What is our primary use case?
We prioritize the control of sensitive data according to our classification, which closely aligns with Microsoft's classification system. Our main goal is to prevent the loss of personal secret data. To achieve this, we focus on specific data types. Our use case involves managing managers who interact with customers. The objective is to limit access to this sensitive data within different departments, allowing some groups to have access while denying it to others. We also control outgoing information through the extension line.
The basic use case scenario is as follows: when we receive sensitive personal data from a customer, we classify this information with Microsoft Purview Data Loss Prevention for information protection. The next step involves narrowing down the range of people who can access this data through recording management. The third step is to use DLP to prevent the loss of this personal information through the extension line.
The second part of the process deals with the use and storage of this information in OneDrive, SharePoint, and Teams. We label and save it within the perimeter system. Lastly, we implement retention policies and tuition policies to ensure that the controlled path of this information is secure and that it is deleted when necessary.
How has it helped my organization?
It's important to us that Purview can connect to iOS, Mac, and Android devices, as well as data in other SaaS apps. We also have numerous organizations with corporate devices, all of which are connected by the MDM and MAM systems within Azure and our on-premises network. Therefore, it's essentially within our perimeter. It's crucial to control the overall flow of data and information on all endpoints, including mobile devices such as tablets and phones. Almost everything is on iOS because we are currently transitioning from older Android devices and corporate devices to Apple devices. Essentially, iOS provides better control.
Purview's native integration for compliance across Azure Dynamics 365 and Office 365 is of utmost importance to us. We have high demands for compliance, and the current design of Purview greatly enhances the user experience for both administrators and regular users. The all-in-one user admin dashboard holds significant value, as it allows administrators to easily visualize connections between modules. Moreover, as administrators, we can effectively track the flow of data between these modules and understand the interconnections of the rules across different modules. This feature is truly impressive and well-implemented. In contrast, most specific cybersecurity programs tend to have more complicated dashboard interfaces, making it challenging to identify the next step in the data flow.
It is important that Purview was built taking into account critical regulations from around the world. We are part of an international group, and we collaborate with other offices and colleagues from different countries. They are currently conducting their own research and starting to implement it. We understand that we can essentially use the same rules, making it clear to everyone how it works, how it is made, and how it is built. We have already modified some default rules and sensitive information types, making it unnecessary to create them from scratch and consider all the small details. Microsoft has provided this functionality for us, and it's incredibly useful, making the entire process much quicker.
We have a plan to set up Purview for the DLP model and incorporate it as a part of our Global DLP system in the company. Currently, we are in the planning and researching phase, and there is a lot of interest in the tool. We anticipate huge potential in Microsoft tools and how they evolve, such as Azure and Entra. Having a wider range of tools gathered in one place is very convenient.
We observe the clients' weaknesses because it essentially operates through pooled solutions within the organization. Whether we use it or not, the tenant's full settings are functional. As we work, and delve deeper into research, we notice some weaker spots. At present, we are in a phase similar to the planning step, but we already perceive the potential directions that Microsoft Purview Data Loss Prevention offers for us to work on. Consequently, we have discovered a few types of information that we had not taken into consideration before, and we see that our users encounter these information types in their everyday operational activities.
Purview has the potential to reduce the number of solutions, and as a result, it has logically impacted the company's budget. On the other hand, Microsoft has been very active in updating systems over the past three years. This development potential stands out compared to other cybersecurity tools that remain relatively static. Consequently, we don't foresee much progress or development in the functional side of those tools in the near future. In contrast, Microsoft offers its customers a clear and open roadmap for the development of their tools.
The AI algorithms could significantly assist cybersecurity specialists in mitigating risks, addressing potential threats, and preventing such threats from compromising the system.
What is most valuable?
The most crucial aspect is controlling how Microsoft Purview Data Loss Prevention functions within the SharePoint environment and cloud storage. Additionally, we exchange ideas because, as a centralized organization, we also make use of a variety of tools, including Symantec DLP. Consequently, we have different levels of systems that monitor the external and internal parameters of the company. These lines of defense are integral to our cybersecurity solutions, and at the heart of this framework lies Microsoft Purview Data Loss Prevention.
What needs improvement?
I currently work in the financial domain, and we have very strict regulations from national banks and the group side. Domain-related improvements could be really useful for organizations and banks. For example, sensitive information types are the basic level of information protection, similar to the Purview model. We start with creating or duplicating sensitive insights and editing them. I am talking about more sensitive information types that align with European regulations, especially in the financial sector. Having more variety would be beneficial. All of the EU considers sensitive information types in finance, but we need more variety, especially as a Ukrainian company. We face a lack of attention to our region, despite having the same strict regulations as EU companies.
