Data Loss Prevention

 View Only
Back to discussions
Expand all | Collapse all

How to Keep track of who accessed the Confidential data via DLP

  • 1.  How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 03, 2012 04:19 AM

    Hi ,  I need the reply very urgently as my mgmt. is aksing . Is it Possible to keep track of a Confidential File via DLP.Keeping track means ,who accessed it ,who read it and who modified it .



  • 2.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 03, 2012 04:22 AM

    HI,

    Auditing/Monitoring of User Activity in DLP

    https://www-secure.symantec.com/connect/articles/a...

     

    Check this thread

    https://www-secure.symantec.com/connect/forums/how-track-personal-information-symantec-dlp



  • 3.  RE: How to Keep track of who accessed the Confidential data via DLP

    Trusted Advisor
    Posted Dec 04, 2012 02:15 AM

    Hi

     audit log will allow you to know who downloaded confidential file from DLP system or who open incident which contains this file. But if you want to keep track of all action performed on a confidential file, you will need an other system to do so as DLP did not control file activity until someone try to copy/sent it outside of your organisation. DLP discover server (use for data at rest) are able to give you information of who create a file and who last modify it (std windows info) but usually it is not enough for what you want to do.

     

     "Varonis" has a nice tool to do this kind of tracking on file activity (i am sure there is also some other tool but this is the one i use more frequently so i let other people giving you other possibilities).

     

     Regards



  • 4.  RE: How to Keep track of who accessed the Confidential data via DLP

    Broadcom Employee
    Posted Dec 04, 2012 02:53 AM

    once the appropriate policy is configured the incident will show all the information who voilated the policy.



  • 5.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 05, 2012 07:36 AM

    Yes DLP to track of who accessed the Confidential data via DLP but it will not fulfill all your req.like who read it and who modified it .It will give u who accesed and where it has been sent out/tranferred. for getting more detail you should implements data insights supplementary componentof DLP with data ownere dature enable and DRM technolgy.

     



  • 6.  RE: How to Keep track of who accessed the Confidential data via DLP

    Broadcom Employee
    Posted Dec 05, 2012 08:50 PM

    endpoint discover can get to know about the files, integration with DI will give better picture.



  • 7.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 06, 2012 12:23 AM

    Hi shybhani,

     

    Symantec Data Insight helps organizations solve the problem of identifying data owners and responsible parties for information in spite of incomplete or inaccurate Symantec Proprietary and Confidential
    metadata or tracking information. This helps support large-scale busines owner-driven remediation processes and workflows.
     
    Data Insight can provide the following information:
    ■ Who owns the data
    ■ Who is responsible for remediation
    ■ Who has seen the data
    ■ Who has access to the data
    ■ What data is most at-risk
    ■ Frequency of usage of data
     
    About audit logs
    Symantec Data Insight collects and stores access events from file servers and SharePoint sites. These access events are used to analyze the user activity on various files, folders, and sub-folders for a given time period. The audit logs provide 
     
    detailed information about:
    ■ Users accessing the file or folder
    ■ The file type
    ■ The access types such as:
    ■ Read
    ■ Write
    ■ Create
    ■ Delete
    ■ Rename
    ■ Security Event - The security event is logged when the access control entries
    of a file or folder are changed. This event helps to identify who changed
    the permissions.
     
    For more details find the Symantec Data Insight User's Guide reference. I am sure above will answer all required query that you have asked

     



  • 8.  RE: How to Keep track of who accessed the Confidential data via DLP

    Broadcom Employee
    Posted Dec 06, 2012 01:13 AM

    DI mentions who owns the file, who last viewed , edited .



  • 9.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 18, 2012 02:57 PM

    Pete,

     

    you bring up a very valid point... most people do not buy DI (data insight) when talking DLP.

    DI is a tool with tremendous power, properly configured it will giv eyou wa weatlh of knowledge on the use and access fo the file(s) you are working with on a incident for DLP.



  • 10.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Dec 18, 2012 09:09 PM

    Recommend to use data insight to capture all these information.



  • 11.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Feb 09, 2013 01:59 AM

    Can someone explain the components of a DLP Suite .While going for dlp solution ,we were not told about DLP Insight .is it a plugin or separate product .It will be helpful if some one can explain or mention all the DLP related products avaialble from Symantec .



  • 12.  RE: How to Keep track of who accessed the Confidential data via DLP

    Posted Feb 09, 2013 04:36 AM

    Hi Subhani,

    As u asked about Data Insight, please find details followed by below links

    https://www-secure.symantec.com/connect/blogs/new-release-symantec-data-insight-301

    https://www-secure.symantec.com/connect/videos/sa-b12-symantec-data-insight-improve-unstructured-data-governance-through-insights-data-owner

    https://www-secure.symantec.com/connect/videos/sm-b13data-insight-improve-unstructured-data-governance-through-insights-data-ownership-and-u

    https://www-secure.symantec.com/connect/videos/improve-data-governance-symantec-data-insight

    I am sure now u will get answer of ur query

     



  • 13.  RE: How to Keep track of who accessed the Confidential data via DLP

    Broadcom Employee
    Posted Feb 09, 2013 04:50 AM

    these are integrations for DLP. Like you can integrate EV , SMg, CCS along with the DLP.

    You contatct the Symantec partner or sales for more information on this.