Information Social Access Mapping: Who is doing what with data? Dan Jennings March 2016 Veritas Partner Technical Account Manager +44 (0)7590 003199 Veritas Technologies LLC   Office: +44 (0)7590 003199 Email address: dan.jennings@veritas.com

Information Ownership Identification Including Inferred Ownership

Identify Data Owners Anyone can do this bit. 3

Rule-based Inference of Data Owners with Custom Attribute Mapping This is far more difficult. Veritas has unique capability here. How many owners of information are “Root” or “Administrator”, or even people that have long left the organisation? Address that with inferred ownership 4

Tracking Users

Track User Activity for Investigations or Audit The Audit Log feature of Data Insight and how it delivers detailed usage information. To find out what Archie accessed and when he accessed it, the Data Insight user can [Click] click on Audit Logs to get detail down to the file level. On this screen, the Data Insight user has navigated to one of the files within the Patent folder after determining that Archie had accessed the patent folder. Data Insight is showing who accessed one of the .doc files in the Patent folder. You can infer from the graph that Archie was reading and writing this folder during the month of October, and below that you can see a detailed log by user of the activity on that file. Data Insight lets you sort the log by Read, Write, Create, Rename and Delete. The investigator now has the information they were looking for regarding who was accessing sensitive data – now they are interested in finding out why someone like Archie, who didn’t work in the legal department had access to that folder.

Archiving Integration Copyright © 2015 Symantec Corporation

Archive Orphan Folders DO - inactive/orphan data sets -> send automatically to EV - policy-based (types of files, age, owner) - EV FSA; SharePoint next Expiration policy: - ownership classification (data in HR category, Delete or move to the cloud Chargeback Symantec Propietary and Confidential SYMC CONFIDENTIAL

Archive by Type Another policy type to archive by. Layer the policies. Symantec Propietary and Confidential 9 9

Archive Custodian Data Symantec Propietary and Confidential 10 10

Archive for Retention Symantec Propietary and Confidential 11 11

Data Loss Prevention Integration Copyright © 2015 Symantec Corporation

Policies to Proactively Monitor Sensitive Data Usage Monitor activity to data Select folders or use DLP classification Alert if activity exceeds threshold Monitor activity of users Alert if user activity deviates from baseline Symantec Data Insight 4.0

Social Network Map: Secure Collaboration Clean up screenshots Detect outliers among users Reduce risk from excessive access permissions

Data Loss Prevention View: Incident and Data Owner Objective of Slide Explain the key benefit of Data Insight with an actual use scenario using a screen shot for illustration. Script Here’s an example of how you can use Data Owner ID to help clean up sensitive data as part of a Network Discover scan. Any time an file is found as part of a Network Discover scan, an incident snapshot is generated in Enforce. This incident snapshot captures all relevant information about an incident so it can be efficiently remediated. We’re looking at an incident snapshot that was generated from a Network Discover scan. This is an example of the type of scans many of our customers perform – they’re looking to find and clean up credit card data out on shared file systems in order to comply with PCI (Payment Card Industry – Data Security Standard ) rules. This incident violated the Credit Card detection rule that we had set up in Enforce. If you look at Incident Details over on the left side of the screen, you see a lot of useful information including where the file is located [Click] Name of the document [Click] File Owner [Click] and the name of the machine where it was found [Click] Notice that the file owner is listed as BUILTIN\Administrators – this is the information that’s been pulled from the file meta data and is pretty typical. Most files are owned by the Administrator – unfortunately, this does not reveal the real owner. That’s where Data Insight comes in. Notice on the right side of the screen in the Attributes section – you see in the lower section a datainsight section. When an incident is created, Enforce asks Data Insight to name the most frequent user of this file – multiple users can be listed and ordered in frequency of access. [Click] The data user or multiple data users are listed in the incident , and an AD user name is listed as the Data Owner. Now that the data owner can be positively identified, the next step is to begin remediation with Network Protect [Click] Remediation buttons for 1 Click Smart Responses– Save time and effort by creating a single command that combines multiple remediation responses and status changes that are specific to your company’s procedures and workflow to ensure consistent remediation for an incident type (“Escalate”, “Launch Investigation”, “Notify Manager” etc.) The benefit of Network Discover, Data Insight and Network Protect is that they enable organizations to quickly find exposed confidential data wherever it is stored, understand who owns the data , and take steps to notify the owner or fix it automatically. Discovery Questions/Competitive Traps What is your process to identify where all your unsecured, outdated or redundant data is stored and who owns it? Do you have an upcoming audit or compliance deadline? Trap: Finding data owner is key to fixing stored confidential data, and typically the meta data is not sufficient. You need a solution like Data Insight to identify ownership by usage. John Smith Data Insight Symantec Data Insight 4.0

Case Study Large Financial Services Company Remediates Open Shares Background Goals Data Insight Benefits Focus on securing unstructured data Where to start? How to remediate? NetApp, Windows, SharePoint (1PB+) Key benefit: Facilitate investigations for malicious activities Discover Open Shares, Review ownership/activity analysis to drive lockdown without disruption Prioritize DLP scans based on Open Shares report; Identify data owners Identify complex shares, data owners and active departments Identify hotspots or unusual spikes in activity; Data clean-up by type Reduce Open Shares Risk Sensitive Data Clean-up File Shares Consolidation Storage Remediation ok

Dan Jennings +44 (0)7590 003199 dan.jennings@veritas.com

Strategy for Information Management 1 Discover 2 Report and Recommend 3 Execute Policy – Archive & eDiscovery 4 Execute Policy – Data Loss Prevention 5 Execute Policy – Information Delivery