LayerOne 2018 - Data Security: How to Avoid an Embarrasing Breach (Matt Hoy)

### Overview At LayerOne 2018, speaker Matt Hoy presents an unconstrained, vendor-neutral perspective on data security, focusing on how organizations can prevent embarrassing data breaches. Drawing on his consulting and incident response background, Hoy argues that while incident response is often a losing battle, data security is an area where organizations have the agency to control their own environment. The presentation explores the historical evolution of data controls, identifies critical gaps in contemporary cloud data security lifecycles, and outlines practical strategies across people, processes, and technologies to track and protect critical data assets.

### Key Topics - **Historical Evolution & Security Models**: Early computer networks like ARPANET and Cold War requirements birthed fundamental security models. The Biba model prioritizes data integrity (preventing data corruption via reading up and writing down), while the Bell-LaPadula model prioritizes confidentiality (preventing data leakage via writing up and reading down). Cold War systems enforced Mandatory Access Control (MAC) and multi-level security—exemplified historically by the IBM AS/400 (now iSeries)—alongside human data custodians who vetted, extracted, and printed authorized records on green-bar paper. - **The Modern Shift & Cloud Risks**: Rapid business demands, pervasive API access, cloud migrations, mobile laptops, and high-capacity flash storage dismantled structured repositories. Hoy notes that organizations often move unclassified, unstructured data directly into public Amazon S3 instances or decentralized Hadoop clusters without evaluating exposure. - **Flaws in the Data Security Lifecycle**: Standard cloud security lifecycles frequently omit two essential safeguards: retention policies and verified backups. Hoy emphasizes that data hoarders retaining decades of old email archives (PST files) represent massive liabilities in a breach, pointing to the Sony hack as an example. Furthermore, unverified backups leave systems helpless against ransomware.

### Technical Details & Implementation - **Data Classification as the Core Foundation**: Relying solely on eDiscovery scanning across petabytes of unstructured data is compared to trying to clean up a flood with a wet/dry vac—scanning is simply too slow and resource-heavy. Instead, organizations must require end users to tag and classify documents at the point of creation. Because data aggregates like water, tracking newly classified files leads security teams directly to repositories where high-value data resides. - **People, Processes, and Technology**: Effective governance requires executive buy-in, clear data retention rules, and user accountability (including termination for attempting to game classification). On the technology front, Hoy discusses machine learning/pattern-based classification metadata tagging, eDiscovery, CASB tools, and Data Loss Prevention (DLP). He stresses that DLP is ineffective if set only to monitor and alert; it must actively block data exfiltration, supported by classification tags to minimize business-disrupting false positives. - **Architectural Controls**: Hoy advocates for defensive architecture such as isolating sensitive data within Virtual Desktop Infrastructure (VDI) environments, enforcing tight Access Control Lists (ACLs), multi-factor authentication at internal choke points, deploying rights management and encryption, and poisoning exfiltrated documents using canary techniques like honeydocs. He also notes User Behavior Analytics (UBA) can record suspicious actions when employees attempt to circumvent security controls.

### Takeaways Hoy concludes that attackers often know where the crown jewels are better than the victims do, making it unforgivable to leave internal networks wide open. Organizations cannot protect or govern what they do not know they have. Before attempting complex frameworks like Carnegie Mellon's CMMI Data Management Maturity (DMM) model, enterprises must master basic data classification, enforce strict data destruction/retention policies, ensure reliable backups, restrict risky users to locked-down VDI sessions, and configure defensive technologies to actively block unauthorized movement.