Feel5
Symantec Data Loss Prevention3

OVERVIEW: SYMANTEC

OVERVIEW: SYMANTEC
• Founded in 1982
• Headquartered in California, United States
• Fortune 500 company
• Provides Software and Services
• Focus is on Consumer Security and Enterprise Security
• 2014 Revenue:
– $6.7 billion (ended March 28, 2014)
– Information Security: $4.2 billion
• 2014 Market Share:
– Largest security software vendor by revenue and market share (17.2%)
(Gartner) - http://www.gartner.com/newsroom/id/3062017

OVERVIEW: THE SPLIT
• On 1st October 2015, Symantec’s Information Management
business now operates as a separate privately held company
Veritas Technologies Corporation
• Solutions:
– Backup and Recovery
– Archiving
– High-Availability
– Disaster Recovery
• Separate operations, partner programs, support, etc.

OVERVIEW: AREAS OF FOCUS
• Solutions to Protect against:
– Malware and Spam
– Advanced Persistent Threats and Cyber Attacks
– Identity Theft and Loss of Confidential Information
• Solutions to Manage:
– Governance, Risk and Compliance
– Client, Asset, Server and Mobility
• Services:
– Product Support
– Cyber Security
– Education

SYMANTEC: PORTFOLIO

PORTFOLIO: NUTSHELL
Cyber Security Services
• Monitoring , Incident Response, Simulation, Adversary Threat Intelligence
Threat Protection
ENDPOINTS DATA CENTER GATEWAY
• Threat Prevention, Detection, Forensics & Resolution
• Device, Email, Server, Virtual & Cloud Workloads
• Available On-premise and Cloud
Unified Security Analytics Platform
• Big data security analytics; available to customers in self-service mode
Telemetry
Incident
Management
Protection
Engines
Global
Intelligence
Threat
Analytics
Information Protection
DATA ACCESS
• Identity and Data Loss Protection
• Cloud-based Key Management
• Cloud Security Broker
Users
Data
Apps
Cloud
Devices
Network
Data Center

SYMANTEC: DATA LOSS PREVENTION
Introduction, Components and Features

DATA LOSS PREVENTION: INTRODUCTION
Locate where your sensitive information
resides across your cloud, mobile, network,
endpoint and storage systems
Discover
Understand how your sensitive information
is being used, including what data is being
handled and by whom
Monitor
Stop sensitive information from being
leaked or stolen by enforcing data loss
policies and educating employees
Protect
Where does your
confidential data live?
How is it being used?
How do you prevent
data loss?

DATA LOSS PREVENTION: COMPONENTS
DLP Enforce Platform
DLP for Endpoint
DLP for Network
DLP for Storage
DLP for Mobile
DLP for Cloud

DLP Enforce Platform
- Management Platform
- Build and Deploy Policies
- Automate Enforcement
- Measure Risk Reduction
- Demonstrate Compliance
- Workflow Remediation

DLP for Endpoint
- DLP Endpoint Discover
- DLP Agent
- Detects Sensitive Data
- Collect Data on Activity
- Send Incidents to Endpoint Server
- DLP Endpoint Prevent
- DLP Agent (Same as above)
- Prevents Sensitive Data Leaving
- Detects Data Transfers:
• Application Monitoring
• Local Drives
• CD/DVD
• Clipboard
• Email/SMTP
• eSATA
• FTP
• HTTP/HTTPS
• IM
• Network Shares
• Print/Fax
• USB

DLP for Network
- DLP Network Monitor
- Capture & Analyze Traffic
- SPAN/TAP
- Define Protocols
- SMTP, FTP, HTTP, Various IM
- Custom Protocols
- DLP Network Prevent for Email
- Outbound Email Traffic
- SMTP-Compliant MTA
- Monitor, Analyze, Block, Redirect
or Modify
- DLP Network Prevent for Web
- ICAP-Compliant Proxy Servers
- HTTP, HTTPS or FTP Content
- Proxy Rejects Requests or remove
HTML content

DLP for Storage
- DLP Network Discover
- Scans Data Repositories
- Cloud Storage (Box Enterprise)
- Networked File Shares
- Databases
- Document Repositories
- Integrate with Veritas Data Insight
- DLP Network Protect
- Removes Exposed Data
- Quarantine and Restore
- Visual Tags/Marker File
- Enforce Access Control

DLP for Mobile
- DLP Mobile Email Monitor
- Microsoft ActiveSync
- Emails Sent
- Information Downloaded
- Databases
- Document Repositories
- DLP Mobile Prevent
- Monitor and Prevent Web &
Application Communications
- VPN Profile (ex, MDM)
- HTTP, HTTPS or FTP Traffic

