Thread by @bettersafetynet

Have a DLP solution? Want to **REALLY** make it actually... useful?

Scan the endpoints for sensitive info. You'll get a report with the data on that host.

Work with risk and legal to assign any arbitrary point value to this sensitive info.

1

Example:
PCI data is 5 points per record
PII is 3 points per record
PHI is 10 points per record

Note: your points will be based on your orgs concern over exposure of each record type. Don't let anyone else tell you what points you should use. You're measuring your risk

2

Now calculate the total risk points per endpoint. Get ready for some shocks!

There are some tools that do this already, but now you have a fancier DLP risk report tool.

Here's what almost nobody does though... :-)

3

The daily (or weekly) DLP scan is now a core metric and has... implications.

First thing:
this risk score is a alert criticality multiplier in your SIEM. Oh, the CEO's laptop got hit? Not ideal, but they also got PM who has ALL THE DATA?!?! Jump on that first!

4

Even better though is this:

"you're getting this email as a warning. you have too much sensitive info on your endpoint. If you do not check in some data you will..."

This is what I call the "protection curve"
5

The protection curve is an increasingly strict set of defensive protections for the endpoint. As you accrue points, your system automatically gets protected more.

This makes sense because we're in *infosec* we have to protect that info!
6

An example curve may look like this:
level 1 - normal endpoint
level 2 - endpoint can only go to expected sites/trusted business partners
level 3 - no web access
level 4 - no external email
level 5 - no more data checkout until some is checked in.

customize to fit your need
7

The final perk of using DLP like this is you should also use it to drive DFIR efforts. No not alerting... the legal side.

When systems with XYZ data get hit, you have different reporting timelines. Use that to help drive the SLAs for your IR efforts.
8

Say regulation X has a mandatory breach notification time of 72 hrs. You need to be able to verify the breach, do all internal procedures for systems with this data.

Now... look at all the assets with that data. Can you do that for all of them? That fast?
9

I've been on the record for saying "DLP solutions are only good for sitting in a corner and making sad panda noises."

That's still true if you think a DLP will do what the vendor marketing team claims.

Use this thread for ways to make your DLP not suck.

Fin.