Today’s Data Loss Prevention (DLP) and data security analytics solutions are challenging to deploy and manage. These solutions repetitively apply complicated rules and analytics at each location where data travels to identify misuse.

Common shortfalls include:

• Rule-sets and analytics only monitor but don’t protect the data itself
• Responding to alerts, including false-positives, overwhelms security staff
• Inappropriately applied rules block user workflows
• Implementation is required at each email, network, endpoint and cloud location

A protect first approach takes a more direct path to safeguarding files that contain sensitive data. At its core is a file-centric technology. A file with sensitive data is discovered, classified and secured the moment it’s created. This one time detect and secure method:

• Encrypts and binds identity and access to the file itself for strong protection
• Eliminates continuous monitoring and alert administration
• Uses transparent and seamless protection that doesn’t disrupt workflows
• Protects file independent of server, storage or device

By working at the file level, this approach creates a sequence of efficiencies that simplify and streamline data discovery, classification, protection, audit and policy management. When deployed as an integrated platform, the approach delivers a high degree of automation with centralized controls.

Here’s how organizations use the protect first approach to keep their security and privacy projects on a fast track.

Now let’s take a more detailed look at how each these activities can keep your project moving.

Discover to Learn

Keep initial discovery simple to gain a first-pass understanding of your data inventory and where security gaps exist

Searching for common file extensions will provide valuable insights into the kind of sensitive information you have and where it is located. The discovery tool searches file shares, desktops, laptops, other endpoints and mapped drives. This snapshot will give you the location of all files, volume of file types you have, who the file owner is, which department it belongs to, and the last date it was accessed.

Use basic insights to formulate priorities

By focusing on the primary goal – to safeguard sensitive unstructured data - you might quickly find that files owned by Human Resources (HR), Research and Development (R&D) or Finance have spread outside their designated file storage locations. If these sensitive files are on employees' laptops, on removable drives or are shared with third parties, the data is at high risk of exposure and should be assessed as an early priority target.

KEY INSIGHT:

Too often projects lose momentum as governance, legal, compliance, IT and security work across multiple departments to gather requirements and develop policies. Overcome inertia and engage with your data inventory to help drive informed policies.

Divide and Conquer

Focus on data that your organization currently generates, accesses and shares. Set older, dated inventory on a separate remediation path. Finally, assess all data for its value, especially “dark” and redundant, obsolete or trivial (ROT) data.

As a general rule, data less than one year old often represents less than 25% of corporate data

Current and active data is typically what matters to your business today and likely the most valuable to threat actors. Target this subset of data first and use the experience to fine tune your policies. Move this current data onto downstream classification and protection processes first to get sensitive data protected and under control as quickly as possible.

Set dated inventory on a separate path

Consider various remediation paths for older inventory to limit its risk exposure while prioritizing current data. Data discovered in unauthorized locations should immediately be moved to approved file-shares. For departments known to deal with a large amount of sensitive data (e.g., legal, audit, HR), use bulk folder-based or in place encryption methods to protect the data inventory in the interim.

They can’t steal what you don’t have

As much as 52% of data stored by organization is “dark” data, the value of which is undetermined and 33% is redundant, obsolete or trivial (ROT). Data discovery will surface all files for review and the deep visibility enabled by a file-based method will identify duplicates and file derivatives (i.e., files that are renamed or format has changed). Eliminate ROT immediately and engage data owners to assess dark data.

KEY INSIGHT:

Simply discovering the basic facts about your unstructured data will help you decide on the best path to address and prioritize your data security and privacy requirements.

Classification

Don’t get side-tracked by diverse data stakeholder interests

There’s a wide range of information governance purposes that impact your data, and security and privacy are just one part. It includes:

• Data categorization (e.g., identifying a sales contract vs. a memo)
• Data attributes (e.g., managing big data warehouses)

Stakeholders will understand the negative impact to their brand and punitive privacy penalties arising from a data breach and why a protect first approach makes sense. Ensure your tool selection can support all stakeholder needs and commit to revisit their requirements after enacting your initial data security and privacy safeguards.