DLP for Cloud
- DLP Cloud Service for Email
- Symantec Cloud
- Monitor & Block
- Microsoft Office 365
- Gmail for Business
- Symantec Email Security.Cloud
- Email Delivery
- Antispam & Anti-malware
- DLP Prevent for Microsoft Office 365
- Azure/Rackspace/AWS
- Monitor & Block
- Symantec Email Security.Cloud
- Email Delivery
DLP Management Server (Enforce) is on-premise
- DLP Cloud Storage (Box Enterprise)
- Scan Box cloud storage
- Scan files, folders + shared links
- Quarantine and/or visual tags

DATA LOSS PREVENTION: UNIFED CONTENT-AWARE SOLUTION
Unified
Management
Box
Office 365
iOS
Email
Web
FTP
IM
USB
Hard Drives
Removable Storage
Network Shares
Print/Fax
Cloud & Web Apps
File Servers
Exchange, Lotus
SharePoint
Databases
Web Servers

DATA LOSS PREVENTION: WITH SYMANTEC ENCRYPTION
DLP scans internal file shares
and can automatically
encrypt sensitive,
unprotected files.
Additionally, DLP can read
and detect sensitive
information previously
encrypted using Symantec
File Share Encryption
FILE SHARE ENCRYPTION
Email is scanned by DLP
before it leaves the
organization. If sensitive
content is found, email is
redirected to Symantec
Gateway Email Encryption
before being sent.
GATEWAY EMAIL
ENCRYPTION
DLP monitors what files and
folders are being sent to
removable devices and can
automatically encrypt
sensitive information before
being transferred.
REMOVABLE MEDIA

Detection, Policy, Incident Response and Risk Reduction

DATA LOSS PREVENTION: CONTENT DETECTION TECHNOLOGIES
DESCRIBED DATA
Non-indexable data
Lexicons
Data Identifiers
Described Content
Matching
STRUCTURED DATA CUSTOMER DATA
Credit card, Government IDs, Pricing
Partial row matching
Near perfect accuracy
Exact Data
Matching
UNSTRUCTURED DATA IP
Designs, Source Code, Financials
Derivative match
Near perfect accuracy
Indexed Document
Matching
UNSTRUCTURED DATA IP
Designs, Source Code, Financials
Derivative match
Very High Accuracy
Vector Machine
Learning

DATA LOSS PREVENTION: CONTENT DETECTION TECHNOLOGIES (ADD-ON)
• Symantec DLP Form Recognition
– Protect data stored in images of handwritten and typed forms such as tax
returns, insurance claims, patient forms or any form that might contain PII
– Works with Network Monitor, Network Prevent for Email, Network
Prevent for Web, Network Discover and Network Protect

DATA LOSS PREVENTION: POLICIES
Content
Credit Cards
SSNs
Intellectual
Property
Context
Who?
What?
Where?
Action
Notify
Justify
Encrypt
Prevent
Notification
User
Manager
Security
Escalate
ResponseDetection

DATA LOSS PREVENTION: INCIDENT RESPONSE
Right Automation | Resolution, Enforcement, Notification
Right Person | Route Incidents to Right Responder
Right Order | High Severity of Incidents First
Right Information | 5-Second Test
Right Action | 1-Click Response
Right Metrics | Prove Results to Execs and Auditors

Sanjay V. Well Meaning Insider
Assistant Controller | Manufacturing Company
SITUATION: Copying sensitive data to removable storage devices
ActionProblem
Sanjay copies pre-
released financial data
to removable media
DLP Response
Endpoint agent
analyzes content
based on policies
Monitor, record or
notify
Automatically encrypt
files using SEE
Result
Automatically encrypt
content
Higher visibility into
where data is going
Change users’
behavior
Competitive Advantage
Lightweight agent Trusted devices
Group based policies Automatic encryption
DATA LOSS PREVENTION: USE CASE
Detection and
Response

Action
DATA LOSS PREVENTION: USE CASE
Detection and
Response
Problem
Betty attempts to
email confidential
employee data
without knowing it
DLP Response
Network: DLP inspects
content and context
for policy match as
email leaves server
Endpoint: DLP
inspects the mail
when user hits “send”
Network: Monitor,
notify user, encrypt or
block
Endpoint: Display pop-
up, justify, block
email, remove content
Result
Help users understand
and justify risk
transparently
Block or encrypt data
in some cases
Symantec Advantage
Detection High-performance
Off Network Coverage Flexible Response
Betty G. Well Meaning Insider
Asst. HR Manager | Midwestern Insurance Company
SITUATION: Sending sensitive data over email

