Artificial Intelligence Enables Next-Gen Data Loss Prevention

welcome to see cast everybody i'm cs caraval from zk research and i'm back for another thought leadership video uh i'm your host and i'm joined by meinl khan vp of product management for z scanner mono why don't you say hi to everybody and just tell us how you're doing thank you zeus thanks for having me i appreciate it um hello folks my name is moinol khan i'm vp of products at z scalar responsible for all things data protection i've been with the company for about three years now uh before zscaler i've been spending i would say last 20 years focusing on data protection and data breaches worked at different companies in the bay area and we're going to talk data protection before we start though i just want to give a quick shout out to e-week my media partner all z casts are done in conjunction with the e-weekly speaks program uh now as i mentioned we're going to talk data protection and model you know the world has changed a lot because the pandemic we've talked a lot about how it's changed the way we work and you know the way kids learn and things like that i think one of the things we really haven't talked about though is uh that's that's kind of flown under the radar is data protection right we as we move people home uh and into this hybrid world um we it's uh it's we're putting more data in more places and and we're heavily leveraging the cloud and so in a lot of ways a rethink of data protection is needed so can you talk about that and how companies should be thinking about data protection today yeah absolutely uh you are absolutely right the world has changed the world of data has changed with the adoption of cloud applications right um you know the users you know they're using different random applications on the web today every organizations they're using hundreds of sas based services um some of them are corporate approved some of them are not approved um and then at the same time there is a lot of lift and shift applications on you know companies they're hosting applications in public cloud infrastructure so um you know again the paradigm of data has changed it's fully distributed it's fully in the cloud today now uh one of the interesting things about sas based services your users they they love these applications they can um they're very high you know collaborative um the users can access them from anywhere and these applications make them productive so more and more users are going to be using more cloud applications right and and that's kind of like imminent today now when you think about it the security team they have a different challenge in the world of cloud they can no longer be a sledgehammer uh so what they're thinking about is how do i empower my users so that so that they're they're more collaborative and and and and and you know because of this you know the goal that the i.t team and the security team has again the biggest challenge that they're focusing on is fully distributed data data is no longer on-prem it's everywhere and people are accessing from um you know all locations so so so again when you think about how do you secure the data it has to be done very very differently um uh you know the the traditional hub and spoke security castle and mode security no longer works um you need to have kind of like a very distributed service edge where you can see users traffic at all times from all locations i think a good way to think about that is you know what what hybrid working cloud did is it made the world more dynamic and more distributed and so that castle model was very rigid right and kind of brittle so you have to have a data protection strategy that mirrors the kind of world that we live in today which is like i said how to distribute it now when i think of z-scaler z-scaler was really a pioneer in leveraging the cloud to deliver security so how does how is this here leveraging that cloud platform to deliver data protection yeah um great question um you know since day one um the the the way zscanner thought about data protection is is very different than um you know what we have seen in the market from other vendors um just about eight eight years ago you know people started talking about casbi security brokers um you know at the end of the day what they were talking about is you need an overlap proxy you need an overlay data protection solution um z-scaler from day one we believed in a platform strategy right um you know the dlp casby all that all the data classification techniques that people talk about um we said it needs to be fully integrated with the platform and and and that strategy has been going very well because if you kind of like look at what gartner has done recently they merged a bunch of mqs into a single mq called secure service edge right at the end of the day gartner is saying swig data protection ksb ztna all all have to come together and that's exactly what we have delivered 12 years ago right so you know again from solution perspective how do we solve this problem uh to protect data to protect organization from data breaches step number one you need to keep the bad guys out so you need to have a very strong security play where you are focusing on external threats at the same time uh the capabilities that we have built around dlp and casby they are very much focused towards insider threats right um once in a while you need to deal with this disgruntled employees um when people are leaving the company they usually take some data with them so you need to think about that situation at the same time we see a lot of accidental data loss so everything that we have built it's part of the xero trust exchange platform it is not an overlap