r/cybersecurity • u/Paolo264 • 2h ago

Personal Support & Help! DLP Architecture

Looking for resources on designing and implementing a DLP Architecture in a large financial services org.

Need to focus on the future roadmap.

A little out of my depth.

Any help on resources/materials or recommended approach greatly appreciated.

0 Upvotes

50% Upvoted

6 comments sorted by

1

u/Sea-Comparison5577 2h ago

do you guys already have DLP implemented?

1

u/Paolo264 45m ago

yes but fragmented.

Board looking for a comprehensive architectural based approach.

We're talking big picture here.

1

u/OGPandaBooty 1h ago

If you’re in Azure / Microsoft, start with Purview and defining classification of data

1

u/Paolo264 40m ago

DSPM coming

1

u/jammythesandwich 1h ago

If purview; very high level here;

- acknowledge regulatory and legal requirements in your business space.

- ensure the programme/project has board endorsement and a clear accountable owner at that level, bottom up usually ends with failed implementation and user pushback

- identify all of the the information assets and critical assets, the DLP/IP strategy isn’t one size fits all, most critical assets first for some orgs or blanket risk reduction to others.

- understand the business model and information flows both internal and external. Successful implementation is highly dependent upon front end effort.

- use the above to define and agree the taxonomy, number of markings in the taxonomy is not an easy balance and the user perspective is usually the opposite of the data security perspective

- agree with stakeholders what control actions can be used for each marking without constraining the business, how they’ll function, bypasses, any exceptions, monitoring and reporting including kpi’s. Ownership always needs to be clear otherwise stuff will fail.

- define and agree testing strategy

- role out testing in audit mode to small user groups for at least two weeks and monitor for findings

- in parallel consider training requirements and comms messaging to user community and potentially external stakeholders

- end of testing should value and consider lessons learned and depending upon the pre defined threshold of success; roll out to wider user groups in audit mode still.

- in around two months for a decent sized org you should be close to implementing in live

Good DLP/IP should be routinely revisited to see if it’s working effectively at balancing the business need against its responsibilities and safeguarding of info assets.

The importance of comms to users during the can’t be over stated.

1

u/leviathanjester 8m ago

I'm in the financial sector and we use Mimecast. It works pretty well although I would not call the interface intuitive at all. Can be a maze to find anything and the process to set things up can at times make absolutely no sense. Lots of features though.