DATA LOSS PREVENTION: RISK REDUCTION
Remediation
Notification
Prevention
IncidentsPerWeek
1000
800
600
400
200
0 Risk Reduction Over Time
Visibility

Architecture, Design and System Requirements

DATA LOSS PREVENTION: ARCHITECTURE
*Symantec Operated Cloud - **Customer Operated Cloud
• All DLP components are software (not appliances or hardware hosts)
• Agents protect endpoints on and off network
• Network detection servers typically reside in DMZ

DATA LOSS PREVENTION: PHYSICAL/VIRTUAL

DATA LOSS PREVENTION: MANAGEMENT PLATFORM

DATA LOSS PREVENTION: NETWORK DISCOVER/PROTECT

DATA LOSS PREVENTION: CLOUD STORAGE

DATA LOSS PREVENTION: ENDPOINT PREVENT
Agent inspects
data to internal
drives, USB,
CD/DVD,
supported email
clients / IM clients
/ browsers, FTP,
print/fax,
clipboard,
network shares,
and applications.
Agent sends
incident data to
Endpoint Server.
Note that agent
functions and
stores incidents
when
disconnected.
On reconnection,
it sends incidents
to Endpoint
Server.
Any blocking,
onscreen
notification, or
FlexResponse
rules are initiated
locally.
Endpoint Agents
(on or off network)
Endpoint Server

DATA LOSS PREVENTION: ENDPOINT DISCOVER
Agent inspects
files on internal
drives for policy
violations,
optionally
quarantines files
or executes
custom
FlexResponse
rules.
Agent sends
incident data to
Endpoint Server.
Agent functions
when
disconnected
from network,
storing incident
data until
reconnection.
Endpoint Agents
(On or off network)
Endpoint Server

DATA LOSS PREVENTION: NETWORK MONITOR

DATA LOSS PREVENTION: NETWORK PREVENT FOR EMAIL

DATA LOSS PREVENTION: NETWORK PREVENT FOR WEB

DATA LOSS PREVENTION: MOBILE EMAIL MONITOR

DATA LOSS PREVENTION: MOBILE PREVENT FOR WEB
DMZCorporate Network
VPN
DLP Mobile
Prevent for
Web Server
Web
Proxy
DLP
Enforce
DLP Mobile Prevent for Web
routes mobile traffic through
corporate VPN to DLP at all times.
Active Sync
Exchange
= components
target prospects
likely already have

DATA LOSS PREVENTION: DLP FOR CLOUD EMAIL

DATA LOSS PREVENTION: CLOUD SERVICE FOR EMAIL
Internet
Secured Corporate LAN
Email
Corporate User
Policies /
Incidents
SMTP / TLS
Enforce Platform
(14.0.1 or higher)
Office 365 Cloud
Microsoft Cloud
Symantec Email Security.cloud
Exchange
DLP Cloud Service for Email
(Cloudfire)
Symantec Cloud
DLP Storage
DLP Network
DLP Endpoint
DLP Mobile
Safeguard Service Plan
(A/V, A/S, Encryption, etc)

DATA LOSS PREVENTION: CLOUD PREVENT FOR O365

DATA LOSS PREVENTION: SYSTEM REQUIREMENTS (SMALL/MED)
Enforce Server Network Monitor Detection Servers
CPU 2 x 3.0 GHz CPU 2 x 3.0 GHz CPU 2 x 3.0 GHz CPU
RAM 6–8 GB 6–8 GB 6–8 GB
Disk 500 GB, RAID 1+0 or RAID 5 140 GB 140 GB
NICs 1 copper or fiber 1 Gb/100 Mb
Ethernet
1 copper or fiber 1 Gb/100 Mb
Ethernet
1 copper or fiber 1 Gb/100 Mb
Ethernet
OS Microsoft Windows Server, Red Hat Linux
• Pre-Services Engagement Activity is a must
• System Requirements and Compatibility Guide Available
• Performance Sizing Guides Available
Single Server Deployment
CPU 2 x 2.2 GHz 8-core CPU
RAM 64 GB
Disk 3 TB, RAID 5 configuration
NICs 1 copper or fiber 1 Gb Ethernet NIC (if using Network Monitor than 2)
OS Microsoft Windows Server, Red Hat Linux

Licensing and Packaging

DATA LOSS PREVENTION: LICENSING
• DLP 14.5 is licensed per ”managed user” or “managed device”
• DLP requires Oracle Standard Edition One or Standard Edition
• Customers may use their own Oracle site license if their Oracle
license agreement allows them to create a separate database
instance for Symantec DLP and they are entitled to a version of
Oracle supported by Symantec DLP.
• Symantec resells Oracle Standard Edition One and Standard
Edition licenses on a per Processor basis only for DLP
• Symantec resells VERITAS Data Insight and Data Insight Portal

