Chapter 13. Identifying and Detecting Sensitive Data

Identifying and detecting sensitive data is a very important process inside an information-protection solution. You need to be able to identify sensitive information within your environment using suitable matching criteria to provide the related results for appropriate classification and protection controls. This is quite important to give the right access to the right person and to improve your security standards. Microsoft has invested in this field and provides different solutions that work natively together. The solutions provide capabilities for data in motion, in transit, and at rest. In this chapter, we'll give a practical overview of the needed information that can be used for your organization or customers:

• Extending your lab environment
• Understanding and using AIP capabilities for data in motion
• Understanding and using AIP capabilities for data at rest

In the first part of the chapter, we will extend your lab environment.

Extending your lab environment

First, we need to extend your lab environment to test the different features and give you the chance to extend the scenarios as you work through the different chapters in this book.

We will add two Windows 10 test clients and the YD1INF01 server. Use the following diagram to get the correct sizing, and the virtual machine configuration and domain membership for the virtual machines:

Lab environment overview

The Windows 10 clients need to be joined to YOURDOMAIN1.COM and you need to copy the example data files from the code package to any directory on the two clients:

1. Add the Domain Users in the local Administrator group to provide easy access to the virtual machines:

User access to VM

2. To use single-sign-on, add *.yourdomain1.com to your Local intranet zone in your Internet Explorer configuration:

IE Local Intranet zone configuration

 

 

3. Install Office Suite and the Azure Information Protection client on both virtual machines.
4. Open https://portal.office.com with your Office...

Understanding and using AIP capabilities for data in motion

The meaning of data in motion or transit is that information is actively moving from one location to another inside your environment or outside through the internet. Typically, the process starts with the creation of a document, presentation, or spreadsheet, or the export of information from a source, such as the HR, CRM, or another system. The best option is to include the classification and protection process directly in these processes. Otherwise, you need to be able to detect and identify sensitive data from scratch on client computers and servers. Another important thing is that you know where your sensitive, protected, or not-protected information is exchanged and stored. Let's say you need a solution that's able to monitor the sensitive data on client computers, on-premises, and in the cloud. Microsoft follows this strategy and provides the following technologies to fulfill these requirements to actively monitor sensitive...

Understanding and using AIP capabilities for data at rest

The identification and detection of sensitive information that isn't actively moved is a very important component inside an information-protection solution. For this reason, Microsoft provides the Azure Information Protection scanner, which allows you to scan two typical file locations, File Shares and SharePoint Document libraries, as you can see in the following diagram:

Azure Information Protection scanner architecture and components

To explore the functionality of the AIP Scanner, we need to distribute some of our example documents to the following file locations:

1. Move the example contents from the code package to the YD1INF01 server where we created the following test shares:

Example file structure

2. Upload some of the test files to your document library on SharePoint:

Sample data on SharePoint

 

We need to install and configure the AIP Scanner on our YD1APP01 server where, in Chapter 7, Deploying Solutions on Azure AD and ADFS, we installed...

Summary

In this chapter, we discussed and configured the key technologies for the discovery of sensitive data in motion, transit, and at rest. You saw how important these tasks are, and the benefits and data control they provide in your environment. They give you the power to build efficient detection and data-leakage-prevention rules. We'll use this knowledge to build an Azure Information Protection solution in Chapter 15, Configuring Azure Information Protection Solutions. But first, we'll learn more about the Azure RMS keys, which you need to understand to follow the protection process and find the right tool to troubleshoot against errors.

In the next chapter, you'll learn how Azure RMS keys are used and which deployment models are available for different compliance requirements.