One point of improvement is related to organization and language issues. For instance, we use different sensitive information types for France, the UK, and other countries where we have offices. Unfortunately, Microsoft doesn't support the Ukrainian language, unlike Chinese and Japanese languages, which have deeper layers of understanding of information. It would be helpful to add support for Ukrainian. However, I understand that we are essentially bilingual, using both English and Ukrainian in our companies, and we are a minority in terms of languages.
Other solutions, like ERP systems, offer localization for Ukraine and have partnerships with companies. Microsoft 365 also supports the Ukrainian language from a user perspective. However, unfortunately, Defender and Azure lack deeper settings. They do not provide language options beyond the ones already available, so our language option is missing. Purview includes sensitive info types covering a wide range of languages and country specifications. For instance, it includes passport numbers for Ukraine, but we also need a sensitive input type for our tax numbers. Currently, there is no option for our tax numbers, which forces us to duplicate the data. In contrast, they include all sorts of options such as driver's license numbers and insurance policy numbers for EU companies. It would be beneficial to have those presets available for us as well.
For how long have I used the solution?
I have been using Microsoft Purview Data Loss Prevention for a couple of months.
What do I think about the stability of the solution?
I rate Microsoft Purview Data Loss Prevention's stability a ten out of ten.
What do I think about the scalability of the solution?
I rate Microsoft Purview's Data Loss Prevention scalability a ten out of ten. The tool is highly flexible, offering a wide range of capabilities that largely depend on the defense strategies and the proficiency of the managers who work with it. It provides ample opportunities to address various traditional data management problems. Furthermore, as the vendor develops additional solutions, such as AI, its potential for high scalability remains significant.
Which solution did I use previously and why did I switch?
We are currently considering the possibility of discontinuing our DLP program called Varonis. This is because it essentially duplicates the data classification capabilities of Purview for cloud storage. By doing this, we can potentially reduce costs, and one of the major advantages of Microsoft is its licensing structure. All our users are already covered by various types of licenses, and we can easily add another type, such as for level admins or security admins, to provide them with additional licenses that offer more possibilities and options to work with the system.
On the other hand, we have another system that also incurs implementation costs and requires significant human and primary resources. Additionally, we must consider various types of licensing, both long-term and short-term. However, one more significant advantage of Microsoft is its clear and transparent licensing policies. We can easily access information and conduct preliminary research without the need for additional communication with partners or vendors. This allows us to make well-informed decisions on what suits us best before involving a reseller, which is also an important aspect to consider.
How was the initial setup?
As the Product Owner of Microsoft 365 and also the Project Manager involved in every step, I find it challenging to describe the process due to being the sole expert in this area. The difficulties arose due to wartime circumstances and the complexity of migrating to the cloud. The team had to handle the heavy lifting of the project, and the lack of available personnel added to the challenges we faced.
We have layers of regulations to consider, especially since we operate in the finance domain. It's a rather complicated situation overall, but the solution is actually quite easy to deploy.
What about the implementation team?
We are implementing the solution in-house but are seeking a partner for consulting.
What's my experience with pricing, setup cost, and licensing?
We are using the E3 license for Microsoft 365 with the E5 compliance license add-on.
The prices are quite reasonable, but unfortunately, I don't know the hourly rates since they are globally negotiated for the entire group, and we probably have some nice discounts. In Ukraine alone, we have five thousand users.
Which other solutions did I evaluate?
We have a range of tools, and prior to considering Microsoft Purview Data Loss Prevention, we also evaluated other solutions.
What other advice do I have?
I would rate Microsoft Purview Data Loss Prevention an eight out of ten. It is not specifically created for security purposes but rather functions as a branch for Microsoft, from what I can observe. However, they are actively working on improvements. I hope that eventually, it will be rated a ten out of ten. Currently, when comparing it to other systems we are using, such as Symantec DLP, it falls on the lower end.
We have only considered using Purview to help reduce actions on insider threats, but it could potentially be helpful for our ESS experts.
Our goal is to use Purview to serve multiple departments instead of 5,000 users within a single tenant.
Purview requires some maintenance because our managers have to do so after the deployment stage. The maintenance stage comes in, as the task for our information security managers is to analyze alerts and likely repeat certain steps such as creating an incentive prototype, establishing rules, and creating new DLP rules. This involves constant management processes, which are more like operational processes.
I would highly recommend Microsoft Purview Data Loss Prevention for researching and implementing data loss prevention measures, especially for mid-size businesses. As an enterprise-level organization, we have higher standards and demands. However, I believe small and mid-size businesses would find it particularly beneficial. Purview addresses all the traditional data management problems and offers specifications that are not commonly found in the enterprise sector. By using Purview, businesses can save on costs and efforts, particularly smaller ones that may lack a sufficient number of staff members with expertise in information security, DLP, and data management. Unlike enterprises, these businesses might not have the luxury of hiring specialized roles such as solution architects, data architects, and a full range of information security experts, which makes Purview an attractive solution for them.
Which deployment model are you using for this solution?
Hybrid Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.