YT YouTube2Text

YouTube2Text → Transcripts → Противодействие утечкам данных и защита от сотрудника: как защищают DLP и NDA и чем уменьшить ущерб

Противодействие утечкам данных и защита от сотрудника: как защищают DLP и NDA и чем уменьшить ущерб — Transcript

by Безопасность бизнеса - Гладиаторы · 2,098 words · 360 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Many companies come to us with requests
0:03to identify data leaks. This can be
0:06either the machinations of competitors
0:08bribing your own employees to steal
0:11valuable company data, or it could be,
0:13uh, let's say, the employee's own
0:16initiative, wanting to harm the company
0:18for some reason. The reasons can vary.
0:21by an employee. Even if you have a
0:24non-disclosure agreement in place, it
0:26doesn't effectively, technically, or
0:29physically prevent them from causing
0:31this kind of self-inflicted damage to
0:33the company. Therefore, in most cases,
0:36organizations are just left to, well,
0:38let's say, wait, in quotes. So, is it
0:40possible to somehow prevent this
0:42unauthorized activity by employees? Can
0:45you avoid the machinations of
0:47competitors and data leaks from your
0:49companies? Of course, you can. And in
0:51this video, I will tell you how to do
0:54it. Here with you in the studio, as
0:57always, your host from the Business
0:58Security Development channel, Dmitry
1:00Ushakov, from the Gladiator Information
1:02Security company. Subscribe to the
1:04channel, like the video, leave comments
1:07below, and let us know what else you
1:09would like to learn regarding corporate
1:11information security or what topics we
1:14haven't covered in this video. Well, we
1:17are starting by analyzing situations
1:20involving company data leaks. Let's go.
1:23We will divide counteracting corporate
1:25data leaks and the spilling of valuable
1:27information, trade secrets, or client
1:29databases into two parts. The first
1:32part is, let's say, the organizational
1:34component, and the second is the
1:35technical one. Let's start from the
1:37beginning. The organizational component
1:40of protecting a company from data leaks
1:42or countering fraud by your own
1:44employees involves having every
1:46employee sign a non-disclosure
1:48agreement regarding confidential
1:49information. It is usually called an
1:52NDA. Also, besides everything else, the
1:55contract with this employee—or
1:57directly in their job description—
1:59must specify the employee's actual
2:02duties and outline exactly what is
2:04permitted and what is prohibited within
2:07the company. Basically, it must be
2:09stated that it is forbidden to disclose
2:11confidential information. And what
2:13exactly constitutes confidential
2:15information and how to work with it is
2:17established in the confidentiality
2:19policy, which is implemented by order.
2:22By the head of the organization,
2:24usually the General Director. Actually,
2:26this confidentiality policy and the
2:28confidentiality regime in the
2:29organization are implemented at a
2:31specific moment in time, and you should
2:32be prepared for this as well. Within
2:34the framework of this confidentiality
2:36order, a list of confidential
2:38information is created, and all
2:40information is categorized by so-called
2:42confidentiality stamps. For instance,
2:45trade secrets or know-how might carry a
2:48higher level of confidentiality.
2:51Whereas information on deals or
2:53contacts of specific clients, which
2:55likewise represents valuable commercial
2:57or at least confidential information
2:59for your company, may have a much lower
3:01priority. After all, you might lose a
3:04client, but if you lose a trade secret,
3:07you effectively leak or hand over your
3:10business to competitors—or some other
3:12company that was trying to buy or steal
3:15this trade secret through an employee
3:17in your organization. Accordingly, when
3:21you have signed an updated contract
3:23with an employee, signed a
3:25non-disclosure agreement with them, and
3:27introduced a confidentiality regime at
3:30the enterprise—that is the moment
3:32when the employee’s obligations to
3:34you arise: formally established,
3:36legally sound obligations for the
3:38employee not to disclose that
3:40confidential information, for which
3:43they will face very clear consequences
3:46that you will also specify in the
3:48agreement with that employee. All these
3:51so-called organizational measures
3:54certainly create certain moral and
3:56ethical constraints, but they in no way
3:58technically prevent the leaking of
4:00information or the theft of trade
4:02secrets, client databases, or deals
4:05from your company. Therefore, this is
4:07definitely not enough. Technical
4:09restrictions are necessary. So what
4:11could these restrictions be? And how to
4:15technically prevent information leaks
4:17and data theft by your own employees,
4:19who, by the way, are sometimes called
4:21insiders in threat models. Technical
4:24countermeasures boil down to three
4:27simple actions. Well, they certainly
4:29sound simple. In reality, this is a
4:31fairly complex technical operation, but