Straightforward security measures makes classification simpler

Classification cues downstream tools to invoke controls. Security that relies on multiple factors to cue controls, like DLP and data analytics, adds complexity to classification.

Keep classification simple. If its sensitive, secure it. This enables you to eliminate complexity and streamline classification efforts.

Quick classification win

Our experience has shown that the majority of sensitive content can be found by searching for the most common sensitive data types using basic and proven filters the 80/20 rule. Like:

• Identification number (like SSN), driver’s license, passport information
• Bank account numbers, credit card formats
• Health care codes and terminology
• Patent and trademark numbers

Organizations too often start by scanning volumes of unstructured data using multiple and complex filters to meet a full range of governance requirements. Instead, use proven filters first to find the majority of your sensitive content, keep false-positives to a minimum and then layer on more specific searches.

KEY INSIGHT:

Don’t let the classification process turn into an academic exercise. Keep a protect first priority to get your data safeguarded as fast as possible.

Protect, Not Alert

Today’s DLP and employee monitoring don’t secure the data itself: they monitor data (who has access, where the files are stored, etc.) and alert on misuse but don't secure the sensitive files themselves.

Monitor alert approach overwhelms staff

Security and IT professionals must actively administer and respond to thousands of alerts to implement today’s solutions. Complex rules and analytics generate a high percentage of false-positives and the tools often lack the context to prioritize incidents for administrator actions. Already burdened, security and IT are falling behind and will continue to be less effective as data volumes grow.

A better approach is to automatically secure sensitive data with strong protection from the start and for its lifecycle. There won’t be repetitive content, analytics scans or ensuing alerts. Your data is truly protected from a breach and valuable resources are available for more productive purposes.

Protect the file, not the locations

Traditional solutions implement rules and analytics at each location where data may reside or travel. It’s become increasingly challenging and complicated to scale these solutions with today’s cloud environments, mobile workforces and explosion of endpoint devices.

Rather than struggle to control every network, server, cloud service or endpoint device that interacts with their data, protect the data itself. Eliminate multiple implementations and costly administration.

Platform Approach

A protect first, file-centric approach creates a sequence of efficiencies that simplify and streamlines document security through data discovery, classification, protection, audit and policy management. It uniquely enables a purpose-built, automated data-centric platform that enforces centralized policies across your entire data inventory.

Eliminate complexity and inconsistency

You quickly lose control of sensitive files governed by a patch work of policies spread across networks, cloud services and devices.

Centralize policy management and manage security, access control, and privacy settings all in one platform and enforce actions immediately that updates across your entire sensitive data inventory.

Automate

It’s essential that privacy and security measures don’t disrupt end user workflows. It must be transparent and seamless with controls applied consistently, in real-time and across the entire enterprise. Automate these processes with a file-centric platform:

• Discovery: don’t rely on users to determine data sensitivity. Use continuous scanning to find files with sensitive information the moment they are created.
• Data classification: categorize and tag files with automated tools to apply a consistent set of policies.
• Protect: use classification cues to instantaneously encrypt and apply access and rights controls.

Eliminate tool sprawl and achieve lowest Total Cost of Ownership

Deploying point solutions to close each emerging security and privacy gap, at each location data travels, is inefficient and adds operational complexity.

Consolidate multiple security and privacy tools with a platform that’s location-agnostic, efficient to administer and layers seamlessly with current infrastructure.

KEY INSIGHT:

The best path to operationalize data security and privacy is to employ highly automated processes and centralized controls that place the burden on the technology and not the end user.

Traditional security and network tools create a patchwork approach to data visibility that is inadequate, impractical, and unsustainable.

You need visibility to know where your data is, who is using it, and how it changes throughout its lifecycle. Discovery and classification tools are a good start to find data and tag it for downstream controls. However, to maintain control, you need deep visibility to track data as it travels, is accessed and transforms into other file types throughout its lifecycle. 

Cybersecurity and privacy teams are challenged to keep track of sensitive files. A file will be accessed by multiple systems, applications and devices as users share it internally and with external parties. With over 40 different security and IT operations tools used in a typical business, organizations struggle as they work to accumulate, correlate, and report file interactions.

