GDPR and email compliance

[ghockin]

Afternoon everyone.

 

One of the GDPR related projects have recently been tasked with is attempting to mitigate the risk of confidential data leaving the college via email. To this end Ive been using the Data Loss Prevention component built into both Exchange 2013 and Office 366. I have a rule setup in both which scans all email leaving college for a certain subset of confidential information such as national insurance number or Bank account details. We then receive a warning that the email has been sent. which is then followed up with the member of staff.

 

We are looking to move toward a moderation system whereby instead of a warning we get an moderated approve / reject for the email and we can choose to release the email if the hit is a false positive.

 

Is anyone else doing this / looking into doing this?

[JATSO]

Afternoon everyone.

 

One of the GDPR related projects have recently been tasked with is attempting to mitigate the risk of confidential data leaving the college via email. To this end Ive been using the Data Loss Prevention component built into both Exchange 2013 and Office 366. I have a rule setup in both which scans all email leaving college for a certain subset of confidential information such as national insurance number or Bank account details. We then receive a warning that the email has been sent. which is then followed up with the member of staff.

 

We are looking to move toward a moderation system whereby instead of a warning we get an moderated approve / reject for the email and we can choose to release the email if the hit is a false positive.

 

Is anyone else doing this / looking into doing this?

 

I wonder if this could be done with GMail? does anyone know?

[Arthur]

I wonder if this could be done with GMail?

G Suite for Education is getting DLP very soon...

 

http://www.edugeek.net/forums/cloud-services/192523-new-security-features-coming-g-suite-education.html

 

Data Loss Prevention (DLP) for Drive and Gmail gives admins greater control and visibility in protecting their sensitive school data, and the ability to protect users from accidentally sharing confidential information externally. G Suite’s DLP protections include a library of predefined content detections to make setup easy and advanced capabilities such as OCR recognition of content stored in images.

 

One big disadvantage to DLP in Office 365 is that it can't OCR documents like Google does with the G Suite DLP.

 

https://office365.uservoice.com/forums/289138-office-365-security-compliance/suggestions/32668342-dlp-needs-to-be-able-to-read-ocr

 

At the present time DLP is not able to read OCR documents, namely documents scanned to PDF. This is a GIANT, GAPING hole in terms of security. I have clients who have 100's of thousands of documents that contain sensitive information saved in OneDrive but no DLP policies can be applied to these documents, since DLP is not OCR aware. Please correct ASAP! Thanks!

[enjay]

scans all email leaving college for a certain subset of confidential information such as national insurance number or Bank account details

 

I trust those are just examples, as the sensitive information we're sending is very rarely NI numbers or bank details. I'd be interested to know what specific terms you are actually scanning for though.

 

Of course, this should only be part of the solution, and staff training is key. What you're trying to mitigate against here is accidental transfer of sensitive information - if someone actively wants to get something out, they will.

 

Related to this, I quite like Google Mail's recent addition of a flag when you are replying to someone outside your organisation, as it highlights the potential risk (hopefully making people think about it for all emails) and tells you if you were copied on an external email without realising.

[manick]

Hi Ghockin,

 

I am going through the same process as you and trying to figure out all of the settings in DLP and Azure Information protection policy. I'm at the moment at the point of trying to figure out what fits where and how they work together, for instance whether when we protect documents in Word 2016 it carries over to OneDrive. It's a slow process as I find MS information very hard to pin down.

 

Enjay, the terms Ghockin was referencing are in the default DLP settings.

 

Cheers

 

Manick

[enjay]

I've just gone looking for DLP in our G Suite, and can't find it. https://blog.google/topics/education/tools-every-school-g-suite-education-updates/ says I should have it, but the corresponding help page https://support.google.com/a/answer/6321530?hl=en says it is Enterprise only. What am I missing?

 

Ignore that - I've just found it. The help file I was looking at was about Drive, not Mail!

Edited February 1, 2018 by enjay

[enjay]

Right, now I've found where the DLP settings are on email, what kind of triggers are people considering adding and what actions if those trigger conditions are met?

[tj2419]

I've just gone looking for DLP in our G Suite, and can't find it. https://blog.google/topics/education/tools-every-school-g-suite-education-updates/ says I should have it, but the corresponding help page https://support.google.com/a/answer/6321530?hl=en says it is Enterprise only. What am I missing?

 

Ignore that - I've just found it. The help file I was looking at was about Drive, not Mail!

 

When you say found it do you mean DLP is live on your gsuite domain or you've found out it's coming soon as i cannot find it on ours.

 

Thanks

[enjay]

When you say found it do you mean DLP is live on your gsuite domain or you've found out it's coming soon as i cannot find it on ours.

 

Thanks

 

I mean it is live and I've found the setting. Apps > G Suite > Gmail > advanced settings > scroll down to "content compliance" > click configure

[fiza]

I mean it is live and I've found the setting. Apps > G Suite > Gmail > advanced settings > scroll down to "content compliance" > click configure

 

I thought DLP was only for G Suite for Enterprise?

 

https://support.google.com/a/answer/6280516?hl=en

[enjay]

I thought DLP was only for G Suite for Enterprise?

 

https://support.google.com/a/answer/6280516?hl=en

 

This says otherwise... https://blog.google/topics/education/tools-every-school-g-suite-education-updates/ Maybe they are rolling it out to education?

[Arthur]

I thought DLP was only for G Suite for Enterprise?

https://blog.google/topics/education/tools-every-school-g-suite-education-updates/

 

New security features coming to G Suite for Education

These new features will bring valuable security tools to the 80 million teachers and students who rely on G Suite for Education, at no additional cost:

 

• Data Loss Prevention (DLP) for Drive and Gmail gives admins greater control and visibility in protecting their sensitive school data, and the ability to protect users from accidentally sharing confidential information externally. G Suite’s DLP protections include a library of predefined content detections to make setup easy and advanced capabilities such as OCR recognition of content stored in images.
  

 

Also posted in post #3.

Edited February 2, 2018 by Arthur

[fiza]

https://blog.google/topics/education/tools-every-school-g-suite-education-updates/

 

 

 

Also posted in post #3.

 

If that is the case then I don't think it's live yet as content compliance has always been there. I can't find anything that actually says DLP in the console.

[Arthur]

If that is the case then I don't think it's live yet as content compliance has always been there.

Google only announced DLP for education. It might be while until it's actually available in G Suite.

 

I checked the release calendar and it doesn't show up there yet.

[fiza]

Google only announced DLP for education. It might be while until it's actually available in G Suite.

 

I checked the release calendar and it doesn't show up there yet.

So what's the difference between saying it's announced for education and being available in G Suite for education? I thought it was one and the same.

[Arthur]

So what's the difference between saying it's announced for education and being available in G Suite for education? I thought it was one and the same.

The difference is similar to how new Chromeboxes get announced in a press release but aren't actually available to buy until later in the year. Or Google saying they are working on improving sharing in Team Drives, but don't give an ETA.