UNCLASSIFIED Matthew Bruce, Senior Solutions Consultant, Adobe Using Logic, Strategy, and DRM to Protect and Manage Content

UNCLASSIFIED Agenda  Introduction  Digital Rights Management: Authentication / Authorization / Auditing  Why does DRM exist? …a brief history.  How does DRM Work?  Insider Threats / Hackers / Data Leakage and Spillage  Snowden and Manning  OPM Data Breach  AshleyMadison.com  Misuse of Sensitive Materials  Applying DRM  Conclusion

UNCLASSIFIED Introduction: Matthew Bruce  Solutions Consultant at Adobe Systems  20+ Years in DoD:  Intelligence Community (NSA, DIA)  DoD (Pentagon, DISA)  Army.mil, BrainLine.org, IASE.Disa.mil  SIGINT Analyst / CryptaAnalyst, US Army

UNCLASSIFIED Why does DRM exist? …a brief history. Digital Millennium Copyright Act (DMCA) Music Industry Movie Industry Gaming Industry

UNCLASSIFIED ACL Digital Rights Management: Authentication / Authorization / Auditing CMS Shared Drive File System Data Repository Websites Media Storage Print Download Server Dedicated Networks Safes Mobile Screen Capture

UNCLASSIFIED Digital Rights Management: Authentication / Authorization / Auditing DRM: A set of technologies to protect and control content/data at rest and in motion. Document ID & Authenticated User  Read  Print  Modify  Validity Period  Accessibility  Revoke  Sign  Offline  Copy DRM Solution / System

UNCLASSIFIED Digital Rights Management: Authentication / Authorization / Auditing  Prove you are who you say you are:  PKI- CAC/PIV  LDAP/Active Directory  SSO  SAML  Kerberos  User Name Password  Invited User  Anonymous  Tie into Identity Manager

UNCLASSIFIED Digital Rights Management: Authentication / Authorization / Auditing  A DRM Server acts as a Policy Enforcement Point (PEP) and the Policy Decision Point (PDP)  Can pull from other services to determine authorization:  External Authorization Provider  Active Directory  Webservices  Database Lookup  A DRM server can act as the PEP and connect with an External Authorization Service Provider as the PDP Dynamically controlled by server One policy per document Can use external authorization provider Revocation: Policy level Document level Policy Uses: 1.Protection 2.Version Control 3.Tracking Only 4.Time-based Dynamically controlled by server One policy per document Can use external authorization provider Revocation: Policy level Document level Policy Uses: 1.Protection 2.Version Control 3.Tracking Only 4.Time-based

UNCLASSIFIED Digital Rights Management: Authentication / Authorization / Auditing

UNCLASSIFIED PKI User ID Employee # LDAP/AD Documents Downloads s Portals Devices NOUN (Notification Of Unusual Nuances) TimeUserEventPlace 07:001234TabletDC 08:001234TurnstileDC 08:151234LoginDC 08:301234Doc openOCONUS 08:311234Doc printOCONUS #events=50 Distance=far Credential=low assurance 3 As | Auditing: Correlation—Continuous Monitoring PEOPLE THINGS PLACES Rooms & Buildings IP address Subnets GeoIP

UNCLASSIFIED Insider Threats / Hackers / Data Leakage and Spillage Insider Threats: Snowden and Manning Both had access to sensitive content Both intentionally stole and distributed sensitive content Both had clearances Uncontrolled distribution of content is on-going… Repercussions are on-going…

UNCLASSIFIED Insider Threats / Hackers / Data Leakage and Spillage Hackers: OPM Data Breach Content not protected or encrypted Once content was stolen, no control over content Uncontrolled distribution of content is on-going… Repercussions are on-going…

UNCLASSIFIED Insider Threats / Hackers / Data Leakage and Spillage Hackers: AshleyMadison.com Content not protected or encrypted Once content was stolen, no control over content Uncontrolled distribution of content is on-going… Repercussions are on-going…

UNCLASSIFIED Insider Threats / Hackers / Data Leakage and Spillage General Misuse of Sensitive Content Content Leakage not intentional Misunderstood policy and common work-arounds Content not protected or encrypted Once content is stolen, no control over content Uncontrolled distribution of content is on-going… Repercussions are on-going…

UNCLASSIFIED Insider Threats / Hackers / Data Leakage and Spillage Network / System Security Content / Data at rest and in motion Security

UNCLASSIFIED Applying DRM: Evaluation Guide for Protection & Monitoring Recommended features to consider: Strong FIPS140 Suite B encryption (AES256) Cross-platform (Windows, Mac, iOS, Android) Multi-format (PDF, Office, CAD, custom) Ubiquitous Client Dynamic policy (change after publishing, including revocation) Continuous monitoring (advanced auditing) Automation ready (bulk automated encryption) Customization ready (client SDK, Server SPIs) Strong authentication sources (multi-domain LDAP, AD, SSO, PKI) Cloud-friendly (private and FedRAMP managed service)

UNCLASSIFIED Conclusion  Digital Rights Management: Authentication / Authorization / Auditing  Why does DRM exist? …a brief history.  How does DRM Work?  Insider Threats / Hackers / Data Leakage and Spillage  Snowden and Manning  OPM Data Breach  AshleyMadison.com  Misuse of Sensitive Materials  Applying DRM