How File Auditing Builds the First Layer of Data Protection
By Sergio Bertoni, Leading Analyst at SearchInform
Just a few years ago, data-centric audit and protection (DCAP) systems were familiar mainly to a relatively small group of advanced information security specialists. Today, this class of solutions has become far more widely adopted. By classifying confidential files and controlling how they are handled, DCAP helps organizations establish the first layer of data protection.
This article explores a capability that goes beyond conventional file auditing: blocking. Rather than simply denying access to files, modern solutions can restrict specific actions involving sensitive information.
We explain how these controls work using SearchInform FileAuditor as an example.
Who Can Access Data, and What Can They Do With It?
Inappropriate access permissions can expose critical information and disrupt business operations. Organizations therefore need to establish which employees genuinely require access to confidential files for their jobs, and whose access is unnecessarily broad or has never been properly authorized.
SearchInform FileAuditor includes a set of reports designed to identify and correct problems with access permissions. The software reads permissions configured in the operating system and displays them in File View mode. It can also detect network shares that have been made accessible from users’ computers.
The Resource Access Rights and Resource Owners reports help security specialists review audit findings and establish who owns a particular document or folder. They show permissions and examine how access rights are inherited. This makes it easier to track new objects in the file system and assign appropriate access rights.
The Permission Inheritance Audit report helps administrators investigate access rights when new objects are added to storage locations and automatically inherit permissions. For example, it can show how users’ rights are distributed across subfolders and files within large directories. If an object has permissions that conflict with the rules applying to its parent folder, FileAuditor notifies the security team.
When necessary, an administrator can adjust access rights directly from the management console with a single click, without manually navigating operating-system settings. Permissions can be configured for individual file operations, including reading, editing, executing, moving and copying, as well as for entire directories.
Traditional DCAP tools, however, have limitations when it comes to context-aware restrictions. Such systems often rely on file attributes and other external characteristics to manage permissions, without considering which applications may process the content. As a result, sensitive information in some documents may remain exposed even when conventional file access controls are in place.
An employee might simply rename a confidential file, copy its contents into a new document and move that document to another folder. SearchInform FileAuditor addresses this problem through content-based access rules rather than relying solely on access control lists (ACLs).
How Content-Based Blocking Works
Modern DCAP solutions should be able to prevent unwanted actions involving selected categories of files. Depending on the policy, they may prohibit transfers through internal or external channels or block unauthorized attempts to access a document.
Unlike many tools that manage permissions through file-system attributes, SearchInform FileAuditor examines the actual content of a document, including text extracted using optical character recognition (OCR). Blocking is implemented in several stages.
First, FileAuditor applies predefined classification rules to analyze files and identify those requiring protection. Searches can use phrases, character sequences, dictionaries, regular expressions, similarity to other documents, file attributes such as type and size, and other criteria. The system also includes more than 450 preconfigured classification rules for different document types.
Once files matching the configured criteria have been identified, FileAuditor automatically assigns classification labels. Labelling is one of the key functions of DCAP: it allows documents with shared characteristics to be grouped into categories, such as tax records or customer contracts.
Labels are protected against removal. Even if a label is damaged, FileAuditor automatically restores it, so the associated blocking policies continue to apply. Each label can have its own set of permitted and prohibited actions.
A policy can specify which users, on which computers, may or may not access a labelled file through particular applications. These can include office software, email clients, messengers, system processes and custom-built applications.
When the defined conditions for an application, user and computer are met, FileAuditor blocks access to the labelled file. For example, an administrator can create a rule prohibiting operations on files labelled “Financial Reporting” in Microsoft Outlook. Employees would then be unable to open such a document through Outlook or attach it to an email.
FileAuditor also helps prevent accidental incidents through a transparent approach that allows employees to label documents themselves. These visual labels inform users about a document’s confidentiality status. A security specialist does not have to configure every label manually: the author of an important document can assign the appropriate confidentiality label.
FileAuditor then enforces the relevant policies for the labelled document and gives security specialists a clear report showing who assigned the label and what actions were performed on the file.
If employees forget to classify a document, FileAuditor can remind them. If a label is incorrect, or the user is not permitted to work with that category of information, the system prevents the operation from being completed. For example, the default notification reads: “Sending this email is not permitted under company policy.”
The notification can also be translated automatically into other languages when a different language is configured in the user’s operating system.
DCAP and DLP: Better Together
Whether an organization should configure protection around content or context depends on the task at hand. Combining file auditing (DCAP) with data loss prevention (DLP), however, provides broader protection. File auditing organizes storage and establishes baseline restrictions that most users will follow. DLP adds controls when someone deliberately tries to circumvent those rules.
Integrating SearchInform FileAuditor with the DLP capabilities of SearchInform Risk Monitor extends blocking beyond the file system to the channels through which information is transferred.
Conclusion
Modern file auditing systems increasingly do more than review storage permissions. They can identify and correct errors in access rights and permission inheritance, and block inappropriate actions involving sensitive files when necessary. SearchInform FileAuditor addresses a fundamental information security task: bringing order to corporate file systems so confidential information does not remain accessible to people who do not need it.
Seamless integration with data loss prevention adds further capabilities for protecting information and monitoring its movement.
ABOUT SEARCHINFORM
SearchInform is an information security and risk management product vendor as well as an MSS provider. The company's clients are more than 4000 companies in 20+ countries. Today, the team has products and services for comprehensive protection against insider threats at all levels of corporate information systems: FileAuditor (the DCAP class solution); DLP system with extended functionality; Risk Monitor (advanced platform for internal threat mitigation); SIEM system, Information Security outsourcing service.
