DLP systems (Data Loss Prevention, DLP) - what it is

Ruslan Rakhmetov, Security Vision

In recent years, news publications and cybersecurity resources have been filled with headlines about information leaks: personal data bases regularly found in the public domain, internal documents and email archives of large companies ‘leaked’, and stolen passport data used in fraudulent activities. Therefore, when developing a threat and intruder model for an organisation, an experienced cybersecurity professional should not overlook the threats posed by insiders - internal intruders - and should also consider the use of DLP systems to prevent data leaks (DLP - Data Leak/Leakage/Loss Prevention).

Insiders are employees and managers of an organisation, as well as those who have active contractual relationships with the organisation: partners, suppliers, outsourcers, contractors, customers and other counterparties. Insiders are characterised by good knowledge of the company's operations and already have or can easily gain authorised and often enhanced access to IT assets. Shareholders, senior executives, even line managers, taking advantage of their official position and justifying urgent business necessity, may attempt to gain highly privileged access by bypassing standard information security procedures, and may actively oppose protective measures (e.g. DLP systems) or investigation procedures in the event of detected breaches.

Legal entities (contractors, outsourcers, suppliers, etc.) may pose a cybersecurity threat to a company due to the possibility of deliberate attacks: stealing intellectual property and other confidential information of interest to them, ‘ordering’ competitors, or performing a task on behalf of the government of their jurisdiction. In addition, such legal entities may unintentionally provide their IT infrastructure as a springboard for attacks by external attackers: for example, hackers often covertly gain a foothold in the systems of a compromised organisation in order to attack targets that are more interesting to them. For example, by hacking into IT companies SolarWinds and Kaseya, attackers gained access to the infrastructures of these companies' customers, resulting in many organisations being attacked that may have been even better protected than their IT service providers, who proved to be the “weak link”.

The more common method of infiltration, however, remains VPN tunnels set up between companies, which allow hackers within the compromised company's infrastructure to attack its counterparties via that VPN connection. There are cases when IT service providers, manufacturers of auxiliary equipment and employees of the contracting company became the causes of leaks. An unsuspecting company employee who inadvertently launches a malicious file on his laptop, which he then connects to the corporate VPN to work from home, could also become an ‘intermediary’ for the attack. The virus, having gained control of the infected laptop, can pass control to the attacker, who, having realised that this is not a simple home laptop but a corporate device, is likely to launch an attack: steal the employee's credentials (domain username and password), then try to infiltrate the company's infrastructure to steal confidential information, launch an encryption virus, mine cryptocurrency, etc.

So, insiders can be considered as individuals who deliberately carry out unauthorised access to protected information for various destructive purposes, as well as those whose accounts and workstations have been compromised by attackers. Once in the target organisation's infrastructure, the malware will initially work on behalf of the stolen account, with further attempts to gain access to the most highly privileged accounts (e.g. domain/enterprise administrator) and disable all protective systems (including antivirus, firewall, DLP system). Just at this stage of a cyberattack, when unauthorised actions are performed from under the accounts of ordinary, low-privileged users, we can respond and prevent the negative consequences of hacking with the help of DLP (Data Leak/Leakage/Loss Prevention) systems. This class of solutions controls the work of employees with protected information, the flow of confidential data in the company's infrastructure and the way it is processed.

Controlled channels of potential information leakage in different manufacturers of DLP-systems may differ, but, as a rule, the main ways of data theft are:

- copying files to removable storage devices (flash drives, CD/DVDs) and mobile devices (smartphones, tablets)

- e-mail transmission

- transfer via web services (messengers, social networks, cloud storage)

- transmission via data synchronisation services (e.g. OneDrive, Dropbox)

- transfer via AirDrop and Bluetooth connections

- transfer via clipboard (possibility to copy data via remote RDP connection)

- printing, photographing and scanning documents.

In the case of a hacker attack using compromised accounts, the channels of information output (exfiltration) can be more sophisticated: For example, through a variety of Web APIs with data transmission via the secure HTTPS protocol, through the remote data synchronisation protocol (rsync), through SFTP/SCP/SSH connection, by creating hidden data transmission channels (for example, with encapsulation of stolen information in DNS/ICMP traffic), using steganography methods (hiding transmitted data inside a file container, e.g. an innocuous picture).

According to the principle of operation, DLP systems can be divided into agent-based and agentless, with the ability to block unauthorised actions ‘on the fly’ or allowing only post-monitoring of performed actions. DLP solutions are also differentiated by the functionality of detecting confidential (protected) information in data streams, by the number of supported file formats and network protocols, by the availability of functionality for searching and classifying confidential information on network storage and local drives, as well as by the presence of additional modules (machine learning modules, computer vision, detection of anomalies in user and system behaviour, etc.).

