Découvrez comment mettre en place un programme de protection des données efficace

À l’ère où les vols massifs de données personnelles font constamment les manchettes, toutes les entreprises sont à risque, et ce, peu importe leur budget. Une approche combinant des ressources humaines, des processus et des outils doit être privilégiée afin de réduire l’exfiltration et la divulgation de données.

Bien que nous ne sommes pas les propriétaires de l’actif, notre rôle de fiduciaire est de gérer et assurer la confidentialité des ressources informationnelles. Lors de cette allocution, nous allons proposer des façons de faire pragmatiques pour la protection de l’information nominative et stratégique.

Transcript

1. © 2020 Forcepoint 10 mars 2020
2. © 2020 Forcepoint Découvrez comment mettre en place un programme de protection des données efficace Benoît H. Dicaire Architecte sénior de solutions — Est du Canada
3. Benoît H. Dicaire Architecte sénior de solutions — Est du Canada Consultant indépendant • Accompagnement ~ 120 mandats • Gestion par intérim ~ 5 Expert technique reconnu • (ISC)2 2006 – 2017 • PRMIA 2013 – 2015
4. © 2020 Forcepoint © 2020 Forcepoint 2,750+ Employees 14,500+ Customers Cloud-first Hybrid-ready Converged security 4 Forcepoint is the world’s leading user and data protection company
5. © 2020 Forcepoint What’s up ?
6. © 2020 Forcepoint 6 Focus on preventing data breaches across channels Printers Cloud Chat SaaS Email Collaboration 3rd Party Hardware USBs 53
7. © 2020 Forcepoint Identification and mitigation before the breach is critical Negligence External attack Insider threat $100-$500M Fine forecasted by Morgan Stanley $100M+ / 5 Years Cost and effort needed to build software $700M / $1.4B Fine / litigation costs July 2017 Q4 2018 Mar-Apr 2019 Apr 2017 May 2017 2015-2016 Jan 2019 July 2017 July 2019 Mar 2019 Sept 2017 Aug 2019 July 2019 July 2019 7
8. © 2020 Forcepoint © 2020 Forcepoint
9. © 2020 Forcepoint • Responsible for securing data throughout its lifecycle, from creation to destruction • Protecting data throughout its 3 states: in-motion, in-use, and at-rest • Preventing Data Exfiltration from organizational assets Data Protection Team 9 Does anyone know or have met organizations with a dedicated Data Protection team?
10. © 2020 Forcepoint Roles and responsibilities 10 50% Remediation / 30% Response (tuning) / 20% Projects How is it different from other teams? • It deals with how data is being handled and managed within the ecosystem • Blue, red and purple security teams focus on information systems attacks • Other duties as assigned: everything that operations doesn’t do What technologies should a Data Protection team be responsible for? • Data Loss Prevention, CASB, encryption • Data governance, Identity and Access Management, Insider threat
11. © 2020 Forcepoint 11 2. PROTECT Review incident management process based on information provided by DLP scanning and monitoring activities to reduce alerts fatigue Discover data locations and identify sensitive data including metadata • Cardholder data (PCI) • Intellectual property (IP) • Personally identifiable information (PII), and Protected health information (PHI) Update DLP protection rules • Quality assurance of current rules based on information gathered • Update rules to prevent and block data exfiltration Monitor ingress and egress channels for restricted content • Manage an exclusion list of users handling sensitive data with a legitimate purpose • Develop SLA to respond to user request to send sensitive data 3. IMPROVE On going communications • Communicate with stakeholders on a regular basis including the IT help desk • Update the security awareness and user education program Setup advanced protection rules on data at rest, in use, and in motion • Endpoints, applications, storage servers, networks, and egress points Update the information security management components • Acceptable Use policy, and corporate security & privacy policies • Information technology and security directives, processes, and procedures Continuously update knowledge, tools, and techniques • Train the stakeholders with a formal curriculum • Share information with your peers and Computer Emergency Rescue Teams 1. INSPECT Ensure that information security management components are aligned with the data loss prevention program Review data classification, and Identity & Access Management (IAM) • Setup automated data classification, third party tool integration, and labeling Monitor sensitive information flowing across channels • Update data flow documentations based on observed data behaviors • Update security controls on endpoints, applications, servers, and networks Setup DLP rules and only notify users of potential violations • Monitor activities and potential major security incidents • Identify lessons learned related to false positive and negative
12. © 2020 Forcepoint Easy to explain with non-technical staff Shows what channels are in scope Segmented sensitive data categories (w/ exceptions) What classifiers fit into each data category Risk level of violation Intended response action Data classification vs categorization vs business rules 12
13. © 2020 Forcepoint How effective is your data protection program ? 13 There is no single correct approach for constructing and organizing DLP policies. The key is to remain consistent. MONITOR-ONLY MODE • Single layer of policies applied to all users • Duplicate or overarching rules • Unfamiliarity of DLP features and common classifiers • Minimal usage of custom classifiers or action plans BLOCKING MODE • Policy application by region or Business Unit • Proper use of policy levels & exceptions • Rules & exceptions granularly controlled based by channel • Use of advanced features, such as file or database fingerprinting
14. © 2020 Forcepoint Risk = Threat x Vulnerability x Consequence ?
15. © 2020 Forcepoint © 2020 Forcepoint 15 Next steps on your path to human-centric cybersecurity Participate in a briefing at our Boston Cyber Experience Center Engage in a workshop with our executive security strategists Conduct a demonstration with your technical team
16. © 2020 Forcepoint © 2020 Forcepoint Merci David Caron Regional sales Manager— Est du Canada David.Caron@Forcepoint.com 514 271-5799 Benoît H. Dicaire Architecte senior de solution— Est du Canada Benoit.Dicaire@Forcepoint.com 514 718-0002