DATA LOSS PREVENTION: PACKAGING (INDIVIDUAL)
Endpoint Discover
Endpoint Prevent
Network Discover
Network Protect
Network Monitor
Prevent for Email
Prevent for Web
Cloud Storage for Box
Email Prevent for O365
Service for Email
Mobile
(Email Monitor and Web
Prevent)

DATA LOSS PREVENTION: PACKAGING (ADD-ON/RESELL)
Symantec DLP
Form Recognition
Veritas Data Insight
Veritas Data Insight
Self-service Portal
Oracle

DATA LOSS PREVENTION: PACKAGING (SUITE)
Symantec DLP Enforce Platform
ENDPOINT
Endpoint
Prevent/Discover
Mobile
Network Monitor
Network Prevent
for Web/Email
NETWORK
SYMANTEC DLP ENTERPRISE SUITE
STORAGE
Network Protect
Network Discover
Purchased separately:
Form Recognition, Cloud Prevent for Microsoft Office 365 Exchange, Cloud Storage, Veritas Data
Insight, Veritas Data Insight Self-Service Portal, Oracle, or all the DLP Cloud Service offerings.

DATA LOSS PREVENTION: PACKAGING (SUITE)
Symantec DLP Enforce Platform
SYMANTEC DLP DISCOVER SUITE
STORAGE
Network Protect
Network Discover

Look and Feel

Thank you!
Copyright © 2015 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in
the U.S. and other countries. Other names may be trademarks of their respective owners.
This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied,
are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.
Thank you!
Iftikhar Ali Iqbal
https://www.linkedin.com/in/iftikhariqbal/

Appendix

Cloud File Sync and Share
SYMANTEC: Data Loss Prev
• Endpoint Prevent now monitors and
prevents users from syncing sensitive
files from their desktop to cloud
storage sites
• Applications monitored by default
include:
– Box
– Dropbox
– Google Drive
– Hightail
– iCloud
– Microsoft OneDrive
BenefitsFeatures
• Reduces risk of sensitive data loss
• Prevents sensitive information from
being sync’d to cloud storage sites
• Improves end-user awareness and
education of security policies

Improved Endpoint Agent for Mac OS
prevents confidential data transfer
between Mac endpoints and removable
storage devices
– Save as and File copy operations
supported
prevents confidential data uploads using
browsers on Mac endpoints
– Safari, Chrome and Firefox browsers
supported
• VMware Fusion 7 support monitors data
in use on a virtual Windows machine
and prevents unauthorized file transfer
BenefitsFeatures
• Reduces risk of sensitive data loss Mac
endpoints
• Prevents data loss from Mac endpoints
• Enables BYOD

Improved Endpoint Agent for Windows
• Chrome support monitors and
prevents users from transmitting from
Chrome browsers
• Microsoft Hyper-V support protects
data in use on virtual Windows
machines residing on a Hyper-V Server
• Media Transfer Protocol (MTP)
support monitors and prevents data
transfer between Windows desktops
and mobile devices using MTP.
BenefitsFeatures
• Reduces risk of sensitive data loss
• Prevents data loss to mobile devices
• Enables BYOD

How Data Insight Works
59SYMC DLP 12 Eval Workshop (Demo) Presentation
Network Discover
Network Protect
Enforce
Corporate LAN
Data Insight
Windows File Server,
NAS Filer, or SharePoint
Data Insight
retrieves file
access information
and usage history.
Enforce receives
Discover
incidents, queries
Data Insight,
populates
incidents with file
access data and
usage history.
Network Discover
scans target and
identifies
confidential files.

Efficient Incident Workflow
First Responders
Core IRT
Incident
Response
Procedures
Human Resources
Escalation Team
Extended Team
Legal Business Unit A
HR Policy
Violation
Suspected
Theft
Broken
Business
Process
Fan-out Response Structure
Escalation Team
Core IRT
First Responder Team
Extended Team Incident
Response
Procedures
Business Unit A Business Unit B Business Unit C
Critical Incidents
Fan-in Response Structure
Data
Flow
Direction
• The right information, to the right person, in the right order
60SYMC DLP 12 Eval Workshop (Demo) Presentation

Technology Overview - Symantec Data Loss Prevention (DLP)

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Technology Overview - Symantec Data Loss Prevention (DLP)

Similar to Technology Overview - Symantec Data Loss Prevention (DLP) (20)

More from Iftikhar Ali Iqbal

More from Iftikhar Ali Iqbal (16)

Recently uploaded

Recently uploaded (20)

Technology Overview - Symantec Data Loss Prevention (DLP)