This challenge grows as data visibility is often obscured when documents travel within the organization or shared externally to the organization and change either through duplication or revisions. Without proper data visibility, you can miss the moment sensitive information is shared, moved to a different location, changed, or deleted.

You must also have visibility into sensitive file interactions for data breach investigations and to comply with privacy regulations.  Details must be readily available to support incident response teams; and privacy regulations like GDPR and CCPA compel businesses to report on all data they hold regarding an individual within a specified period or be subject to fine. 

KEY INSIGHT:

Faced with millions of files and countless interactions across global networks with thousands of end points, organizations need a new way to track data use and movement.

Visibility gaps widen as three trends stress legacy infrastructure

IT, security and privacy professionals are working to address widening visibility gaps and overcome the risk posed by:

Data proliferation is staggering, and unstructured data is rapidly growing, estimated to be 80% of a business’s data inventory.  Unstructured data is routinely undermanaged and is hard to control and track as users take sensitive files from controlled repositories, store them on laptops, endpoints, and cloud services and share them in collaboration applications both internally and with external parties.

COVID-19 rapidly expanded the remote workforce and dissolved corporate perimeters.  Sensitive data now resides on more unmanaged and shared devices. It travels on insecure networks and is used in unauthorized or non-compliant apps.  All this is obscured from corporate oversight.      

Privacy regulations have vaulted individual rights to the forefront.  Right to be informed; right to be forgotten; and data residency all impose new demands on data visibility, tracing, control and reporting.

KEY INSIGHT:

Regulatory agencies and corporate Governance, Risk and Compliance (GRC) teams increasingly focus on the visibility gap of sensitive unstructured data and the actions of security, compliance and IT professionals to close these gaps.

Self-reporting files use an embedded ID technology to trace and record all interactions

Legacy security and privacy data architecture lack the deep data visibility and persistent tracking needed to meet today’s requirements.

Data loss prevention (DLP) and identity and access management (IAM) solutions designed for perimeter security lose track of data migrated to the cloud and when downloaded by remote workers.  Privacy and legal e-discovery applications may have file mapping features, but they are siloed, don’t track all interactions, and the multiple datasets are disconnected and incomplete.     

A unique ID that’s embedded and travels with the file enables persistent tracing and self-reporting of interactions throughout the file’s lifecycle.  By using this method, it:

An organization’s existing data-centric tools perform better with an embedded ID approach.  Discovery scans lack the intelligence to relate file derivatives that are copied or duplicated.

With an embedded ID, derivatives of an original file, whether duplicated or renamed, inherit the parent ID tag and all its security and governance policies.

An embedded ID reduces tool sprawl by negating the need for tracking tools fielded with each security, privacy and legal e-discovery application.  All applications benefit from a single source of truth for file tracing and interactions.

KEY INSIGHT:

Using an embedded ID for deeper visibility, tracking and reporting at the file level is the best way to achieve sustainable and auditable processes and better safeguard sensitive data.

Today, with increasing threats and the consequential impacts of a data breach, more organizations are adopting a file-centric method as the foundation of their data-centric architectures.  It’s the only method that truly denies unauthorized access to your sensitive data no matter how it flows or the location it resides.  This protect-first foundation recognizes that if data isn’t properly protected – your entire house crumbles. 

A file-centric method works as a frontline defense and can be deployed in combination with other methods to achieve a fortified, cohesive data-centric security architecture.  Understanding the key distinctions between the methods helps you navigate vendor engagements and build a protect-first architecture that best fits your needs

Data Flow-Centric

These solutions defend sensitive data at corporate infrastructure ingress and egress points and use data loss prevention (DLP) tools to stop data leakage. Ingress and egress points include servers, networks end-points, and cloud services.

Today, the majority of businesses have deployed DLP as point solutions – known as Integrated DLP (e.g., network DLP, email-server DLP, or end-point DLP) while few have scaled to a full enterprise DLP deployment (e.g., a full solution suite across all points).

Data flow-centric characteristics:

DLP solutions set up rules that specify conditions, actions and exceptions. The tools filter messages and files based on their content and prompt corrective measures. They can simply alert a user that an action may be risky or completely block the action. Examples include alerting when sharing sensitive data through email and restricting the copying of sensitive files onto a USB drive.

