Which DLP Tasks to Automate – and Which to Do Manually

Just this week, the news broke that a poorly-secured AWS server exposed over 10 million hotel reservation logs from Cloud Hospitality websites, putting the information of millions of guests at risk. As of June 2020, more than 3.2 million consumer records have been exposed in the ten biggest data breaches this year. Organizations in virtually every industry struggle to get data loss prevention (DLP) right due to one big misconception about this important cybersecurity practice. Many organizations believe that DLP requires significant internal resources to implement and at least 18 months to start seeing ROI. These myths may be preventing a hotel, for instance, from protecting their valuable PII with DLP technologies and processes.In reality, most data loss prevention steps can be done automatically using cloud-based tools like Nightfall. Here are the DLP steps that require manual effort – and the many more that can be completed using a cloud-native DLP platform.

Which DLP processes should you do manually? 

Strong data loss prevention involves a combination of tools and policies. And, depending on which DLP tool you choose, some will require more manual set-up and implementation than others. Nightfall is a cloud-native DLP platform, meaning there are no agents or software to install, patch, manage, or update. Our platform integrates directly with your SaaS and data infrastructure products (e.g. Slack, GitHub, Confluence, etc.) via their native APIs.Some aspects of DLP, however, are unique to every organization and therefore should be managed by your IT team.

Assign user roles

User roles govern who can access platform features and functionality, both in your work tools (like Slack and Google Drive) and in your DLP technology. User permissions in Slack, for instance, include three types of administrative roles and three types of non-administrative roles. Each role comes with its own abilities to see, share, and manage content.Proactively managing user permissions is the first step to improving your data security within a platform. Your IT team needs to decide who should have access to which documents, folders, and channels and close-out old accounts as needed.At the same time, user roles need to be assigned within any DLP technology that you intend to implement. Who is in charge of reviewing threat monitoring reports? Who is in charge of responding to security alerts? Who can access detailed threat reports? These are decisions that must be made by your organization to improve data loss prevention.

Implement a DLP policy

Great data loss prevention includes both tools and procedures. The procedures should address one of the biggest vulnerabilities in an organization –insider threat. Insider threat is any action from an employee that compromises the security of an organization’s cloud systems.A DLP policy provides a roadmap for educating users in your company to recognize any attempts to compromise data security. Your policy will also drive the adoption of DLP technology to monitor and protect your system. DLP tools can automate scans of your cloud platforms to search for data leaks before they happen –but only you and your IT security team can provide the education necessary to prevent user error from happening.

Remediate instances of data loss

Nightfall gives you the ability to respond to and quickly remediate instances of data sharing or data loss that may represent a security risk to your organization. One of the biggest benefits of a DLP tool is its ability to quickly alert your security team to an issue. But, most tools still require that your IT team address the malicious or inadvertent activity directly.

Which DLP processes can you automate? 

A cloud DLP solution like Nightfall specifically discovers, classifies, and protects personally identifiable information (PII), protected health information (PHI), other unique identifiers, and credentials and secrets. And, one of the key benefits of Nightfall is that it utilizes machine learning to automate much of the DLP process.

Classify your data 

Data classification involves parsing files and/or strings of data to properly categorize the data found within structured or unstructured data sources. When done accurately, this process allows you to determine the content and context of the data your organization uses and stores. It also enables your organization to make actionable insights regarding what to do with its data and how to secure it. Nightfall’s DLP solution makes data classification automatic and highly accurate, so you'll eliminate time spent tagging data manually and reduce time spent reviewing false positives and grappling with alert fatigue. Machine learning detectors are trained to identify common types of PII across SaaS and IaaS environments. This allows our platform to both account for context and improve the accuracy of our detection and classification capabilities –saving your team tons of time (and headaches).

Automated vulnerability scanning

Machine learning also boosts Nightfall’s automated vulnerability scanning capabilities. Our tool uses machine learning-based detectors to automatically scan cloud environments for sensitive data. Each detector is specially trained to identify a unique token type –and Nightfall utilizes 100+ machine learning detectors for all types of personal information, secrets, keys, and credentials, as well as custom token types. Set custom keywords to find terms that are inappropriate for work, and scan for messages or files that contain those keywords. Nightfall can even scan unstructured data: customer chat logs, JSON objects, application logs, spreadsheets, PDFs, images, screenshots, and more.

Defend against insider threat

Training your employees can take you only so far when it comes to mitigating the risks of insider threat. If someone is determined to expose your data, the best response is a strong set of automated alerts and custom actions to prevent the data from leaking outside the organization.With Nightfall, you can delete messages that contain information that could lead to a data breach, such as API keys and credentials, PII like credit card numbers, or protected health information (PHI) like medical record numbers. Set up automatic notifications to let users know when they share data in unsafe ways across your cloud applications. Nightfall provides a way to establish granular rules with our policy engine; and, use our developer platform to set up custom detectors to scan any SaaS or IaaS platform. Any piece of data that needs protecting is covered with Nightfall. Schedule a demo at the link below to see how Nightfall automates some of the most time-consuming aspects of data loss prevention.