DCAP systems are often considered as an additional package to DLP solutions for classifying files and monitoring data access policies. Others argue that the DCAP system is a standalone product that can challenge the DLP solutions when it comes to data protection capabilities, including preventing data leaks.
DCAP: basic tool for ensuring protection of corporate data
Before building a comprehensive information protection system, implementing a DLP systems or taking other measures, it’s required to deal with the basic task – obtain and classify all confidential and valuable data, which is kept in the corporate infrastructure and configure access rights to this data. To deal with this task it’s necessary to implement a DCAP system. DCAP class solutions are recommended by renowned analysts, including Gartner experts. DCAP class systems enable file processing management and content monitoring and perform audits of all company’s data and its storage facilities. This functionality ensures proactive protection of corporate data and helps to comply with regulatory requirements.
Under the hood of the DCAP
The workflow of the DCAP system has several stages.
- Data-Centric Audit and Protection solution collects information about data from all storages and analyses it.
- DCAP system classifies files in storage to find sensitive data that must be protected.
- DCAP systems distribute access right to the protected files according to the type of data they contain.
One of the most important things for DCAP systems is the method of data classification. An audit can be content-based or attribute-based. Let me illustrate the difference between the two approaches with a simple example.
Let’s imagine storage with DWG blueprints. The basic DCAP system will prevent access to DWG files for all users, except the “Engineers” group, to prevent misuse and potential data leaks. The same result can be achieved if security specialists forbid access to the particular folder for all non-engineer users. Nonetheless, such restrictions can be bypassed if one of the allowed users copies a sensitive file outside of the permitted folder or changes the file extension. Also, sensitive information will not be protected if an insider takes a screenshot of the DWG blueprint. As a result, the basic DCAP system won’t be capable of ensuring the data’s safety.
More advanced content-based DCAP systems, like FileAuditor by SearchInform, analyse file content. Thus, getting back to our example with the DWG file, the solution will recognise that the DWG file and its screenshot have the same content and will mark the new file with the same label as the original blueprint. This label is embedded in the file structure and can’t be removed by simply changing the file’s extension, moving it to another directory or changing other attributes.
Therefore, DCAP solutions form the security foundation for the safety of data storage and processing.
Practice of data protection with DCAP
Task No1. Protection of personal data. This priority task is quickly becoming obligatory to comply with for more and more organisations and companies (including SMBs) due to the adoption of data protection related regulatory acts. With the help of the DCAP system, information security (IS) specialists will always know how many records of PII the company has, where these records are kept, and who has access to such records. Advanced solutions ensure secure access rights to this information.
Case study: During the trial of FileAuditor the customer IS specialist detected a critical risk. Results of audit for PII revealed that some users kept photos of the UAE ID and other sensitive PII on their corporate workstations. The problem was that according to the job responsibilities, most of the users didn’t require such information. Based on the performed audit, numerous copies of the files were obtained as well. The IS specialist performed data classification, deleted all unaccounted copies and reconfigured access rights to personal data. The access to personal data was allowed only for those users who required access to PII due to their job duties.
That’s how the process of redistribution of access rights to confidential data via FileAuditor looks like from IS specialist perspective.
Implementation of advanced DCAP system helps to deal with the critical task of ensuring compliance with regulatory requirements. Numerous regulations are firstly aimed at ensuring protection of personal details. The list includes, but isn’t limited to – GDPR, SAMA, PDPL, DCC and others. In order to efficiently deal with this task and simplify the IS specialist work process, the solution must be equipped with plenty of pre-sets for data classification and protection. For example, FileAuditor is equipped with 400+ such presets.
Example of preconfigured templates for classification of PII, implemented in FileAuditor by SearchInform.
Task No2. Ensuring protection of internal documentation and trade secrets. Data is the crucial asset of any business. Firstly, I mean such types of data as customer database, know-how, technical drawings, agreements & financial documents, market research. With the help of advanced DCAP solution, an IS specialist obtains all files, referring to these categories and ensures their protection. With the help of FileAuditor IS specialist can redistribute access rights the way only legitimate users can process the file. A user, who doesn’t have legitimate rights to work with the file simply can’t open or process the file.
That’s how the blocking of illicit processing of file looks like from the user’s perspective.
For example, there’s no need for software developers to have access to accounting documents and invoices. Thus, IS specialist can configure prohibition for these groups of employees to process such types of documents. Simultaneously, specialists of accounting department, due to their job duties have to process these documents, and IS specialist allows them access to this information. More flexible configuration is available as well – for example, all employees of accounting department can work with payment documents, but only the CEO and Chief Accountant have access to financial reports.
What’s more, FileAuditor keeps records of user actions with data and creates file copies, what enables to recover the information in the required version, in case of both accidental and malicious file damage. You may request a free 30-day trial of FileAuditor to evaluate the system workability and its usefulness for your business.
Case study: With the help of FileAuditor prevented dangerous information security incident. IS experts detected that accountant department employee used to forge financial documents, which were kept on the file server. Subsequently, these edited documents would be transmitted to the tax authority. This would lead to the penalty of tens of thousands of AED. With the help of FileAuditor it would be easy to recover documentation in the demanded version (before any amendments were made to them). However, timely interference in the process prevented the incident, thus, the company saved time and money, which otherwise would be spent on paying the fine and dealing with the legal consequences.
360° data protection – integration of DCAP and DLP
When businesses grow and expand, companies get the opportunity to allocate larger budgets for IS-related issues. The time comes to ensure full-scale information protection. To achieve this goal, it’s required to implement DLP system and integrate it with DCAP solution. What does such an integration ensure?
- DCAP system ensures security of data at rest, while the DLP will secure data in motion.
- DCAP solution manages access rights to files for employees, while the DLP prevents data leaks outside of the company.
- DCAP tool protects files; DLP protects any data.
If an advanced DLP system is integrated with a DCAP system, the customer gets the full-scale protection of corporate information assets. DCAP ensures protection of data-at-rest, while DLP protects data-in-motion and prevents cases of corporate fraud. Briefly speaking, the integration of these two systems ensures compliance with data-centric and user-centric approaches simultaneously. It’s the ideal scenario if the customer integrates solutions by the same vendor. Such a platform ensures seamless integration, management via single console and maximum efficiency.
Outcome: DCAP as security foundation
Advanced DCAP systems analyses files not based on their external attributes, which can be easily changed, but based on the file content. Such a protection tool isn’t just a niche product – it can easily become the foundation of IS protection of an SMB, which has to ensure protection of PII; or become the basic IS protective solution in an organisation which is striving to ensure protection against basic tasks of data leak prevention, but faces limitations in budgets, allocated to IS-related tasks.
As the business expands, the customer who has a DCAP system implemented, can integrate it with a DLP into the single platform. As a result, the first system will ensure protection of data at rest and the second system will protect data in motion. Accordingly, the closer the integration interaction between these means of information protection, the higher the efficiency of such a construction will be.
