Understanding Risk-Adaptive Protection in DLP

The Main Driver of DLP Adoption

In the last few decades, data has consolidated its position as an organization’s most valuable asset. Hence, measures to protect it such as data loss protection (DLP) solutions have been essential to an organization’s security strategy. Increasing data regulations, higher customer demand for data protection and technological advancements in the form of cutting edge tools like automation have led to significantly higher DLP adoption over the years, seen by a DLP market CAGR of 21.3% according to KBV Research.

However, the main reason for DLP adoption is the increasing number of data breaches year-on-year. An independent study sponsored by Apple claimed that breaches reached an all-time high in the first 9 months of last year, so having an effective DLP solution in your arsenal is a must. But the truth is, not all DLP solutions are created equal. The most effective ones focus on the biggest threat to your data – your people, because 74% of data breaches are caused by human error.

Shifts in Security Strategy

A few years earlier, security strategies were focused on building higher walls around your network perimeter. But after the advent of cloud computing and the organizational culture shift precipitated by the pandemic, your people are now situated far beyond those walls.

In fact, it wouldn’t be erroneous to state that your people are now your security perimeter. They are out there in their remote working environments, accessing organizational data in their personal devices using IP addresses not provided by IT. That scenario, in itself, is highly risky for your data.

But then, consider this. Your people want to do their job in the fastest way possible. Any kind of security measure that inhibits their productivity is just another excuse to break the rules, further risking your data.

So, for a long time, organizations were left with two options when it came to their security strategy, neither of them ideal:

• Being cautious: To avoid data leak incidents, organizations put up restrictive policies that may have curbed threats, but also curbed productivity.
• Being carefree: In the goal of empowering employees to reach maximum productivity, minimal security policies are enforced, and those being enforced are often incorporated after a breach occurs.

Companies were left reeling from a trade off between being too proactive and too reactive. But, surely there has to be a middle ground, where preventing threats and responding to them becomes a lot more streamlined. The key to finding this middle ground is to find the context behind all the actions of your people (and machines) with your data. But to understand context, one must understand behavior. And understanding behavior is the key component to understanding why risk-adaptive protection (RAP) is so essential for your DLP solution.

RAP is a behavior-based data security model that focuses on your people and how they interact with your data. Using these insights, your DLP solution can secure data at any point of access. By being able to identify, quantify and proactively respond to any data risk, you are both protecting your enterprise and freeing it up to do as much as it can in terms of productivity.

This dual benefit is what gives risk-adaptive protection its edge amongst other DLP solutions. Traditional DLP struggles to differentiate between legitimate and risky data usage, leading to excessive alerts and false positives. The behavioral aspect of RAP helps mitigate this through real time data protection and adaptive data security measures. This leads to a more proactive approach through constant analysis & calculation of risk.

Additionally, traditional DLP placed a lot of emphasis on IOCs (indicators of compromise) that indicate intrusion, in itself a reactive measure. Risk-adaptive DLP focuses on IOBs (indicators of behavior), that is, all the actions likely to lead to a data breach. We offer a DLP solution from industry leader Forcepoint, which measures over 100 different IOBs. Some of these IOBs include IOB 711 for Screen Capture, IOB 511 for usage of a personal email, and IOB 265 for usage of a personal printer.

Let’s take a lot at how risk-adaptive protection works in terms of its methodology:

• Setting a baseline: To truly detect anomalous activity, a baseline for normal data usage, access and location is established for every member of your organization. Any behavior straying from these norms is immediately put on alert and dealt with.
• Building risk profile: Once baselines are established, real time tracking occurs for all user actions. Here, seemingly disparate interactions are all taken cumulatively and accounted for in individual risk profiles.
• Adaptive security: Initial DLP assessments recognize the most sensitive data in your organization. Subsequent policies focus on areas where the risk is most, allowing more data freedom in places where the risk is low.
• Automated responses: The fallout of breaches get worse with delayed response. We use automation to set up quick reactions to high-level alerts, blocking the particular interaction when a breach is perceived to be imminent.

All of these benefits are dependent on a single factor that forms the crux of a risk-adaptive protection strategy – a risk score. Every entity in your organization (which also includes machines in the case of VMs) is given a risk score from 0-100, with level thresholds between 1 to 5. Level 5 is a score that is 80+ and absolutely trending towards a breach. Once this score is reached by a user, automated responses are activated that immediately block any further action.

To explain this to you in further detail, let’s use a real world example. Let’s take the example of Ankita, one of the HR employees in your organization, and reflect on her activities over a two month period:

• On Day 1, she downloads a file that contains sensitive data related to her roles and responsibilities, specifically a document that details all the payroll transactions conducted in the last month. Nothing suspicious here, so her risk score stays at a low Level 1 range.
• On the same day, she sends the document from her work email to her personal email. The risk is upped to Level 2, but there is an acknowledgement that this could be her normal work practice and might not lead to a breach. That being said, all her subsequent actions are kept under constant alert.
• 30 days pass, and nothing else happens from her end. Her risk score gradually decreases with every passing day.
• On Day 35, she downloads a flurry of other payroll related files at one go. The system wonders what use she could be having for all these files, all at once, so immediately upgrades her to Level 3 security.
• On the same day, she copies all these files to a personal pen drive. Something clearly suspicious is happening here, so she is moved to Level 4, and any subsequent actions from her end are to be immediately blocked. At this stage, your infosec team is well aware of Ankita’s actions and are advised to approach her at once.
• Finally, on the next day, when Ankita tries uploading these files to a personal cloud from her laptop at home, this action is clearly blocked and no data breach occurs.

This meticulous approach can provide great value for organizations looking to effectively safeguard their data. Here are all the benefits of risk-adaptive DLP:

• Continuous monitoring of real-time events and behaviors
• Immediate detection of potential data breaches or policy violations
• Proactive incident response that uses automation to swiftly & effectively respond to detected incidents, minimizing potential damage
• Advanced threat intelligence that harnesses real-time feeds and empowers your security teams to stay one step ahead of potential risks
• Adaptive mechanisms that adjust strategies on the fly based on the emerging threat landscape
• Stringent policy enforcement, allowing you to stay in compliance with regulatory requirements

But, ultimately, since risk-adaptive DLP focuses on tangible metrics and scores, all these benefits help you stay secure by improving on these key metrics:

• A decreased mean time to detect, enabling better prevention
• A decreased mean time to respond, enabling better mitigation from data leaks should they ever occur
• Immediate time-to-value through its frictionless deployment, allowing your organization to quickly justify your initial investment

Our DLP solution is in partnership with Forcepoint, the pioneers when it comes to risk-adaptive protection. Along with constant monitoring of 100+ IOBs, Forcepoint’s DLP solution has 1700+ out-of-the-box policies that ensure comprehensive data protection, regardless of the industry you operate in. Click here to adopt a risk-free approach to data security, with no compromises on productivity!