4:33let's break them down. The first
4:34technical measure is restricting
4:36employee access rights when working
4:38with the organization's information
4:40systems. This is the so-called
4:43principle of least privilege. Least
4:45privilege principle. It consists in the
4:48fact that an employee, when working
4:50with an information system, has access
4:52only to the information they actually
4:55need to perform their job duties. And
4:58as a consequence of implementing this
5:01principle, even in the event of an
5:03incident, we, let’s say, limit the
5:06scale of the damage. That is, the data
5:09that could theoretically leak from the
5:10company constitutes only a small part,
5:12exactly the part that the given
5:14employee is responsible for. But if you
5:16have 10 managers in a department, and
5:18only one actually leaked information,
5:20then in the worst-case scenario, you
5:22can only lose one part of that
5:24information. Whereas in the usual
5:27scenario, what we observe in most
5:28companies when we conduct information
5:30security audits for them, we see that
5:32access rights are effectively not
5:34restricted at all, and the full
5:36spectrum of employees actually has full
5:38access to all information in the
5:39company. This, of course, must not be
5:43allowed. Limiting employee privileges
5:46only to the scope of operations,
5:48actions, and information truly
5:50necessary for them to perform their job
5:52duties. The second important technical
5:56measure is a regular audit of data
5:58access rights. Why is this necessary?
6:01Well, in any company, let’s not hide
6:03it, there is always at least some staff
6:06turnover. Plus, as a company grows, new
6:09data emerges, including new information
6:12systems that process this data, store
6:15trade secrets or have access to them,
6:17and handle an increasing number of
6:20transactions and client contacts. In
6:23short, they process the very
6:24confidential information you are trying
6:26to protect. So, the system is alive and
6:29evolving. And it is equally necessary
6:32that the information security system,
6:34which controls access to this data,
6:37limits manager privileges, and
6:39ultimately limits the potential damage
6:42to your company, must also evolve.
6:46Therefore, a regular access audit—
6:49either manually following procedures
6:51and written algorithms that an external
6:54consultant can draft for you (like our
6:57company), or using a specialized
7:02information security system—scans all
7:05employee accounts and information
7:07systems to provide you with a
7:09ready-made access matrix that reflects
7:12the current state of your company. Then
7:17you, or your company's security officer
7:20, can visually compare what is
7:23currently implemented in terms of
7:26access matrices with what should be on
7:29paper—the theoretical model of access
7:32and threats that your company should
7:36apply—and align the actual model with
7:39the theoretical one, ensuring real-time
7:43security control on a regular basis.
7:47Finally, the third technical measure is
7:49the data leak prevention system itself.
7:51A DLP system, or Data Loss Prevention
7:54system. As the name implies, it is a
7:57system that allows you to prevent data
8:00leaks. What does it do? It monitors all
8:03communication channels used by an
8:05employee. Based on a set of rules—
8:09typically keywords or specific behavior
8:12patterns—it isolates suspicious
8:15activity that either directly indicates
8:18a leak in progress or acts as a warning
8:21sign of a leak about to happen.
8:26Accordingly, the main task of a DLP
8:28system is to promptly warn a manager,
8:31an information security officer, or
8:34even the CEO—if you have a small
8:37company—that something bad, i.e.,
8:39that very leak of confidential
8:42information, is either happening at
8:44this moment or is about to occur. These
8:48warnings are generated either by the
8:50system itself or by an analyst working
8:52with it. And you don't even need
8:55technical expertise to implement and
8:57maintain such a system. Such an
9:00implementation can be done using an
9:02outsourcing model, where a specialized
9:04integrator, for example, an information
9:06security pro, installs this kind of
9:08system in your company and subsequently
9:11maintains it, providing the
9:12organization's head with a ready-made
9:15report on leak indicators regarding
9:17employees who should be kept under
9:19watch. Or regarding all employees in
9:22your company. When using a DLP system,
9:24it is important to follow a number of
9:26rules, let's call it the hygiene of
9:28using a DLP leak prevention system. The
9:31first recommendation is not to use the
9:33blocking mode of this system, despite
9:35the fact that it is called a leak
9:37prevention system. An effective mode
9:41for using this system is when it allows
9:44for passive monitoring of employee
9:46communication channels, let's say, with
9:48the outside world, with potential
9:50competitors or other scammers who are
9:52trying to steal your confidential data
9:54through them, and simply notifies you
9:56of these facts in a timely manner. Why
