How to Keep track of who accessed the Confidential data via DLP

Created: 03 Dec 2012 | 12 comments

Subhani

Hi , I need the reply very urgently as my mgmt. is aksing . Is it Possible to keep track of a Confidential File via DLP.Keeping track means ,who accessed it ,who read it and who modified it .

Discussion Filed Under:

Security, Data Loss Prevention (Vontu), Installing, Tip/How to, Troubleshooting

Login or register to post comments
Comments RSS Feed

Comments 12 Comments • Jump to latest comment

ManishS

How to Keep track of who accessed the Confidential data via DLP - Comment:03 Dec 2012 : Link

HI,

Auditing/Monitoring of User Activity in DLP

https://www-secure.symantec.com/connect/articles/a...

Check this thread

https://www-secure.symantec.com/connect/forums/how-track-personal-information-symantec-dlp

Thanks In Advance.

Manish

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

stephane.fichet

How to Keep track of who accessed the Confidential data via DLP - Comment:04 Dec 2012 : Link

audit log will allow you to know who downloaded confidential file from DLP system or who open incident which contains this file. But if you want to keep track of all action performed on a confidential file, you will need an other system to do so as DLP did not control file activity until someone try to copy/sent it outside of your organisation. DLP discover server (use for data at rest) are able to give you information of who create a file and who last modify it (std windows info) but usually it is not enough for what you want to do.

"Varonis" has a nice tool to do this kind of tracking on file activity (i am sure there is also some other tool but this is the one i use more frequently so i let other people giving you other possibilities).

Regards

pete_4u2002 Symantec Employee

How to Keep track of who accessed the Confidential data via DLP - Comment:04 Dec 2012 : Link

once the appropriate policy is configured the incident will show all the information who voilated the policy.

Cheers!
Pete

Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619

K S Sharma

How to Keep track of who accessed the Confidential data via DLP - Comment:05 Dec 2012 : Link

Yes DLP to track of who accessed the Confidential data via DLP but it will not fulfill all your req.like who read it and who modified it .It will give u who accesed and where it has been sent out/tranferred. for getting more detail you should implements data insights supplementary componentof DLP with data ownere dature enable and DRM technolgy.

pete_4u2002 Symantec Employee

How to Keep track of who accessed the Confidential data via DLP - Comment:05 Dec 2012 : Link

endpoint discover can get to know about the files, integration with DI will give better picture.

Cheers!
Pete

Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619

K S Sharma

How to Keep track of who accessed the Confidential data via DLP - Comment:05 Dec 2012 : Link

Hi shybhani,

Symantec Data Insight helps organizations solve the problem of identifying data owners and responsible parties for information in spite of incomplete or inaccurate Symantec Proprietary and Confidential

metadata or tracking information. This helps support large-scale busines owner-driven remediation processes and workflows.

Data Insight can provide the following information:

■ Who owns the data

■ Who is responsible for remediation

■ Who has seen the data

■ Who has access to the data

■ What data is most at-risk

■ Frequency of usage of data

About audit logs

Symantec Data Insight collects and stores access events from file servers and SharePoint sites. These access events are used to analyze the user activity on various files, folders, and sub-folders for a given time period. The audit logs provide

detailed information about:

■ Users accessing the file or folder

■ The file type

■ The access types such as:

■ Read

■ Write

■ Create

■ Delete

■ Rename

■ Security Event - The security event is logged when the access control entries

of a file or folder are changed. This event helps to identify who changed

the permissions.

For more details find the Symantec Data Insight User's Guide reference. I am sure above will answer all required query that you have asked

pete_4u2002 Symantec Employee

How to Keep track of who accessed the Confidential data via DLP - Comment:05 Dec 2012 : Link

DI mentions who owns the file, who last viewed , edited .

Cheers!
Pete

Help Link: http://www.symantec.com/business/support/overview.jsp?pid=54619

stumunro Partner Accredited

How to Keep track of who accessed the Confidential data via DLP - Comment:18 Dec 2012 : Link

Pete,

you bring up a very valid point... most people do not buy DI (data insight) when talking DLP.

DI is a tool with tremendous power, properly configured it will giv eyou wa weatlh of knowledge on the use and access fo the file(s) you are working with on a incident for DLP.

huan.zhou Partner Accredited

How to Keep track of who accessed the Confidential data via DLP - Comment:18 Dec 2012 : Link

Recommend to use data insight to capture all these information.

Subhani

How to Keep track of who accessed the Confidential data via DLP - Comment:08 Feb 2013 : Link

Can someone explain the components of a DLP Suite .While going for dlp solution ,we were not told about DLP Insight .is it a plugin or separate product .It will be helpful if some one can explain or mention all the DLP related products avaialble from Symantec .