Defined Categories of Service 2011 - Cloud Security Alliance

CLOUD SECURITY ALLIANCE SecaaS | DEFINED CATEGORIES OF SERVICE 2011
Category #2: Data Loss Prevention
Description: Data Loss Prevention is the monitoring, protecting, and verifying the security of
data at rest, in motion and in use both in the cloud and on-premises.
DLP services offer protection of data usually by running as some sort of client on desktops /
servers and running rules around what can be done. Where these differ from broad rules like
“No FTP” or “No uploads” to web sites, etc. is the level to which the services understand data.
A few examples of policies you can specify are “No documents with numbers that look like
credit cards can be emailed,” “Anything saved to USB storage is automatically encrypted and
can only be unencrypted on another office owned machine with a correctly installed DLP
client,” and “Only clients with functioning DLP software can open files from the fileserver,”
etc.
Within the cloud, DLP services could be offered as something that is provided as part of the
build, such that all servers built for that client get the DLP software installed with an agreed set
of rules deployed.
Class: Preventative
CORE FUNCTIONALITIES
Data labeling and classification
Identification of Sensitive Data
Predefined policies for major regulatory statues
Context Detection Heuristics
Structured Data Matching (data-at-rest)
SQL regular expression detection
Traffic Spanning (data-in-motion) detection
Real Time User Awareness
Security Level Assignment
Custom Attribute Lookup
Automated Incident Response
Signing of Data
Cryptographic data protection and access control
Machine readable policy language
OPTIONAL FEATURES
Rate domains
Smart Response (integrated remediation workflow)
Automated event escalation
Automated false positive signature compensation
Unstructured Data Matching
File / directory integrity via hashing
Integration with Intrusion Detection Systems
Multiple Language Pack
Data privacy
Chain of evidence services to support investigations and
prosecutions
Continued on the following page…
SERVICES
Includes: Encryption, Meta-data
tagging, Data Identification, Multilingual
fingerprinting, Data leakage
detection, Policy management and
classification, Transparent data
encryption, Policy controlled data
access, storage and transportation,
Dynamic data masking
Related Services: IAM
Related Technologies and Standards:
SAML, SPML, XACML,
(MOF/ECORE), ESG
Service Model: SaaS, PaaS
THREATS ADDRESSED
Data loss/leakage
Unauthorized access
Malicious compromises of data
integrity
Data sovereignty issues
Regulatory sanctions and fines
Copyright © 2011 Cloud Security Alliance 10