Data Loss Prevention (DLP)

DLP works through a combination of best practices in planning and security. By monitoring, detecting, and blocking, DLP capability helps identify and prevent potential data breaches and unauthorized transmissions. This can occur while sensitive data is in motion (DLP tools monitor network traffic), at rest (DLP facilities monitor data storage volumes), or in use DLP (capabilities monitor endpoint actions). Using DLP's ability to monitor all three elements proactively, users can help prevent unauthorized access or the transfer of protected information. 

Although data loss and leakage can lead to data breaches, they're technically two different categories of events. With data loss, the data is gone and may not be recoverable or accurate following a misplaced or stolen flash drive or a ransomware attack. On the other hand, data leakage involves sensitive information moving between critical systems—usually systems of records. Data leakages can occur when data flows into complementary systems without the same level of data protection. 

Data loss prevention works to detect and prevent sensitive data from leaving the network, and data leakage prevention ensures similar data protection levels are applied across multiple systems where data may be transmitted.

DLP strategy allows users to monitor, detect, and receive alerts on activity, especially for sensitive data. This activity may match data exfiltration patterns, specifically emphasizing activity indicative of unauthorized data access. DLP capability provides critical visibility into many potentially problematic factors, from insecure configurations and potential system compromises to abnormal activity and insider threats. This visibility also helps reduce incident response time and helps with compliance.  

DLP can monitor changes made in Active Directory and the file server, focusing on user-initiated events and recording security-related activity across the network. Malicious activity is associated with higher occurrences of these events, mainly if they occur in unusually short periods. DLP tools allow users to track changes across the network.  

Since DLP tools proactively send alerts if they detect this activity, they’re often the fastest way to stay abreast of unauthorized changes. DLP's capability also provides reporting to meet compliance and auditing requirements, allowing you to identify areas of weakness and anomalies for forensics and incident response. 

SolarWinds^® Access Rights Manager (ARM) helps ensure proper data security standards and prevent insider threats by giving you insight into user permissions, settings, and activity. 

This DLP tool's broad range of security functions and capabilities allows users to automate access rights management, analysis, and enforcement processes. ARM provides critical visibility into Active Directory by monitoring and auditing changes based on who made the changes and when. Paired with the robust notifications system in ARM, users can stay updated regarding unauthorized access or changes made to Windows file servers. ARM helps prevent internal security threats by analyzing privileged user credentials and group memberships. 

ARM's easy-to-use dashboard and alerting system visualize file server permissions to provide quick insights into changes made to sensitive data. 

Related Tools:

• SolarWinds Observability Self-Hosted & Security Observability
• Security Event Manager
• Patch Manager
• Identity Monitor

Related Features:

• Cybersecurity Risk Management
• Access Management System
• Active Directory Management Tool
• Automate User Account Management
• SAP Monitoring Tool
• OneDrive Permissions Monitoring
• OneDrive Group Policy Access Change Monitoring
• NTFS Permissions Report Tool
• NTFS Permissions Management
• Account Takeover Prevention
• Compromised Credentials