Agent-based data leakage prevention systems involve installing a DLP agent on all monitored devices (PCs, laptops, servers, mobile devices), invisible and non-disabled for the average low-end user. Such a DLP agent works similarly to an antivirus: it is installed in the operating system at a low level, intercepts system calls, monitors the disc subsystem and network activity to detect protected information. The disadvantages of an agent-based DLP solution include the possibility of disabling/suspending the DLP agent by a highly privileged user (local administrator), the agent's dependence on the environment (it may not work correctly on a system attacked by intruders), and resource intensity (increased consumption of computing resources of the device on which it is installed).

Agentless systems function at the level of network traffic control, and are also installed at points where information flows are processed (corporate proxy servers, mail servers, file servers, business application servers). When DLP systems work at the network traffic control level, they are connected either through the SPAN port of the router (mirroring) or through a TAP connection (installing a device with a DLP component ‘in the gap’ of the network connection). If you use a TAP connection, you can inspect SSL/TLS traffic, which is close to 90% of the traffic on the modern Internet. Installing DLP components on important infrastructure objects (mail, file, business and proxy servers) implies control over information processing regardless of user endpoints - in other words, an employee can work with corporate email from his personal iPhone, which does not have a DLP agent, and nevertheless his actions with protected information will be monitored.

DLP-systems that provide the ability to block unauthorised processing of information can significantly reduce the risk of information leakage and, as a result, reduce the damage from such an incident to almost zero. However, the operation of a DLP solution in blocking mode has its obvious disadvantages: in the case of a False Positive, when DLP has mistakenly blocked an authorised, legitimate exchange of information, the relevant business process will be suspended. Here is an example: a DLP solution mistakenly mistook a file with open tender documents for a confidential contract and blocked the email sending of such a file, thus blocking the business process until a manual intervention by an IS specialist, who must analyse the blocked file, understand that the classifier worked incorrectly, add the file to the ‘whitelist’, contact the sender and ask him to send the email again. Thus, running a DLP system in blocking mode requires very careful pre-configuration, classification and tuning of information control rules to minimise such false positives.

DLP solutions for data leakage protection operating in monitoring mode perform, in fact, post-facto analysis of what happened to the data: if the transmission of security events and warnings from the DLP agent is carried out continuously, in real time, it only slightly reduces the overall level of protection of confidential information, because the on-duty analyst of the SOC-centre can take additional actions to prevent information leakage: contact the supervisor of the offending employee or block access However, if the network communication between the DLP agent and the DLP system control centre is broken (for example, the intruder deliberately disconnected the Internet while copying data to a flash drive), the response may be too late. However, even a DLP system in monitoring mode will provide invaluable assistance by enriching the security event data fed into, for example, a SIEM system. Information about users' actions with files, their work with cloud storage, removable drives and other potential channels of information leakage will be extremely useful when analysing incidents and conducting forensic investigations.

Functional characteristics of the ways to detect sensitive (protected) information in data flows play a crucial role when selecting a DLP system, because it is the capabilities of semantic content analysis that determine the ultimate effectiveness of a data leak prevention system. Let us imagine that we have included personal data of our employees and customers in the list of protected information; thus, all files and documents containing surnames, first names, patronymics, dates of birth, passport series/numbers, etc. should be interpreted as confidential by the DLP system through semantic content analysis.

The semantic core of a DLP system can use:

- Regular expressions: applied to structured data such as passport details, bank card details and insurance numbers.

- Keyword matching: used to search for specific ‘secret’ words in file content (new product name, chemical formulas, vendor company names).

- Full file matching: used to control the processing of known and unchangeable files (e.g. electronically signed contracts, encrypted file containers, proprietary software distributions).

- File structure search: analysing the content of a file reveals a certain frequency of keywords and the structure of the document, on the basis of which a conclusion is made as to whether the document belongs to one or another category of confidential information (e.g. documents containing a ‘header’ in the upper right part of the page are considered to be employee statements, while documents containing the name and address of the company in the footer of each page are considered to be intellectual property).

- Content search using machine learning: DLP is trained on some large set of documents and files that an IS analyst has marked as confidential. Then, when a new file is discovered, the DLP system compares it with previously analysed files and decides whether the file is likely to contain sensitive information.

Additional functionality of DLP systems may include:

- File storage analysis module: used to analyse files on shared network drives to search for confidential documents stored in the public domain with incorrect permissions, to identify file owners (based on the number and frequency of accesses to a document by a particular user), to structure and visualise the state of the company's document storage system, and to deduplicate data.

- Functionality of recording actions on the device: it helps to control the activities of both employees and contractors and outsourcers in the organisation's IT systems; it can also be used for internal checks (investigations) and forensic research of the device.

