Overview of Data Loss Prevention (DLP) Technology

Copyright 2011 Trend Micro Inc.Classification 8/2/2013 1
Overview of Data Loss Prevention (DLP) Technology
Liwei Ren, Ph.D
Data Security Research, Trend Micro™
Sept, 2012, Tsinghua University, Beijing, China

Copyright 2011 Trend Micro Inc.
Backgrounds
• Liwei Ren, Data Security Research, Trend Micro™
– Education
• MS/BS in mathematics, Tsinghua University, Beijing
• Ph.D in mathematics, MS in information science, University of Pittsburgh
– Research interests
• DLP, differential compression, data de-duplication, file transfer protocols, database
security, and algorithms
– Major works
• N academic papers, M patents and K startup company where N≥10, M ≥12 and K=1
– TEEC member since 2005.
– liwei_ren@trendmicro.com
• Trend Micro™
– Global security software company with headquarter in Tokyo, and R&D centers in
Nanjing, Taipei and Silicon Valley.
– One of top 3 anti-malware vendors (competing with Symantec & McAfee)
– Pioneer in cloud security with product lines Deep Security™, SecureCloud™
– Major DLP vendor after Provilla™ acquisition
2

Agenda
• What is Data Loss Prevention (数据泄露防护)?
• DLP Models
• DLP Systems and Architecture
• Data Classification and Identification
• Technical Challenges
• Summary
Classification 8/2/2013 3

What Is Data Loss Prevention?
• What is Data Loss Prevention?
– Data loss prevention (aka, DLP) is a data security technology
that detects potential data breach incidents in timely manner
and prevents them by monitoring data in-use (endpoints), in-
motion (network traffic), and at-rest (data storage) in an
organization’s network.

• What drives DLP development?
– Regulatory compliances such as PCI,SOX, HIPAA, GLBA, SB1382 and etc
– Confidential information protection
– Intellectual property protection
• What data loss incidents does a DLP system handle?
– Incautious data leak by an internal worker
– Intentional data theft by an unskillful worker
– Determined data theft by a highly technical worker
– Determined data theft by external hackers or advanced malwares or APT

• The evolution of naming
– Information Leak Prevention (ILP)
– Information Leak Detection and Prevention (ILDP)
– DLP
• Data Leak Prevention
• Data Loss Prevention

DLP Models
• A model is used to describe a technology with rigorous terms
• We need models to define/scope what a DLP system should
do
• Three States of Data
– Data in Use (endpoints)
– Data in Motion (network)
– Data at Rest (storage)

DLP Models
• The data in use at endpoints can be leaked via
– USB
– Emails
– Web mails
– HTTP/HTTPS
– IM
– FTP
– …
• The data in motion can be leaked via
– SMTP
– FTP
– HTTP/HTTPS
– …

DLP Models
• The data at rest could
– reside at wrong place
– Be accessed by wrong person
– Be owned by wrong person

DLP Models
• A conceptual view for data-in-use and data-in-
motion:

DLP Models
• Technical views for data-in-use and data-in-motion:

DLP Models
• DLP Model for data-in-use and data-in-motion:
– DATA flows from SOURCE to DESTINATION via CHANNEL do
ACTIONs
• DATA specifies what confidential data is
• SOURCE can be an user, an endpoint, an email address, or a group of
them
• DESTINATION can be an endpoint, an email address, or a group of
them, or simply the external world
• CHANNEL indicates the data leak channel such as USB, email, network
protocols and etc
• ACTION is the action that needs to be taken by the DLP system when
an incident occurs

DLP Models
• DLP Model for data-at-rest

DLP Models
• DLP Model for data-at-rest
– DATA resides at SOURCE do ACTIONs
• DATA specifies what the sensitive data (which has potential for
leakage) is
• SOURCE can be an endpoint, a storage server or a group of them
• ACTION is the action that needs to be taken by the DLP system when
confidential data is identified at rest.

DLP Models
• These two DLP models are fundamental
• They basically define the formats of DLP security rules (or DLP
security policies)

DLP Systems and Architecture
• Typical DLP systems
– DLP Management Console
– DLP Endpoint Agent
– DLP Network Gateway
– Data Discovery Agent (or Appliance)

DLP Systems and Architecture
• Typical DLP system architecture

Data Classification and Identification
• One expects a DLP system can answer the following questions
– What is sensitive information?
– How to define sensitive information?
– How to categorize sensitive information?
– How to check if a given document contains sensitive information?
– How to measure data sensitivity?
• Data inspection is an important capability for a content-
aware DLP solution. It consists of two parts:
– To define sensitive data, i.e., data classification
– To identify sensitive data in real time

• Sensitive data is contained in textual documents.
• What does a document mean to you?
• We need text models to describe a text:

• I prefer to use UTF-8 text model
– Handling all languages, especially for CJK group.
– A textual document is normalized into a sequence of UTF-8 characters
• Four fundamental approaches for sensitive data definition and
identification:
– Document fingerprinting
– Database record fingerprinting
– Multiple Keyword matching
– Regular expression matching

• What is document fingerprinting about?
– It is a solution to a problem of information retrieval:
• Identify modified versions of known documents
• Near duplicate document detection (NDDD)
– A technique of variant detection for documents
• Extract invariants from variants of digital objects
• Variant detection is a principle with 1-to-many capability

• Problem Definition (a model):
– Let S= { T1, T2, …,Tn} be a set of known texts
– Given a query text T, one needs to determine if there exist at least a
document t ϵ S such that T and t share common textual content
significantly.
• Multiple documents are ranked by how much common content are shared.

