Classify Data at Rest with Symantec DLP’s High Speed Discovery

• Symantec DLP 16.1 is making data classification and auditing easier.
• Classify data at rest is faster than ever with MPIP labels and High-Speed Discovery.
• Beta testers love using existing DLP policies to auto-tag and protect sensitive files.

In October, we dropped powerful new data classification and protection capabilities that made Symantec DLP 16.1 next level.

One feature that quickly became a fan favorite is the ability to classify and label files using Microsoft Purview Information Protection (MPIP) integration, which enhances protection of data at rest with High Speed Discovery for File System. Here’s what one of our own customers had to say during the beta test:

We’re still hearing users rave about this upgrade (and we are too). And as organizations are realizing just how central data classification is to reducing risk, we expect more to join the Symantec DLP 16.1 bandwagon. 

Manifested: Symantec DLP with MPIP integration

No matter your industry, data security starts with accurate data classification.  And with Data Security Posture Management (DSPM) on the rise, organizations are looking for means to categorize data efficiently and accurately across their environment.  

 Over the years, we at Symantec (and Broadcom) have been working towards offering an out of the box (OOTB) Data Classification solution by gradually integrating with MPIP to automatically classify documents/emails based on the content, across channels. 

We began this journey with Symantec DLP 15.8, which could  read the MPIP labels applied on documents, and automatically suggest and/or enforce MPIP labels on documents and emails on the endpoint based on the policies a customer has in place. Over several updates, we extended the capability to automatically classify sensitive data using MPIP to data residing on cloud apps as well. 

And now with DLP 16.1, customers can apply MPIP labels to data at rest on file shares, completing this feature’s coverage across endpoints, in the cloud and on-premise environments.

Now speed it up: MPIP with High Speed Discovery

Many organizations are still on their data classification journey, painstakingly classifying and tagging all the documents in their environment across platforms for risk posture audits and compliance. To support you in this endeavor, we made Symantec DLP integrate MPIP across many channels. With DLP 16.1, you can automatically classify and tag on-premises data on file/network shares using MPIP and our High Speed Discovery for File System technology.

High Speed Discovery for File Systems is our rearchitected solution introduced in DLP 16.0 for scanning and discovering more and more sensitive information across on-prem file/network shares. By scaling your Discover (server) setup, discovery only takes a short span of time— with scan speeds of up to 1 TB/hour or more.

Another stand-out benefit of the Symantec DLP & MPIP integration is the ability to use existing fine-tuned Symantec DLP policies to detect and protect sensitive data for classifying documents using the High Speed Discovery for File Systems solutions. The DLP policy determines the appropriate MPIP tag to apply, then MPIP-labeled documents that also have RMS encryption enabled in the Azure portal will automatically be encrypted when the MPIP label is applied.

You’ll also experience more flexibility and auditing capabilities, including: 

1. Flexibility to generate Symantec DLP incidents for audit tracking. Choose to generate incidents at the response rule level, while applying MPIP tags to documents. This will help with detailed audit reporting of highly sensitive documents. Take care to avoid overloading the Enforce database by enabling incident generation only for documents with highly sensitive tags, or as required.
2. Reporting on the MPIP label applied. A new attribute is introduced that will capture the MPIP label applied in the DLP incident generated while classifying a document. This will enable DLP admins to report on the MPIP labels applied in their classification journey.
3. Classification reports. Detailed statistics showing the classification distribution, document attributes and DLP policy violated per scan will be available. The report can be exported, giving admins a classification statistical overview to review and confirm accuracy per scan.
4. Restricting data classification based on document attributes. Enable data classification based on document size and type. These new granular controls help organizations fine-tune their scans to achieve better performance based on their environment.
5. Enabling classification with existing remediation actions. Classify, copy and quarantine files at the same time in the same scan target. Sensitive documents will be classified, which are then copied and moved to their respective locations. This streamlines your remediation process and reduces scan target management overhead.

The verdict is in: Simple to use, big impact

Some of our customers previewed this powerful capability to some of our customers before we made it available to all—and the response was overwhelmingly positive. Many emphasized their need to classify decades of untagged data and appreciated that leveraging existing DLP Discover technology made it easy without a steep learning curve. 

They called out another major win: flexibility with additional controls ensures appropriate classification and audit tracking for highly sensitive labels.

Fast, accurate data classification—now across all environments 

A solid classification strategy and methodology helps optimize your organization’s productivity while nailing data compliance and security. With this Microsoft Purview integration, the goal is to deliver the best of both products: Symantec DLP’s enterprise-grade sensitive data detection and Microsoft’s unmatched tagging capabilities. 

Find out how DLP 16.1 with MPIP can help you complete your data classification journey in the tech doc.