search menu icon-carat-right cmu-wordmark

Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources

Technical Note
In this report, the authors present methods for controlling removable media devices in a MS Windows environment.
Publisher

Software Engineering Institute

CMU/SEI Report Number
CMU/SEI-2013-TN-002
DOI (Digital Object Identifier)
10.1184/R1/6574457.v1

Abstract

Removable media, such as universal serial bus (USB) flash drives, present unique problems to the enterprise since insiders can use such media to remove proprietary information from company systems. Insiders may do this for legitimate reasons, such as to work on material at home, or they may do so for malicious reasons, such as to steal intellectual property.

Organizations must establish and implement effective methods and processes to prevent unauthorized use of removable media while still allowing users with a genuine business need to access and remove such media. In addition, organizations should establish sound methods to track critical electronic assets so that they may better protect them.

This report focuses on the theft of intellectual property using removable media, in particular, USB devices. We present methods to control removable media devices in a Microsoft Windows environment using Group Policy within an Active Directory environment. We also explore OpenDLP, an open source tool for identifying where sensitive data resides on organizational systems.

Cite This Technical Note

Silowash, G., & King, C. (2013, January 1). Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources. (Technical Note CMU/SEI-2013-TN-002). Retrieved May 19, 2024, from https://doi.org/10.1184/R1/6574457.v1.

@techreport{silowash_2013,
author={Silowash, George and King, Christopher},
title={Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources},
month={Jan},
year={2013},
number={CMU/SEI-2013-TN-002},
howpublished={Carnegie Mellon University, Software Engineering Institute's Digital Library},
url={https://doi.org/10.1184/R1/6574457.v1},
note={Accessed: 2024-May-19}
}

Silowash, George, and Christopher King. "Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources." (CMU/SEI-2013-TN-002). Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, January 1, 2013. https://doi.org/10.1184/R1/6574457.v1.

G. Silowash, and C. King, "Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources," Carnegie Mellon University, Software Engineering Institute's Digital Library. Software Engineering Institute, Technical Note CMU/SEI-2013-TN-002, 1-Jan-2013 [Online]. Available: https://doi.org/10.1184/R1/6574457.v1. [Accessed: 19-May-2024].

Silowash, George, and Christopher King. "Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources." (Technical Note CMU/SEI-2013-TN-002). Carnegie Mellon University, Software Engineering Institute's Digital Library, Software Engineering Institute, 1 Jan. 2013. https://doi.org/10.1184/R1/6574457.v1. Accessed 19 May. 2024.

Silowash, George; & King, Christopher. Insider Threat Control: Understanding Data Loss Prevention (DLP) and Detection by Correlating Events from Multiple Sources. CMU/SEI-2013-TN-002. Software Engineering Institute. 2013. https://doi.org/10.1184/R1/6574457.v1