On the DLP audit in one financial company, I saw a classic picture:the system stood, the policies were included, the licenses were paid- and the VIP client manager for three months merged the statementson the accounts through the personal Gmail without a single ailelet.The reason is banal: the policy checked the attachments of the format.xlsx and .csv, and the employee copied the data in the body of theletter. DLP honestly missed everything that did not fall under theattachment pattern. This story is not an exception, but a norm.According to Ponemon/Proofpoint Cost of Insider Threats Global Report2022, the average annual cost of insider incidents reached $15.38million, up 34%, up from 2020. The problem is not the absence of DLP,but how data leak prevention policies are customized.
Most DLP-images companies operate inthe “catched obvious” mode: regulars for bank card numbers,keywords such as “confidential” and blocking USB ports. Tocounter insider threats, this is not enough, because the insider isnot an external attacker. He knows what words trigger the system,what channels are monitored and how to circumvent control withoutviolating formal rules.
Proofpoint in the analysis of theconvergence DLP and ITM (Insider Threat Management) divides theprotection against leakage into three levels, and they must worksimultaneously:
Contentanalysis - what's being told. Thesystem checks the content by digital fingerprints, regularexpressions, keywords, dictionaries. To improve accuracy are usedExactData Match (EDM) is a direct comparison with the reference base,and Indexed Document Match (IDM) is a fingerprinting document.According to Palo Alto Networks, both methods seriously reduce thenumber of false positives compared to naked regex.
Contextualanalysis - under what circumstances istransmitted. Who is the sender, from what device, at what time, towhom is addressed. The same table with the client base is the routinefor the sales manager at 10:00 and the red flag at 23:00 from apersonal device.
Behavioralanalysis (UBA/UEBA) - why does theemployee act like this? The system records deviations from the normalpattern: a sharp increase in the volume of downloaded files,contacting data with which the employee had not worked before,activity in non-working hours.
Only in conjunction, thesethree levels form policies to prevent data leaks that can catch areal insider, and not just a random sending of a file to the wrongaddressee.
Before building policies, it is worth dividingthreats into categories. According to the Virtuelle Groupclassification, typical insider scenarios are divided into fivegroups:
Each script requires its own set of DLP rules. Thepolicy, sharpened only under scenario 3, will miss scenarios 1, 2 and4. I have seen it repeatedly: the security builds protection from the“evil insider”, and the data is leaked through an accountant who“just sent the file home.”
Emailremains the main channel of leaks for one reason: it is legitimate.The employee sends dozens of letters a day, and the task of the DLPis to separate the normal working flow from the exfiltration.Insideric threats through mail are not only investments, but also thebody of the letter, the topic, even the recipient.
By themselves, these templates aresemi-finished. Pattern \b\d{10}\bgenerate thousands of false positives: it will catch any 10-digitnumbers, including order numbers and internal identifiers. Tie regexto the conditions: the recipient's address outside the corporatedomain, the presence in the letter of two or three more sensitivefields (name + account number + amount), sending in non-working time.
Atthe stage of pilot operation, always start with logging. Two to fourweeks in the observation mode will show the real picture: how manytriggers per day, what percentage of false, which units generate themain stream of alerates. Only after calibration, proceed to block. Isaw projects where the blockage was included immediately - a weeklater, the business demanded "turning off this thing."
According to Microsoft Purview Insider RiskManagement, one of the working technicians thesequence detectionDetection of a sequence of actions. Theessence: the DLP-system analyzes not individual events, but chains:
Every individual action can be legitimate. Together,it's an exfiltration pattern. Microsoft Purview allows you tocustomize the sequence detection through Insider Risk Managementpolicies, where such chains automatically increase the user’s riskscore and generate a high degree of seriousness.
Anotheruseful mechanism - cumulative exfiltration detection: thesystem monitors not a one-time shipment, but the total amount of dataper period. An employee who sends one small file to a personal mailevery day will not cause a threshold rule. But cumulative controlwill record that in a month he issued 200 documents. This is how“quiet” extillation works most often.
Microsoft Teams and Slack support native integrationwith DLP. In Teams, Microsoft Purview Information Protection policiesapply to messages in channels and personal chats - you can blocksending messages with sensitive data or replacing content by anotification "message blocked by DLP policy". In Slack,similar features are available through Slack Enterprise Grid with aDLP provider connection via API.