Many organizations have implemented email DLP since this is the most obvious ingress/egress point prone to unauthorized exchanges of sensitive data. While there are measured improvements, security and IT administrators still have challenges when implementing and operating DLP  solutions, such as:

Too often businesses have inappropriate expectations for DLP.  It works - but many underestimate the complexities and resources needed to build, tune, and manage policies to fit your environment. You should anticipate iterative refinement of rules and alert resolution.

KEY INSIGHT:

Data flow-centric solutions are good at reducing risk but not a strong, protect-first approach. They don’t defend the data itself, but only how it flows in your organization. Any leakage exposes the data to unauthorized disclosure.

Location-Centric

These solutions defend sensitive data storage locations. They look for gaps and inconsistencies in identity and access management (IAM) and apply user behavior analytics (UBA) to reduce the risk of unauthorized disclosure of sensitive data. Locations include folders, file-shares, disks, and cloud services.

Location-centric characteristics:

Unlike DLP solutions that query and assess content repetitively, location-centric solutions pre-process, classify, and tag sensitive data. These tags flag where sensitive content is located within your IT data architecture and use:

Location-centric solutions are easier to implement than rules-based data flow-centric solutions because the tools are non-intrusive and use system log and UBA. Location-centric solutions place priority on data visibility and are superior to many approaches when it comes to privacy compliance, audit and reporting requirements.

However, drawbacks with location-centric solutions include:

While obfuscation tools are not native to these solutions, some do use data encryption while the data resides and is used within a particular location. However, when files are downloaded to endpoints, stored in personal cloud accounts, and shared outside the location - protection, visibility and control is lost.

KEY INSIGHT:

Location-centric solutions use a “least privilege” approach as the foundation for their data protection method – not a “protect-first” approach. Critical gaps arise when data is moved from its original location, and lacking persistent encryption, expose your sensitive unstructured data to a breach.

File-Centric

In contrast to the other methods, persistent encryption and IAM are tied to and travel with the file. This is independent of networks, severs, locations and devices. 

File-centric characteristics:

The method uses data classification tags to:

File-centric solutions were historically used for very specific use cases but today are experiencing a market resurgence. Modern solutions take advantage of the latest in software tools like RESTful APIs and open operating system standards to work transparently across the enterprise. Centralized policies ensure access and protection are consistently applied across all networks, file-shares, devices, end-points and cloud services.

And when it comes to denying access to sensitive content, the file-centric method is by far the best "protect-first" approach. Here's how leading analyst are advising clients:

Look for file-centric solutions that automate discovery, classification and encryption in a single instantaneous step without user intervention. This improves productivity and consistency in application of policies.

KEY INSIGHT:

File-centric solutions use a “protect-first” approach as the foundation of their data protection method. Persistent access control and encryption remains with the file throughout its life-cycle. Most privacy regulations exempt loss of encrypted files from breach reporting or alternatively, impose significantly reduced penalties.

Sharing and storing sensitive information in free-form documents that live outside carefully monitored or secured databases is now a widespread practice. This creates a gap that presents countless opportunities for unauthorized disclosure through inadvertent handling by employees, actions of malicious insiders, and cyberattacks.

Businesses are mobilizing to combat these threats. The first step is to ensure your organization understands the character, significance and challenges surrounding sensitive unstructured data. Focus on these topics to drive better organizational insights into why and what can be done now to close the gap.

Who cares about sensitive unstructured data?

Unauthorized access or loss of sensitive data hurts your competitive advantage, damages your brand, and can incur significant regulatory penalties.

In addition to customers and potential loss of revenue,

What are the types of sensitive unstructured data?

Sensitive data is any information that must be safeguarded from unauthorized disclosure. The broadest categories are regulated or unregulated. The former, as required by laws, must be handled as sensitive. Unregulated data includes both business sensitive and publicly known information. It’s up to the business to determine what content it deems sensitive.

Regulated data arises from:

Personal Health Information (PHI), Personal Identifiable Information (PI), and Payment Card Industry Data Security Standard (PCI) continue to be the traditional definition of individual privacy. By gaining access to this valuable data, cybercriminals can steal identities and/or compromise bank accounts to easily earn a quick profit.

