Storage Data Sensitivity Tagging for Exfiltration Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems face challenges in efficiently detecting and preventing data exfiltration, particularly in networked environments, where sensitive data can be inadvertently or maliciously extracted without proper monitoring and security measures.
Innovation Solution
Implementing a system that includes network monitoring and classification of outgoing network traffic, coupled with data sensitivity analysis to identify and mitigate unauthorized data exfiltration attempts, utilizing a storage system with non-volatile memory express (NVMe) over fabrics for enhanced data security and integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If network monitoring and classification of outgoing network traffic is implemented, then detection capability for data exfiltration is improved, but device complexity increases
Solution Approach 1:
A network monitoring system is introduced as an intermediary component that sits between the storage system and the network. This monitoring system captures outgoing network traffic, classifies it based on sensitivity, and provides detection capabilities without requiring fundamental changes to the core storage system architecture. The intermediary handles the complexity of network analysis separately from the storage functions.
Solution Approach 2:
The detection function is segmented into separate components: traffic capture, sensitivity classification, and exfiltration detection. By dividing the complex detection task into independent modules, the system can implement monitoring capabilities while maintaining manageable complexity in each individual component rather than requiring a monolithic complex system.
2Loss of time
If real-time monitoring and classification is provided, then response time for data exfiltration prevention is improved, but use of energy increases
Solution Approach 1:
Instead of continuously processing all network traffic in real-time, the system employs periodic sampling and classification of outgoing network traffic. The monitoring system analyzes traffic at defined intervals and triggers detailed analysis only when anomalies are detected, reducing energy consumption while maintaining effective detection and response capabilities.
Solution Approach 2:
The system applies partial monitoring by focusing analysis on outgoing network traffic specifically, rather than monitoring all storage operations. The sensitivity classification mechanism processes only the metadata and classification results rather than analyzing every byte of data, providing sufficient detection capability with reduced computational and energy overhead.
Data Source
AI summary
An illustrative storage system operating within an environment bounded by a managed network may perform a sensitivity classification procedure with respect to a data instance stored within the storage system, the sensitivity classification procedure comprising determining a sensitivity classification of the data instance, and generating metadata representative of the sensitivity classification; detecting a request to send the data instance to a remote system by way of the managed network; and sending, based on the request, the data instance and the metadata to a network monitoring system that performs a network traffic monitoring service with respect to outgoing network traffic from the managed network.