Email Data Loss Prevention and the Windows Server 2008 R2 File Classification Infrastructure

This is a copy of a blog I wrote jointly with Microsoft.  It can be viewed on the Microsoft Windows Server WebLog at

http://blogs.technet.com/windowsserver/archive/2010/02/25/prevent-loss-of-sensitive-information-using-the-windows-server-2008-r2-file-classification-infrastructure.aspx

 

There has been a lot of talk lately about data breaches costing organizations millions of dollars in fines or lawsuits not to mention the bad publicity and other intangible losses.  Data Loss Prevention products are being deployed to try to help organizations minimize these types of incidents. Information classification can be used to prevent data breaches and help organizations with compliance requirements such as PCI, HIIPA, ISO 27001, the Massachusetts Data Protection Law 201 and other similar legislation.

 

The new File Classification Infrastructure (FCI) in Microsoft Windows 2008 R2 enables organizations to protect data by automatically classifying files and applying policy. FCI includes the ability to define classification properties, automatically classify files based on location and content, and invoke file management tasks such as file expiration and custom commands based on classification. Once the files have been classified, appropriate security can be applied based on the business value of the information.  For example, in a PCI environment, FCI based classification can be used to identify files that contain sensitive credit card information, and in a health care environment, FCI based classification can identify files with private health information.  Once the files have been classified file management tasks can be used to segment sensitive files onto more secure storage devices, to protect files with encryption, and to assign more restrictive permissions to the files. This helps ensure that information stored on file servers is well secured. 

 

Another concern is email.  Email messages or email attachments are a security risk as email cannot easily be controlled.  At Titus Labs  we’ve extended classification and information protection to the Microsoft Outlook environment. Titus Labs Message Classification can recognize file attachments that have been classified using FCI.

 

The Titus Labs solution can examine the FCI classifications of Microsoft Office attachments, and can apply policy that can restrict the distribution of sensitive information.  Titus Labs’ Safe Recipient policies can be used to:

 

1. Protect the distribution of email within an organization. By examining all the recipients of an email, the Titus Labs policy can verify via Active Directory whether the recipient is allowed to receive attachments of a given classification. This prevents inadvertent data loss by warning the user that one of the recipients should be removed. For example, in an internal scenario, a financial organization may want to ensure that an employee in corporate finance is restricted from sending files classified as MERGER / ACQUISITION to another employee working as a broker or trader.

2. Protect the distribution of email outside the organization. By examining the domain of each of the recipients, the Titus Labs policy can verify that the domain is listed as trusted in the policy and can warn the user of a possible data breach and warn them or force them to change the recipient list. In the following example, the sender has mistakenly selected the wrong Anne Hollingsworth at an external address. The sender receives a warning because the email contains an attachment that has been classified as CONFIDENTIAL / INTERNAL USE.

 

 
Invalid recipient is detected based on classification

This is an example of the power of classification to protect your sensitive information.