-: Data loss prevention.
Data loss prevention is set up to monitor
the data of a system while it's in use,
in transit, or at rest.
It does this in order to detect any attempts
to steal the data.
Let's think about when we had data stored,
20 or 30 years ago.
Where did they store most of it?
Well, most businesses stored it, printed off,
and in a filing cabinet.
And if somebody wanted to get it,
they'd have to break into your offices,
open the filing cabinet, and physically take the files.
This limited the amount of information
that somebody could steal from you,
because they really could only steal,
what they could carry with them.
Then, we started allowing people to work remotely,
and a lot of data was stored on laptops.
If you happened to stop for lunch
and you left your laptop sitting in your car,
somebody could've broken in your car
and stolen your laptop.
And they now have access to all the data that was on it.
The next evolution in data theft occurred
when we started using external hard drives.
These started being used all throughout our offices.
These hard drives could hold large amounts of data.
We could plug it into the network, through our laptop,
and download a ton of information and data,
and then walk out of the building with it.
But, these were kind of large and easy to detect.
Next, we started seeing thumb drives,
that hold just as much as these external hard drives,
carrying billions of documents out the front door
with no one knowing it, because they're so small,
and fit right in your pocket.
But wait, we don't even need to do that nowadays,
because we have things like Dropbox and Google Drive,
where we get terabytes of storage available to you,
hooked up to the network.
And I could sit there
and upload everything your company has,
and get access to it, anywhere in the world.
This is a huge problem for businesses,
because our data and our intellectual property
is what the currency of business is these days.
To protect it, we have to use data loss prevention systems.
These systems come as either software or hardware solutions.
The first data loss prevention system we're going to talk about
is an endpoint DLP system.
An endpoint system is usually a piece of software
that's installed on a workstation or a laptop,
and it's going to monitor the data that's in use
on that computer.
And if someone tries to do a file transfer,
it'll either stop that file transfer,
or it'll alert the admin of the occurrence
based on certain rules and policies.
Very much like an IDS or an IPS would, but focused on data.
DLPs can be set to detection mode or prevention mode.
The next one we have is a network DLP system.
This is a piece of software or hardware
that's a solution placed at the perimeter of your network.
It's sole function in life
is to check all of the data going into
and out of your network,
with a special focus on things going out of the network.
They want to detect data in transit
that shouldn't be leaving the building.
The third type we have is called storage DLP.
This is a software that's installed on a server
in the data center and inspects the data
while its at rest on the server.
This is usually because they've encrypted it
or watermarked it,
and we want to make sure that nobody's accessing
the data at times that they shouldn't be.
For example, if someone starts downloading
large amounts of data at two in the morning,
that's probably against your policy
and the DLP could catch it.
The fourth type of DLP is a cloud-based DLP system.
These systems are usually offered as software-as-a-service,
and it's part of your cloud service and storage needs.
They're going to protect your data
when it's stored inside those cloud services.
For example, my company uses Google Drive
and we have data loss prevention
as part of a cloud service, offered by Google.
In summary, these data loss prevention solutions
are made to be accurate in a way
that they stop data from leaving your network.
They're going to go through and look at data at rest,
data in use, and data in transit,
to ensure that it's following
the policies you've set up as a security administrator,
so you could protect that asset of your company.