• Alternative model:
– Let S= { T1, T2, …,Tn} be a set of known texts
– Given a query text T and X%, one needs to determine if there exist at
least a document t ϵ S such that |T ∩t| /Min(|T|,|t|) ≥ X%
• Multiple documents are ranked by the percentils.

• Solutions
– Liwei Ren & el., US patent 7516130, Matching engine with signature generation
– Liwei Ren & el., US patent 7747642, Matching engine for querying relevant
documents
– Liwei Ren & el., US patent 7860853, Document matching engine using
asymmetric signature generation
• Solution Highlights:
– A document fingerprint is a textual feature that we extract from a given text which is a
sequence of UTF-8 characters
– A single document has multiple fingerprints
– Uniqueness: Any two irrelevant documents should not have common fingerprints
– Robustness: If two documents share significantly common texts, they should have common
fingerprints. In other words, when a document has moderate changes , its fingerprints
should have good probability to survive.
– The key is to identify anchor points within text that can survive text changes. fingerprint
can be generated from its textual neighborhood
– The major part of the solution is a fingerprint generation algorithm.
– Finally, we arrive at a fingerprint based search engine

• How to evaluate a fingerprint generation algorithm?
– Accuracy in terms of false positive and false negative
– Performance
– Small fingerprint size that is required for an endpoint DLP solution
– Language independence

• What is database record fingerprinting about?
– Also known as Exact Match in DLP field
– It is a technique to detect if there exist sensitive data
records within a text.
• Use Case:
– We have several personal data records of <SSN, Phone#, address> that
are included in a text, we want to extract all records from the file to
determine the sensitivity of the file.
• Example: Two data records < 178-76-6754, 412-876-6789, 43 Atword Street,
Pittsburgh, PA 15260> & <159-87-8965, (408)780-8876 , 76 Parkview Ave,
Sunnyvale, CA 94086 > are embedded in text in an unstructured manner.
– Hhghghg 178-76-6754 ggkjkkkkk879-45-6785kjkjjk 43 Atword Street, Pittsburgh,
PA 15260 kllkll 412-876-6789 kjkjjkj 76 Parkview Ave, Sunnyvale, CA 94086
hhjhjhj (408)780-8876 hjhjkjkjjj 159-87-8965hjhjhjhj

• Problem Definition :
– Let S= { R1, R2, …,Rn} be a set of known data records of the same table.
– Given any text T, one needs to extract all records or sub-records from T
while the record cells may appear randomly within the text.
• A solution:
– Liwei Ren & el., US patent 7950062, Fingerprinting based entity
extraction.

• Multiple keyword match and RegEx match
– They are well-known & well-defined problems
– Very useful in DLP data inspection
• Problem Definition for Keyword Match:
– Let S= {K1,K2,…,Kn} be a dictionary of keywords.
– Given any text T, one needs to identify all keyword occurrences from T.
• Problem Definition for RegEx Match:
– Let S= {P1,P2,…,Pm} be a set of RegEx patterns.
– Given any text T, one needs to identify all pattern instances from T.
• Easy problems?
– Not at all. For large n and m, one will have performance issue.
– That’s the problem of scalability.
– Scalable algorithms must be provided.

• Data inspection template and framework
• The 4 different data inspection techniques need to work
together
– To meet various DLP use cases
– Especially, the regulatory compliances.
• For example, PCI needs the following Boolean logic supported
by both keyword match and RegEx match:
– SSN-Entity (2) OR [CCN(1) AND NAME(1) ] OR [CCN(1) AND Partial-Date(1) AND Expiration-
Keyword ]
– That is the PCI data template

• Data template framework:

• DLP rule engine works on top of both DLP models and data
template framework:

Technical Challenges
• Some areas with challenges
– Concept Match
– Data Discovery
– Document Classification Automation
– Determined Data Theft Detection

Summary
• What DLP is about
• DLP models
• DLP systems
• Text Models
• Data template framework with
– 4 data inspection techniques on top of a text model

Q&A
• Thanks for your time
• Any questions?

Overview of Data Loss Prevention (DLP) Technology

More Related Content

What's hot (20)

Viewers also liked (15)

Similar to Overview of Data Loss Prevention (DLP) Technology (20)

More from Liwei Ren任力偉 (20)

Recently uploaded (20)

Overview of Data Loss Prevention (DLP) Technology