Setting up DLP policy forcorporate messengers is not much different from email: the same regextemplates, the same dictionaries, the same digital prints. Thedifference in speed: in the messenger, the employee expects instantdelivery, and the delay in analyzing the content is even 2-3 secondsperceived as “everything hangs”. This should be taken intoaccount when choosing between inline-blocking and asynchronousanalysis.
With personal messengers, the situation is morecomplicated by an order of magnitude. WhatsApp is using End-to-end(E2E) encryption, the usual Telegram chats - Cell encryption(MTProto), E2E in Telegram is available only in secret chats. At thenetwork level, the SSL inspection can give partial access toweb-version traffic, but Desktop customers with penning pass thecorporate MITM. The main means of control remains the endpoint agent- the DLP component on the workstation.
Endpoint agentintercepts actions before encryption:
The restriction, which you need to talk aboutdirectly: if an employee uses Telegram on a personal smartphone,endpoint agent is powerless. Here only the organizational measurehelps - the prohibition of personal devices to work with corporatedata and control through MDM (Mobile Device Management).
Cloud services are the third critical channel ofleaks. The employee downloads a report on Google Drive “to work athome”, shares the folder on Yandex.Disk for the contractor,synchronizes working files through Dropbox on a personal laptop. Eachof these actions is a potential insider threat, and the DLP systemmust control all three data states in the cloud: data at rest(storage), data in motion (transfer) and data in use (use).
According to the Palo Alto Networksclassification and CrowdStrike, the cloud DLP is implemented in twoways:
API-based- The DLP system connects to the cloud service via the API and scansalready downloaded files. Plus: does not affect productivity, fullaccess to metadata (who created, who was shaken when he changed).Minus: the post-factum works - the file is already in the cloud whenthe system finds it.
Inlinevia CASB/SSE - CloudAccess Security Broker (CASB) or Security Service Edge (SSE)stands a layer between the user and the cloud service. All traffic toSaaS applications passes through CASB, where real-time DLP policiesare applied. Plus: preventive blocking. Minus: Requires trafficredirects (proxy mode or agent) can conflict with a VPN.
A separate headache - Shadow IT. According toCrowdStrike, employees use disapproved cloud services to share fileswithout the knowledge of the IT department. A DLP system on a networkgateway can detect accesses to unauthorized domains: file.io,wetransfer.com, temp.sh. In practice, the allowlist of permittedcloud services is formed, and any access to it generates an alter orblocked.
It is necessary to remember the requirementsFZ-152:if personal data is uploaded to the cloud service, the PD operator isobliged to ensure their confidentiality (St.7 FZ-152) The use of foreign cloud storages for the PD creates additional compliance risks that DLP-policy shouldtake into account by blocking the PD load on foreign sites.
The main enemy of the DLP-adminder is not an insider,but a false trigger. The policy that blocks every third legitimateletter will be disabled by business in a week. According toProofpoint, it is the high level of false positives that is whyorganizations do not transfer DLP from monitoring mode toblock.
Specific methods of reducing falsepositives:
Combine the conditions. Not one regex,but regex + context (external recipient + non-working time + datavolume above the threshold). Each additional condition reduces thefalse positive rate.
Use EDM instead of regex forstructured data. Exact Data Match checks content with a real base(customer table, employee list) rather than an abstract template. Ifyour DLP has EDM support, use it for critical data first.
Createexceptions for business processes. The accountant regularly sendspayment documents with details. The financial department exchangesreports with auditors. For these processes, allowlist rules arecreated: authorized senders -> authorized recipients ->permitted data types. Everything that goes beyond the supply list isan alter.
Calibrate the thresholds. Racing speedsare not set up once and for all. Microsoft Purview documentationrecommends periodically revising the thresholds based on analytics:if 90% of aerates are false - the threshold should be raised. Itsounds obvious, but I’ve seen systems where the thresholds have notchanged since the introduction two years ago.
Why typical DLP policies pass insiders
Most DLP-images companies operate inthe “catched obvious” mode: regulars for bank card numbers,keywords such as “confidential” and blocking USB ports. Tocounter insider threats, this is not enough, because the insider isnot an external attacker. He knows what words trigger the system,what channels are monitored and how to circumvent control withoutviolating formal rules.
