Abstract
The financial institutions provide the resources to protect their sensitive data and information by trying to prevent unauthorized leakage. They approve policies and realize technical restrictions to block the loss and revelation of sensitive data and information by external attackers as well as careless insiders. One example of Data Loss Prevention (DLP) restrictions consists of endpoint protection solutions to block data transmissions to USB storage devices. Nevertheless, financial institutions approve exceptions to these policies, based on the business need for the specific user, in order to be able to fulfill their job-related tasks. But from these exceptions derive the following questions: How an approval for an exception can create impact over the risk of data leakage for the financial institution? What is the particular risk for according an individual user a confident exception? This paper introduces a new concept to risk depending on exception management, which will provide the financial institution to assign exceptions derived from on basic DLP. Initially, the paper presents an approach for evaluating and classification users based on their access to sensitive data and information, and afterward, a standard of rights is decided for assigning exceptions to derive from the classification of users, which allows specific approvers to prepare knowledgeable decisions concerning exception requests.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
Tomsitpro. http://www.tomsitpro.com/articles/threat_management-utm-it_security-it_certification-infosec,2-473.html. Accessed 15 Oct 2017
Radwan, T., Yousef, S.: Data leakage/loss prevention systems (DLP). NNGT J. Int. J. Inf. Syst. (2014)
Shabtai, A., Elovici, Y., Rokach, L.: A Survey of Data Leakage Detection and Prevention Solutions. Springer, New York (2012)
Gugelmann, D., Studerus, P., Lenders, V., Ager, B.: Can Content-Based Data Loss Prevention Solutions Prevent Data Leakage in Web Traffic? IEEE Security Privacy (2015). ISSN 1540-7993
Chitchyan, D.R.: Detecting and Preventing Data Exfiltration (2014). www.cpni.gov.uk/documents/publications
Tischer, M., Durumeric, Z., Foster, S., Duan, S., Mori, A., Bursztein, E., Bailey, M.: Users really do plug in USB drives they find. In: Proceedings of the 37th IEEE Symposium on Security and Privacy (S&P 2016), San Jose, California, USA, May 2016
Silowash, G.J., Lewellen, T.B.: Insider Threat Control: Using Universal Serial Bus (USB) Device Auditing to Detect Possible Data Exfiltration by Malicious Insiders (2013)
Reed, B., Kish, D.: Magic Quadrant for Enterprise DLP. Gartner, Inc. (2017)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 Springer International Publishing AG
About this paper
Cite this paper
Karamani, B. (2018). Improving Data Loss Prevention Using Classification. In: Barolli, L., Xhafa, F., Javaid, N., Spaho, E., Kolici, V. (eds) Advances in Internet, Data & Web Technologies. EIDWT 2018. Lecture Notes on Data Engineering and Communications Technologies, vol 17. Springer, Cham. https://doi.org/10.1007/978-3-319-75928-9_16
Download citation
DOI: https://doi.org/10.1007/978-3-319-75928-9_16
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-75927-2
Online ISBN: 978-3-319-75928-9
eBook Packages: EngineeringEngineering (R0)