proxy it is not an overlake hasby which makes us very different than other vendors um you know into this space yeah and i saw actually that uh the mq that you're talking about i saw the z skater was a leader in there so congratulations on that achievement now dlp is an interesting technology because it's been around a long time and when i talk to companies about it a lot of them have kind of shied away from it because there's a lot of noise and a lot of false positives and so you know if there's too many false positives in fact you you can't ever actually find you know the real breaches and so the way z scanner does theop how do you handle all the the traditional noise and false positives that the traditional legacy systems i guess if you will uh would actually give yeah um you know the step number one you need to first focus on contextual dlp don't don't go straight into regular expressions and custom dictionaries and predefined dictionaries right um those are usually uh you know very false positive prone um so what we recommend is first focus on contextual dlp what does that mean um focus on the file types different type of files that are leaving the premise right why my users are uploading encrypted documents to a random websites why i'm seeing hundreds of office documents going into an application called pdfconverter.com right so those are the things that that people should be focusing on is contextual dlp where is the data coming from where it's going what kind of activities that are happening into these cloud applications that's a great start right then when you when you uh go to the next step which is you know now let's inspect the content let's look at the file let's look at the structured data and unstructured data the traditional approach has failed right the traditional dlp vendors their primary solution was all about regular expressions you know you need to hire a 50 people dlp team who wakes up every morning and keeps riding those complex regexes right um so the approach that we have taken is in addition to all these stable states like you you define predefined dictionaries and custom dictionaries but how do you introduce automation in data classification so that you know a uh you do not have a lot of management overhead and b you cut down the noise uh you cut down false positive right so um you know we we are using a lot of um you know ml and ai when we are trying to classify that the data in addition to standard regular expressions but also at the same time we have introduced some of the very advanced data classification techniques like um uh you know exact data match uh index document matching ocr so with those advanced classification techniques really allow us uh you know to automate that whole process and reduce a very large number of false positives so you mentioned ocr which is uh optical character recognition can you uh you know drill down on that and explain why that's important for dlp because i think that's fairly unique to you correct that is correct yes um you know the ocr uh you know again it's it's it's uh powered by you know heavily powered by ml and ai uh the entire oci library that we have designed it it utilizes a lot of machine learning algorithm at the end of the day what ocr is solving is in today's world people take a lot of screenshots you know when when you have to deal with a malicious employer disgruntled employee just about to leave the company sometimes they're taking screenshots with their phones uh sometimes they're trying to exfiltrate data with embedded image files or handwritten text and and and so on so what uh ocr really allows you to do is go inside that image file extract the data and then do dlp on the data so that you can you know protect sensitive data and intellectual property right so so again very advanced uh you know classification techniques uh you know a lot of screenshots today a lot of image files today contain sensitive information it could be source for pii data pci data but ocr is is able to detect that uh again using that that heavy ml and ai so even if somebody takes a screenshot of you know a zoom section or something like this you'd actually be able to find that that is correct yes if someone is taking a screenshot and then attaching that screenshot with an email to his personal email or trying to upload that screenshot into their personal dropbox account and onedrive account and g drive account on the wire we will be able to detect it and we will be able to block that transactions yeah that's amazing and you also you you mentioned artificial intelligence and machine learning um are there other ways you're using aiml for data protection yeah yeah so so the very first thing we did is when we built uh predefined dictionaries to catch industry standard classifiers like credit card number social security number uh you know and bunch of other predefined dictionaries some of those standard classifiers were built using regex and pcre engine right now it does create sometimes it does create false positives so in order to cut down the noise we also use ml and ai when we were designing other type of predefined dictionaries i will give you an example if if if you are in the medical industry every healthcare company their patient patient record id uh patient documents and you know those those you know varies right uh differs from each other right so so there is no standard loan check or checksum for this type of data the only way you can really help this healthcare organization is uh is is when you start using um you know ai and and ml so we have heavily utilized um machining machine learning and and ai algorithm to build these predefined dictionaries we have used different term frequencies