Proofpoint in the analysis of theconvergence DLP and ITM (Insider Threat Management) divides theprotection against leakage into three levels, and they must worksimultaneously:
Contentanalysis - what's being told. Thesystem checks the content by digital fingerprints, regularexpressions, keywords, dictionaries. To improve accuracy are usedExactData Match (EDM) is a direct comparison with the reference base,and Indexed Document Match (IDM) is a fingerprinting document.According to Palo Alto Networks, both methods seriously reduce thenumber of false positives compared to naked regex.
Contextualanalysis - under what circumstances istransmitted. Who is the sender, from what device, at what time, towhom is addressed. The same table with the client base is the routinefor the sales manager at 10:00 and the red flag at 23:00 from apersonal device.
Behavioralanalysis (UBA/UEBA) - why does theemployee act like this? The system records deviations from the normalpattern: a sharp increase in the volume of downloaded files,contacting data with which the employee had not worked before,activity in non-working hours.
Only in conjunction, thesethree levels form policies to prevent data leaks that can catch areal insider, and not just a random sending of a file to the wrongaddressee.
Insider is not always an attacker
Before building policies, it is worth dividingthreats into categories. According to the Virtuelle Groupclassification, typical insider scenarios are divided into fivegroups:
- Random error - the employee sent the file to the wrong recipient or invested the wrong document. The most common case, and the most underrated.
- Unauthorized sharing - forwarding working files through personal mail or cloud "for convenience". The motive is not to hurt, but so fast.
- Deliberate data theft - a resigning or offended employee purposefully unloads customer bases, financial reports, IP.
- Leakage during remote operation - personal devices, unsecured networks, copying to USB, screenshots.
- Failure to comply with data processing policies - violation of internal regulations and requirements of FZ-152, including the transfer of PD without the consent of the subject (art. 9 FZ-152).
Each script requires its own set of DLP rules. Thepolicy, sharpened only under scenario 3, will miss scenarios 1, 2 and4. I have seen it repeatedly: the security builds protection from the“evil insider”, and the data is leaked through an accountant who“just sent the file home.”
Setting up DLP-policy for email
Emailremains the main channel of leaks for one reason: it is legitimate.The employee sends dozens of letters a day, and the task of the DLPis to separate the normal working flow from the exfiltration.Insideric threats through mail are not only investments, but also thebody of the letter, the topic, even the recipient.
Basic rules of content analysis
By themselves, these templates aresemi-finished. Pattern \b\d{10}\bgenerate thousands of false positives: it will catch any 10-digitnumbers, including order numbers and internal identifiers. Tie regexto the conditions: the recipient's address outside the corporatedomain, the presence in the letter of two or three more sensitivefields (name + account number + amount), sending in non-working time.
Actions in case of operation
Atthe stage of pilot operation, always start with logging. Two to fourweeks in the observation mode will show the real picture: how manytriggers per day, what percentage of false, which units generate themain stream of alerates. Only after calibration, proceed to block. Isaw projects where the blockage was included immediately - a weeklater, the business demanded "turning off this thing."
Sequence detection: chain of suspicious actions
According to Microsoft Purview Insider RiskManagement, one of the working technicians thesequence detectionDetection of a sequence of actions. Theessence: the DLP-system analyzes not individual events, but chains:
- The employee downloaded 50 files with SharePoint in 15 minutes.
- Renamed files (removed privacy markers from names).
- Sent them by archive to an external email address.
Every individual action can be legitimate. Together,it's an exfiltration pattern. Microsoft Purview allows you tocustomize the sequence detection through Insider Risk Managementpolicies, where such chains automatically increase the user’s riskscore and generate a high degree of seriousness.
Anotheruseful mechanism - cumulative exfiltration detection: thesystem monitors not a one-time shipment, but the total amount of dataper period. An employee who sends one small file to a personal mailevery day will not cause a threshold rule. But cumulative controlwill record that in a month he issued 200 documents. This is how“quiet” extillation works most often.
Control of leaks through messengers
Corporate messengers: Teams, Slack
Microsoft Teams and Slack support native integrationwith DLP. In Teams, Microsoft Purview Information Protection policiesapply to messages in channels and personal chats - you can blocksending messages with sensitive data or replacing content by anotification "message blocked by DLP policy". In Slack,similar features are available through Slack Enterprise Grid with aDLP provider connection via API.