10:00is this mode more effective than
10:02blocking everything? Well, first of all
10:05, if we start blocking communication
10:08channels—messengers, email, or
10:11certain websites—then an employee, if
10:15they are a truly motivated scammer or
10:18someone who has decided they will steal
10:21information from your company at any
10:24cost or tamper with it, will not be
10:27stopped by these restrictions. They
10:30will simply find another way. They
10:33always exist. Where there's a will, as
10:35they say. So, motivated employees
10:37usually have that will. And therefore,
10:39they will find a communication channel
10:41that is not currently being monitored
10:43by this system. And it is much more
10:47effective, as I said, not to force the
10:50employee to think creatively, but to
10:52try to relax them, make them act in
10:55their usual way, so that they use the
10:58standard, controlled, and convenient
11:00communication channels. In this case,
11:03it will be much easier to identify them
11:05. Also, to comply with all legal
11:08procedures, it is necessary to include
11:11a clause in the employee’s contract
11:13explicitly stating that the company
11:15monitors the communication channels the
11:18employee may use for their work. And
11:21that this does not in any way limit
11:23their right to privacy or personal life
11:26. And that this is required to maintain
11:29the organization's confidentiality
11:31regime and is aimed at ensuring the
11:33security of the company's business
11:35processes. After that, the employee
11:38will either object to such monitoring,
11:40which serves as an additional signal to
11:42the security department regarding the
11:44true reasons for the employee’s
11:46objections. Perhaps you shouldn't hire
11:49them at all. But if they sign the
11:52contract and agree to the implemented
11:55control mechanisms, then most likely—
11:57and this would be more appropriate—
11:59you will have to provide the employee
12:02with equipment, such as a laptop or
12:04desktop computer, which will be
12:06monitored by a data leak prevention
12:09system, through which you will
12:11effectively monitor the employee's work
12:13and be able to do so completely
12:16legitimately. By the way, another
12:19interesting fact we have encountered
12:21when consulting our clients during the
12:24implementation of leak prevention
12:26systems is that employees often refuse
12:29such monitoring tools. They justify
12:32this by saying that their personal
12:34correspondence—which they don't
12:36hesitate to use during the workday,
12:38even though they technically shouldn't
12:41—is somehow valuable information to
12:43them. But at the same time, for some
12:47reason, they undervalue all trade
12:49secrets, all know-how, the client base,
12:52and ultimately, information about deals
12:55or other valuable company data. In
12:57other words, they believe it is somehow
12:59unimportant. This is an additional
13:02indicator and a reason to talk with the
13:05employee about how much they truly
13:08value the company’s information,
13:11understand what their duties entail,
13:14what the company requires of them, what
13:18it permits them to do, and what it
13:21restricts—such as transferring,
13:24modifying, copying, sharing externally,
13:28or even deleting information within the
13:30company's systems. Remember that just
13:34one data leak, one instance of sharing
13:37trade secrets with competitors during
13:39the company's growth phase—especially
13:42in the early stages—can be critical
13:45and even fatal for a young business.
13:48Therefore, be careful, keep your
13:50information secure, and keep your
13:52employees under supervision. If you
13:55need a detailed consultation, visit our
13:58website via the link in the description
14:00, submit a request, and our specialists
14:02will contact you to provide expert
14:04advice and even demonstrate this system
14:07in action. They can advise on using the
14:11algorithms or help with the
14:12organizational aspects of monitoring
14:14employees and ensuring confidentiality
14:16within your company. I wish you
14:20security and growth for your business.
14:23The Gladiators of Information Security
14:25are ready to be your reliable partner
14:27on this challenging journey. Good luck
14:30and have a great day. Don't forget to
14:32subscribe to the channel and leave your
14:34comments. Let us know what else you
14:36would be interested in learning
14:38regarding information security for your
14:40business. Share this video with your
14:42colleagues. Let more companies develop
14:45successfully and securely. And let’s
14:48all work together to build successful
14:50businesses in our country. These are
14:53challenging times. Have a good day. See
14:55you in future videos. Bye.

About this transcript

This page contains the full transcript of Противодействие утечкам данных и защита от сотрудника: как защищают DLP и NDA и чем уменьшить ущерб by Безопасность бизнеса - Гладиаторы, generated from the public captions YouTube serves with the video. The transcript has 2,098 words across 360 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.