Overview

Email has become the most common communication medium for businesses these days, and each organization often deals with a high volume of sensitive information. Sensitive information including financial data (employee salary, credit/debit card details, etc.), personal identification number (social security number), health records, etc., must be shared via email with designated users/teams for various purposes. However, when users do not share them through appropriate mediums or send them to unintended recipients by mistake, the outcome of the sensitive data leak can be unimaginable.

Data Loss Prevention (DLP) is an important security measure to prevent users from sharing sensitive information via email with unintended recipients. Most compliance and regulatory authorities mandate organizations to comply with the industry-specific standards while sharing such sensitive information via email.

DLP in NICeMail Services

NICeMail's Data Loss Prevention (DLP) feature is designed keeping in mind the security of your organization's user data without compromising their privacy. It is the responsibility of each user to understand about DLP and the importance of sensitive data. This is vital to prevent the threat of data leak when users share sensitive information via email.

Protected Identifiers

Protected Identifiers are the list of information types (predefined and custom) which can be associated in a DLP policy to identify whether a sensitive information is shared by users via email and take appropriate action. NICeMail uses Predefined Protected Identifiers and Custom Protected Identifiers and associate them with a DLP policy based on the security requirements.

Predefined Protected Identifiers

The Predefined Protected Identifiers are region specific, and each identifier denotes a specific SIT. When an identifier is associated to a DLP policy, NICeMail scans the emails that match the policy parameters and takes the action defined in the policy (reject the email,  quarantine for moderation, and so on).

Some of the predefined identifiers available in NICeMail are IPv4, IPv6, credit/debit card details, email address detection, etc. Refer to Annexure II for an exhaustive list of country specific predefined identifiers supported by NICeMail.

Custom Protected Identifiers

The requirements to detect a Sensitive Information Type (SIT) might vary from one organization to another as per the industry that the organization belongs to. For organizations working across the world, different SIT might be required based on the local regulatory laws applicable for that region.

For example, the social security identification number will be different in the India when compared to United States of America (the format of the SIT, number of strings associated, etc).

In such cases, NICeMail uses custom protected identifiers with the appropriate confidence levels and the criteria to match (primary element and supporting elements) when a SIT is detected in an email.

Confidence Levels

Confidence Level is one of the measures based on which a DLP policy gets processed whenever an SIT is detected in an email. The three Confidence levels available in NICeMail are:

• Low - When the confidence level is set to Low, the DLP policy will be processed only when the primary element matches the SIT detected in the email.
• Medium - When the confidence level is set as Medium, the DLP policy gets processed only when the primary element and at least one supporting element matches with the SIT defined in the policy.
• High - When the confidence level is High, the DLP policy gets processed only when the primary element and more than one supporting elements match with the SIT detected in the email.

Primary elements

Admins can decide the primary criteria based on which an email content should be scanned to match with their organization's DLP policy. Select the preferred primary element with which you wish to detect a SIT:

Validators

Validators act as another additional check to boost the confidence level of the Custom Protected Identifier whenever "Regex" is chosen as the primary element. NICeMail supports a wide range of information types which can be added as a second level of validation. Refer to Annexure I for more details.

Secondary elements

Secondary elements or Supporting Matches are an additional level of screening with which a SIT within an email can be detected. Adding a supporting match is an optional step. Review the available options and add the secondary element if required.

Adding secondary elements can also be any word that can be matched using regular expressions, a list of keywords, and predefined functions.

Additional checks

The Custom Protected Identifier can be configured to perform additional checks such as "excluding specific values" which are allowed to be shared via email. These can be a SIT but is permitted as per your organization's email policy.

Data Loss Prevention Policy

Admins can create a Data Loss Prevention (DLP) Policy and associate the policy with the users in their organization. The policy can be created either by using a predefined template or create a custom policy from scratch.

Default Policy from Template

NICeMail simplifies the DLP policy creation process by providing predefined policy templates which cater to specific region and the domain in which the industry operates. The available templates are as follows:

• Financial
• Medical health
• Privacy
• Custom

The custom option allows admins to create organization specific Conditions & Actions that are to be processed for each email to ensure that sensitive information type are shared as per the approved norms.

Custom Policies

As an email administrator, you can create policies from scratch using the combination of predefined protected identifiers and custom protected identifiers based on your organization's DLP requirements. The custom policy can be configured based on the type of content and type of protection that you want to provide.