Setting up DLP policy forcorporate messengers is not much different from email: the same regextemplates, the same dictionaries, the same digital prints. Thedifference in speed: in the messenger, the employee expects instantdelivery, and the delay in analyzing the content is even 2-3 secondsperceived as “everything hangs”. This should be taken intoaccount when choosing between inline-blocking and asynchronousanalysis.
Personal messengers: Telegram, WhatsApp
With personal messengers, the situation is morecomplicated by an order of magnitude. WhatsApp is using End-to-end(E2E) encryption, the usual Telegram chats - Cell encryption(MTProto), E2E in Telegram is available only in secret chats. At thenetwork level, the SSL inspection can give partial access toweb-version traffic, but Desktop customers with penning pass thecorporate MITM. The main means of control remains the endpoint agent- the DLP component on the workstation.
Endpoint agentintercepts actions before encryption:
- Monitoring of the exchange buffer - fixes the copy-paste of sensitive data through the messenger window.
- File control - detects drag and attach files to Telegram Desktop.
- Screenshots - some DLP solutions (SearchInform CIB, Solar Dozor) record the contents of the application window.
- Control of input from the keyboard is a controversial method in terms of privacy, but technically working.
The restriction, which you need to talk aboutdirectly: if an employee uses Telegram on a personal smartphone,endpoint agent is powerless. Here only the organizational measurehelps - the prohibition of personal devices to work with corporatedata and control through MDM (Mobile Device Management).
DLPfor cloud services and Shadow IT
Cloud services are the third critical channel ofleaks. The employee downloads a report on Google Drive “to work athome”, shares the folder on Yandex.Disk for the contractor,synchronizes working files through Dropbox on a personal laptop. Eachof these actions is a potential insider threat, and the DLP systemmust control all three data states in the cloud: data at rest(storage), data in motion (transfer) and data in use (use).
Two Approaches to the Cloud DLP
According to the Palo Alto Networksclassification and CrowdStrike, the cloud DLP is implemented in twoways:
API-based- The DLP system connects to the cloud service via the API and scansalready downloaded files. Plus: does not affect productivity, fullaccess to metadata (who created, who was shaken when he changed).Minus: the post-factum works - the file is already in the cloud whenthe system finds it.
Inlinevia CASB/SSE - CloudAccess Security Broker (CASB) or Security Service Edge (SSE)stands a layer between the user and the cloud service. All traffic toSaaS applications passes through CASB, where real-time DLP policiesare applied. Plus: preventive blocking. Minus: Requires trafficredirects (proxy mode or agent) can conflict with a VPN.
Shadow IT: Invisible Clouds
A separate headache - Shadow IT. According toCrowdStrike, employees use disapproved cloud services to share fileswithout the knowledge of the IT department. A DLP system on a networkgateway can detect accesses to unauthorized domains: file.io,wetransfer.com, temp.sh. In practice, the allowlist of permittedcloud services is formed, and any access to it generates an alter orblocked.
It is necessary to remember the requirementsFZ-152:if personal data is uploaded to the cloud service, the PD operator isobliged to ensure their confidentiality (St.7 FZ-152) The use of foreign cloud storages for the PD creates additional compliance risks that DLP-policy shouldtake into account by blocking the PD load on foreign sites.
False Action: How Not to Kill Business Processes
The main enemy of the DLP-adminder is not an insider,but a false trigger. The policy that blocks every third legitimateletter will be disabled by business in a week. According toProofpoint, it is the high level of false positives that is whyorganizations do not transfer DLP from monitoring mode toblock.
Specific methods of reducing falsepositives:
Combine the conditions. Not one regex,but regex + context (external recipient + non-working time + datavolume above the threshold). Each additional condition reduces thefalse positive rate.
Use EDM instead of regex forstructured data. Exact Data Match checks content with a real base(customer table, employee list) rather than an abstract template. Ifyour DLP has EDM support, use it for critical data first.
Createexceptions for business processes. The accountant regularly sendspayment documents with details. The financial department exchangesreports with auditors. For these processes, allowlist rules arecreated: authorized senders -> authorized recipients ->permitted data types. Everything that goes beyond the supply list isan alter.
Calibrate the thresholds. Racing speedsare not set up once and for all. Microsoft Purview documentationrecommends periodically revising the thresholds based on analytics:if 90% of aerates are false - the threshold should be raised. Itsounds obvious, but I’ve seen systems where the thresholds have notchanged since the introduction two years ago.
