Microsoft Purview Data Protection – Protecting Sensitive Data from Third-Party Cloud Storage

A common gap in data security is caused when users store content belonging to the organization in cloud storage not controlled by the company’s IT infrastructure.  When this occurs, the content is potentially no longer under the control of the business and is at risk for misuse.  Whether this is a malicious act or an innocent one, the outcome is the same.  The data is not receiving the full protection of the environment in which it is supposed to be stored.  In this post, I’ll cover how an organization can go about protecting sensitive data from third-party cloud storage.

As always, please be aware of my blog disclaimer

You’re Going to Need Microsoft Defender for Endpoint

A quick note before we continue.  You must have Microsoft Defender for Endpoint (MDE) deployed to the workstations for this to work.  If your organization already uses an Endpoint Detection and Response (EDR) tool like Crowdstrike or Trend Micro, that is ok.  MDE can provide the controls we are looking for in what is known as passive mode.  Passive mode is exactly as it sounds: the tool sits there and monitors and reports the information it needs to gather.  It just doesn’t act on it.  While this sounds great, as an endpoint support analyst, you need to be aware that MDE can get in the way of your EDR even in passive mode.  What happens is that both MDE and your EDR try to access the same file or monitor the same activity simultaneously and lock each other out.  This is known as a race condition.  This is happening less as the various tools are being updated to allow for multiple instances of an EDR tool running, but it does happen.

The rest of this post will assume that MDE is deployed in at least a passive mode.  An important note to make here is the parts of Purview and MDE that we are going to be using here will work even with MDE in passive mode.  The tool to be configured is known as Endpoint Data Loss Prevention or eDLP.  This is just a part of MDE, and because it does not do the same thing as a standard Crowdstrike or Trend Micro install, it is able to function in a more active mode.  However, you will likely run into some problems if you have another eDLP tool active on your workstations.

Identifying the Domains to Block

Before we can create any policies to monitor or block the upload of content, we need to set the locations that we want to block against.  To do this, you must review the various third-party storage you will monitor (or block).  For the purpose of this post, I am going to monitor Google Drive, Dropbox, Box, and personal OneDrive (yes, you can monitor personal OneDrive without affecting the use of any OneDrive for Business your organization may have configured).  Use the steps in a related post: “Microsoft Purview Data Protection – Configure the Sensitive Service Domain Groups” to monitor the following locations:

• Google Drive: “drive.google.com”
• Dropbox: “*.dropbox.com”
• Box: “*.box.com”
• OneDrive (personal): “onedrive.live.com”

Protecting Sensitive Data from Third-Party Cloud Storage

Once the Sensitive service domain group has been created, we will use it in a DLP policy to monitor and block the upload of Confidential or Restricted data to the cloud locations.

1. Login to Microsoft Purview (https://purview.microsoft.com).
2. Click on Data Loss Prevention –> Policies –> + Create policy.
3. Create a custom policy and click next.
4. Provide the policy with a meaningful name and a description (optional)

5. Click next twice (leave admin units at default setting).
6. Ensure the only location selected is Devices

7. Click Next and then Next again at the Define policy settings screen.
8. Click + Create rule
9. Provide the rule a meaningful name.
10. Create a “Content Contains” activity under Conditions.
    1. Click Add and Select Sensitivity Labels
    2. Select Confidential and Restricted Labels
11. Under Actions, click + Add an action and select “Actions Audit or restrict on devices“.

12. Place a checkmark beside “Upload to a restricted cloud service domain or access from an unallowed browsers” and “Paste to supported browsers”.
13. Under the first option, click on “+Choose different restrictions for sensitive service domains”
14. Click on Add group
15. Select the group(s) created in the “Sensitive service domain groups” step above.  Click Add.
16. Select whether you wish to:
    • Audit Only: Only alerts will be generated.
    • Block with override: Initial action will be blocked, but users can override the block
    • Block: Block without providing an option to override
    • Allow: Allow the activity through (used for safe lists)

17. You will be prompted to perform additional checks like copying to USB or clipboard, but I like to have a certain level of separation between policies so I select Don’t restrict activity in the next section of the policy.

18. Configure the remainder of the notification settings as you see fit for your organization

19. Click Save
20. Back on the Rule overview page you can click on the down arrow beside your rule to review a summary of the rule’s configurations

21. Click Next
22. Choose to run the policy in simulation mode, turn it on, or leave it off.
23. Review the configurations of the policy and click Submit.

 

Policy Results

In the following example, I will attempt to upload a confidential document to Dropbox.  You’ll notice that when I upload an internal document, it works without any issues.  However, when I upload a Confidential or Restricted, I am prompted to provide a justification.  The process is similar to when one attempts to lower the sensitivity of a document.

(Click to enlarge)

Thanks for reading!