Cyber Security Services: Data Loss Prevention Monitoring Overview

Transcription

1 WHITE PAPER: DLP MONITORING OVERVIEW Cyber Security Services: Data Loss Prevention Monitoring Overview Who should read this paper Customers who are interested in using Symantec's Managed Security Services to monitor their Data Loss Prevention solution

2

3 Content Overview Data Loss Prevention Architecture How DLP Monitoring helps to protect customers sensitive data Defining a role and creating a user account Symantec provides true Edge to Endpoint Visibility

4 Overview Symantec Cyber Security Services: Managed Security Services (MSS) minimize the potential business impact of increasingly sophisticated and targeted attacks by reducing the time it takes to detect, assess and respond to security incidents. MSS provides proven security expertise, log retention, and real-time monitoring of network security devices and endpoint protection solutions. Partnering with Symantec an industry leader in managed security services you can build on existing investments in security technologies to create an effective, scalable information security program to improve your security posture. For customers already leveraging MSS for real-time security monitoring, we are pleased to offer monitoring for Symantec Data Loss Prevenetion (DLP). Adding MSS DLP Monitoring helps ensure enterprise-wide visibility by aggregating and correlating DLP Monitor, Protect and Prevent events with network and endpoint security detections to provide: 24x7 analysis and escalation of real-time data loss incidents, Prioritized incidents and elevated severity levels when existing network and endpoint events are correlated with detected data loss This comprehensive approach provides an unprecedented ability to detect and prevent malicious activity, and allows you to focus remediation efforts toward the most critical incidents involving data loss. 1

5 Data Loss Prevention Architecture Symantec DLP has a three-tier architecture: an Enforce Platform, multiple detection servers and multiple remote agents/scanners. All detection and prevention configuration is managed centrally on the Enforce Platform using an intuitive web interface. Please note, Symantec Data Insight is not part of Symantec DLP, but is available as a companion product to monitor file server read and writes as a basis to determine the true data owner. How DLP Monitoring helps to protect customers sensitive data Protecting your company's confidential data is the ultimate goal of Symantec Data Loss Prevention. To ensure the confidentiality of data contained within your DLP incidents as well as meet regulatory compliance requirements, MSS DLP device support was designed to ensure that no sensitive information will be transmitted back to the Symantec SOC for analysis. MSS retrieves DLP logs via a collector that calls the DLP manager s API. This connection requires a user account established and administered by the customer. During the onboarding process, Symantec provides DLP user account configuration recommendations that reinforce data collection control via role-based restrictions, thereby prohibiting the retrieval of sensitive session data (such as data body and attachments) associated with DLP events. Additional information on how customers can configure DLP for MSS monitoring can be found in the Customer Setup Guide for Symantec Data Loss Prevention Security Monitoring, available from your local account team or MSS Service Manager. 2

6 Defining a role and creating a user account Protecting your company s confidential data is the ultimate goal of Symantec Data Loss Prevention. To ensure the confidentiality of data contained within your DLP incidents, the product enforces role-based access control to restrict access for users accessing the Enforce Platform. These controls extend to the reporting API used by Symantec MSS for security monitoring. You must define a role to permit Symantec MSS access to the incidents you require monitored. This role must not permit access to the confidential data itself, only to the metadata describing the incident s business impact. You then create a user account with that role; this is the account used by the Symantec Log Collection Platform. To validate the controls, the customer can create the required role+user and use it to log-in to the DLP Enforce Server and confirm exactly the data it makes available to MSS. They will be able to see the incidents, the names of the policies and rules to which the incident relates and the high-level information about the incident (e.g. subject line of offending , addresses of senders and recipients, file names, etc.). Performing this validation and capturing a record will satisfy an auditor that the data access controls are in-place and tested. 3

7 4

8 View of incident from MSS portal: This screenshot shows a DLP event correlated to an incident. Note that portal users can easily drill down into the actual DLP event log data for more information. In addition, customers receive our SOC analyst's assessement of the incident. 5

9 Viewing the extracted DLP event data for this incident: MSS retrieves DLP logs via a collector that couples with the DLP reporting API to receive, normalize and parse the high-level event information. This model has a number of advantages: 1. Symantec MSS has full access to the incident meta-data required for analysts to handle the incident without requiring logging-on to the customer s DLP console. 2. The customer can directly control exactly what incident data they share with Symantec MSS: guaranteeing that confidential data never leaves their environment. 3. The solution is very efficient, MSS does not use any DLP resources unless there is an event to process In addition, the Symantec DLP plug-in architecture has been used to ensure that every Network Discover and Endpoint Discover incident has a custom attribute containing the IP address of the scanned system. This ensures that Discover incidents can be correlated by the file server or endpoint. Symantec provides true Edge to Endpoint Visibility By correlating network and endpoint detections with data loss events, Symantec Managed Security Services provides the Edge to Endpoint visibility needed to protect your organization from even the most persistent and sophisticated cyber attacks. For more information, visit go.symantec.com/mss 6

10

11 About Symantec Symantec Corporation (NASDAQ: SYMC) is an information protection expert that helps people, businesses, and governments seeking the freedom to unlock the opportunities technology brings anytime, anywhere. Founded in April 1982, Symantec, a Fortune 500 company operating one of the largest global data intelligence networks, has provided leading security, backup, and availability solutions for where vital information is stored, accessed, and shared. The company's more than 20,000 employees reside in more than 50 countries. Ninety-nine percent of Fortune 500 companies are Symantec customers. In fiscal 2014, it recorded revenue of $6.7 billion. To learn more go to or connect with Symantec at: go.symantec.com/socialmedia. For specific country offices and contact numbers, please visit our website. Symantec World Headquarters 350 Ellis St. Mountain View, CA USA +1 (650) (800) Copyright 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, and the Checkmark Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. 10/2014