inverse term frequencies we did a lot of document clustering uh you know to to cut down the noise within the predefined dictionary so that's one part of it um the other part is when we did data classification using very advanced technologies like ocr we used mln ai and then the third part which is even more important is when we focus on end user behavior analytics or user anomalies that's when we are also heavily using machine learning and ai you know just to kind of like give you an example if an employee is leaving the company and then we see an excessive amount of download uh it it's a clear indication that the employee is trying to steal steal some data when they're leaving the company right so so again we are benchmarking every single users their behavior and anytime there is a drift from their normal behavior that's when our ai and ml will kick in and and identify those anomalies and then trigger alerts and take different type of actions yeah that's uh and that actually supports the move to the cloud even more because traditional on-prem systems wouldn't have the capacity to actually do the aiml algorithms needed to find those things correct that's right that's right again you can only be successful uh with mlm ai when you have large amount of data and if you think about z-scaler we are dealing with 200 billion internet transactions a day so across the board we have a lot of data we are leveraging this data we are building analytics and so on right yeah well and you have the processing capability in your cloud that you wouldn't have that on-prem system so now now when i think of dlp if somebody says dlp to me i think large teams i think policy tweaking i think continual ongoing management and a lot of overhead so convince me i'm wrong here yeah you are absolutely right like that's that's really the old-school way of doing data protection and dlp many organizations they tried to do it they burned their fingers um and they kind of like you know stayed away from it and i've talked to many enterprise customers they you know they will say hey i do not want to touch dlp with the 10 feet pole right because because of those noise and then false positive that the management overhead they had to go through now the the recommendation that we do uh we make um you know the dlp casb these are not just features that you just turn on and you are done right when you think about data protection it's a journey um you know you have to um you really have to take the journey uh and then you will feel uh you know much more secured if you take that approach so so when we sit down with our customers our prospects our professional services our smes um we always tell them to take a crawl walk run approach right um and then our script follows five simple steps so we tell them if you follow these five simple steps then you should feel pretty good about your data protection program um um you know literally within 90 to you know you know 160 days right so so so we kind of like take them through different steps step number one do you have the right visibility right do you have the full visibility right and if you think about z scalar architecture we are at the right position to see all your internet bound traffic everything is going through us so step number one we start with full visibility second is in our visibility uh you know if it shows that your employees are using a lot of heavy risky applications that are not corporate approved you should just block those applications step number three uh focus on password protected files encrypted files zip files because again if an employee is trying to steal the data most likely a smart user will zip up bunch of sensitive data and send it out right step number four um in today's world the number one data exfiltration point is personal cloud storage applications and email applications so focus on what kind of data people are uploading to their personal dropbox and box and g drive focus on what kind of attachments are going out with yahoo and hotmail account right and then step number five which is the last step is the data address the data your data that is already sitting in the cloud do that data have any exposure out to the world right so so again we kind of like help them through that journey simple five step steps and i've seen many organization they feel pretty good about their overall data protection program when they follow this follow this model again crawl walk run is the best approach to take don't try to solve worlds hunger in day one that never works yeah liken that to uh uh you know thinking of these it projects as you know chip shots not moon shots right any anybody can handle one step or two steps but if you think about the end state you can almost paralyze yourself so i think bringing it down with those five steps was great it's it actually makes it doable for people so uh thanks for that uh anyways uh i think uh with those five steps and those recommendations we're going to wrap up here uh milo uh you you accomplished your task you convinced me that uh dlp isn't this long laborious process that's going to consume all my security team's time and it is actually something you can do today and more importantly it's something you need to do today i i think the again this trend of hybrid work is just pushing more people into more places i think this there's been a huge rise in um in the use of consumer apps and and shadow yt so uh so thanks for that so on behalf of moylecon vp of product management z scanner i'm zs caravals and thanks for watching don't forget to click to subscribe and i'll see you soon on another z cast you

This transcript was generated automatically from the video's captions and may contain errors.