- User behaviour anomaly detection module: the application of machine learning allows to detect deviations in the normal working behaviour of a user, such as working at uncharacteristic hours (at night on weekends), launching rare system utilities, installing and running suspicious software, visiting atypical web resources, changing the circle of communication in the corporate messenger, even a sharp increase in the number of typos, which may indicate stress or burnout.

- OCR (optical character recognition) module: allows you to translate a picture, such as scanned text, into a machine-readable form for the application of semantic algorithms.

- Computer vision: used to analyse the behaviour and actions of employees behind the screen of a work computer equipped with a webcam, e.g. to detect screen photography or misuse of working time.

- Speech Recognition Module: uses the microphone built into the work computer to detect verbal disclosure of confidential information.

It should also be noted that implementation of a DLP system is a complex process that includes assessment of the current state of IS processes in the company, analysis of information of value and processed digitally, classification of IT assets containing confidential data, interviewing of those responsible and owners of business processes. For legal and documentary justification of the DLP-system operation it is necessary to introduce a trade secret regime in the company (in accordance with the norms of 98-FZ ‘On Trade Secrets’), prepare a list of information that constitutes a trade secret of the company, then familiarise the company's employees with the documents against signature, emphasising in them the fact of using a DLP-system in the company. In addition, as organisational measures to combat internal threats, it is possible to conduct checks of applicants for employment, psychophysiological tests with the use of polygraphs, training and regular awareness-raising of employees in the field of information security and the organisation's requirements for working with information, as well as continuous provision and control of personnel and psychological security of team members - identification of negative trends, work with confidential informants, interaction with formal informants. In order to minimise the risks generated by legal entities (outsourcers, contractors, suppliers, etc.), it is necessary to conclude with them a legally correct non-disclosure agreement (NDA, non-disclosure agreement) with indication of responsibility for its violation and the order of compensation for damage; it is also possible to check the reliability of contractors, to analyse the history and capabilities of suppliers, to assess the possible risks of rendering certain services to certain persons, in addition, an informal audit of information security can be carried out. Note also that the analysis of storage locations and methods of processing protected information, revision of semantic rules for identifying confidential information DLP-system and updating the list of information that constitutes a trade secret should be carried out at predetermined intervals (but at least once a year), including this process in the information security management system in the company.

In conclusion, DLP systems can be successfully used to combat both internal intruders and external threats: for example, spyware that has entered the system will behave like a typical insider: it will scan the corporate LAN, search for valuable information on the network and locally, and try to transfer the found data to the outside. Such a cyber incident can lead to significant damage to a company if the spyware virus preys on confidential corporate information or personal data of customers.

Response times to such cyber incidents should be minimised as much as possible, as the time from initial network intrusion to the release of stolen data is often a matter of minutes. To minimise MTTD (mean time to detect) and MTTR (mean time to respond), IS process automation and cyber incident response systems such as Security Vision's IRP/SOAR solution are used. This product can fill gaps in standard DLP systems, such as insufficient integration with other security tools (e.g. SIEM systems), lack of machine learning, artificial intelligence and Big Data processing modules, and inability to proactively respond to information leaks outside the DLP-controlled infrastructure (e.g. firewall or EDR system). Integration of data provided by the DLP solution with security events received by the SIEM system will help the SOC centre analyst to get a more complete, enriched picture of the incident, and risk profiling of users will become more accurate. It will be possible to see not only the fact of confidential information transfer, but also the context of this action: whether it was performed by the user locally or remotely, from which geolocation the remote employee connected, whether this connection was preceded by unsuccessful authentication attempts (possible password mining), how typical it is for the user to search for a certain word in all documents on all available network drives. The graphical playbook created in the Security Vision IRP/SOAR system will help reflect the logic of responding to suspicious actions of both internal intruders and external attackers who have gained unauthorised access to an employee's account, while the integration of Security Vision with various information protection systems and tools will help minimise damage from information leakage by reducing the response time to a cyber incident.

What is DLP (Data Loss Prevention)?

DLP is a system designed to prevent data leakage from an organisation. It allows you to control and monitor information moving in and out of the corporate network and prevent its unauthorised dissemination. It is an important part of information security that provides protection against internal and external threats such as data breaches, loss of secrets, malicious attacks and regulatory breaches.

How does DLP work?

DLP systems use a variety of methods and technologies to identify, categorise and control data. Here are some key aspects of how they function:

1. Sensitive data detection: DLP systems scan text, files, emails, and other types of information to identify sensitive or confidential data such as social numbers, credit cards, medical information, and others.

2. Traffic monitoring: They analyse network traffic and data transfers to identify anomalies and potential security policy violations.

3. Security Policy Enforcement: DLP allows you to configure security policies that define what actions are allowed with certain data. This can include blocking, encryption, alerts, and more.

4. Incident Management: When the system detects a security policy violation, it provides information and tools to investigate and respond to the incident.