Modern day privacy regulations, such as GDPR and CCPA, have broadened the definition of what information is subject to regulations to include individual interactions in the digital space, putting companies under significant new obligations.

Unregulated data of a sensitive nature is determined by the business. It is data the business doesn’t want exposed and can be strategic, competitive, financial or operational in nature. Examples include:

Today’s cybercriminals are opportunistic and look for companies involved in a current event or have an obvious vulnerability they can exploit for the most value. Examples include: stealing data about important drugs or vaccines being developed or exposing damaging information from an ongoing legal proceeding.

Interestingly, unregulated sensitive content breaches are often a hidden secret. It’s not subject to disclosure like regulated data so organizations often choose to avoid the reputational damage associated with publicizing a breach.

How are sensitivity levels determined?

Regulated data is always sensitive. Most unregulated is not as it includes publicly known information.

Your corporate GRC team or chartered committee determines what data is sensitive. They consider all internal and external mandates, the nature of the data, how it is being used, the likelihood of a breach, and its overall impact on your organization (financial and reputational).

Helpfully, policies have become standardized across industries with “templates and toolkits” that leave little to risk that you can implement with reasonable effort.

Best practices recommend three classification levels (e.g., confidential, internal, public), four at most. Any greater number have shown that the distinctions are too finite for employees to assess and result in subjective and inconsistent application.

To move from templated policies to meaningful execution, its critical GRC team help security and IT professionals in your organization prioritize sensitive unstructured data tasks by directing attention to such factors as:

1. Hybrid and Multi-Cloud Environment

According to Flexera’s “State of the Cloud, 2020 Report”, organizations use an average of 2.2 public and private cloud providers. This exposes your data to the following risks:

SOLUTION CONSIDERATION:

A data-centric approach identifies files and secures them in a centralized management system to provide consistency across all channels. Using discovery tools helps locate your data and classifies it with specific tags to control their cloud location.

2. Privacy

Today’s privacy regulations demand greater visibility and control over an individual’s data.

Regulation types include:

SOLUTION CONSIDERATION:

Deep visibility tools accumulate access information during the entire lifecycle of the sensitive unstructured data. You should avoid traditional tools that provide limited visibility and require forensic action to correlate and search across multiple log files.

3. Insider Threat

While external threats from hackers and cybercriminals make the headlines, trusted insiders can pose a greater threat to your sensitive unstructured data. A traditional security infrastructure focuses on external threats using firewalls, anti-malware, intrusion detection, and other security solutions. These solutions may not prevent an employee, contractor or third party vendor with access from sharing it with unauthorized users.

There are three types of insider threats that require your attention:

SOLUTION CONSIDERATION:

Encrypt files and apply rights management to decrease the likelihood of unauthorized users accessing your sensitive unstructured data. If hackers and cybercriminals exfiltrate protected sensitive data, it will be useless to them. The same goes for employees or contractors who want to take sensitive data.

4. Security Gaps

Despite significant investments in security infrastructure and the deployment of data loss prevention capabilities, breaches are at all-time highs. Threat actors have greater success exfiltrating information on endpoints and servers where sensitive unstructured data is common.

What you need to acknowledge and have teams address:

SOLUTION CONSIDERATION:

Enhance existing DLP investments by encrypting files with sensitive data. Use centralized encryption key management to maintain protection and control wherever the file travels.

5. Remote Workforce

This is a significant trend that’s been recently accelerated by COVID-19. Security and privacy implemented in corporate offices can’t be replicated at each home. Review your current policies to see if they address:

SOLUTION CONSIDERATION:

Use strong data-in-use tools like rights management capabilities that restrict printing and storing content on removable media.

6. Secure Third-Party Collaboration

Customer information shared with others remains your responsibility, regardless of who leaks the data. The challenges here are:

SOLUTION CONSIDERATION:

Deploy agentless browser collaboration with file tracking and protection. Screen blocking of sensitive information during collaboration sessions prevents losing sensitive data. Revoke access of sensitive files if shared with third parties once no longer needed.