New from Forcepoint: Data Detection and Response (DDR)

In today's digital landscape, data breaches are becoming increasingly frequent and severe. One of the most alarming statistics is that it takes organizations an average of 258 days to identify and contain a data breach. This significant delay highlights a critical gap in current data security solutions: the lack of visibility into data exposure and misconfiguration that create the potential for breaches.

Addressing the Visibility Gap with Forcepoint DDR

Forcepoint Data Detection and Response (DDR) is designed to address this visibility gap. Unlike traditional data security solutions, DDR provides continuous monitoring of various data repositories, giving organizations visibility into potential data breaches as they occur. This proactive approach enables timely identification and remediation of data issues, significantly reducing the duration and impact of a data breach.

Key Features of Forcepoint DDR:

• Continuous Threat Detection and AI-Driven Responses: DDR provides continuous threat detection and enhanced data risk visibility, ensuring that organizations can identify, monitor and respond to threats. Leveraging rich context powered by Forcepoint’s AI Mesh, DDR acts to neutralize threats, offering a robust defense against data breaches.
• Extensive Visibility Across Cloud and Endpoints: DDR offers extensive visibility across both cloud and endpoint environments. This comprehensive view helps organizations prevent data exfiltration and ensures that potential vulnerabilities are monitored and addressed. Capabilities such as data lineage tracking further enhance the ability to counter potential breaches accurately.
• Enhanced Productivity and Cost Reduction: With continuous threat detection and dynamic responses, DDR enables security teams to focus on prioritizing data and permissions changes pointing to potential data breaches in action. This enhances productivity and supports organizational goals of cutting costs, reducing risks and maintaining customer trust.
• Enhanced Incident Investigation: Data lineage capabilities offer forensic-level details by tracing a file’s lifecycle. DDR enhances the investigation of security incidents—leading to more accurate remediation decisions and reducing false positives.
• Key Add-on to Forcepoint DSPM: As companies seek to secure their data posture, especially by reducing risky data across cloud and on-prem locations, Forcepoint DDR brings continuous risk visibility to Forcepoint DSPM. Instead of needing to run a complete discovery scan of data locations first, Forcepoint DDR enables continuous monitoring of the data security posture immediately after being deployed. Even without prior discovery scans, Forcepoint DDR detects and enables remediation for new data risks as they are happening. This continuously prevents new risks to the overall data security posture.
• Deployed as SaaS or on-prem software: Organizations are increasingly looking for flexibility in how they deploy security solutions. Businesses with data sovereignty and compliance requirements can deploy Forcepoint DDR on-premises while others that prefer the simplicity of a cloud service can use the new SaaS version. 

How Forcepoint DDR Works

Imagine an organization where an employee has legitimate access to a file containing sensitive information, such as credit card numbers. If this employee decides to steal the data, they might change the file's permissions to public access ("anyone with this link"). They could then send the link to themselves and access the sensitive information from an unauthorized machine, resulting in a data breach.

Alternatively, an unauthorized individual could steal credentials to gain access to the organization's data. Once inside, they could move around and change permissions to access sensitive information files undetected. Typically, such activities are not clearly visible.

With Forcepoint DDR, these risky data changes are continuously monitored. When suspicious activity is detected, an incident alert is sent to the security team. The team can then remediate the files by removing public permissions and identifying the user making the changes. They can also see all files where similar changes are being made, whether it's permissions changes or data movement to unauthorized locations. Data lineage tracking allows the team to see the history of affected files along with user information, providing greater visibility and control over potential breaches.
 

"Forcepoint DDR's continuous monitoring has given us peace of mind. We're excited to see how this will help us maintain robust security measures and prevent potential breaches in the future."  — Financial Services Organization

Announcing SaaS Offerings for Forcepoint DSPM and DDR

Both Forcepoint DSPM and Forcepoint DDR are now available as cloud services as well as on-prem software. The new SaaS solutions offer the same features and functions as the on-prem versions, with the added benefits of faster deployment, easy scalability and automatic updates. This gives organizations the flexibility they expect in modern security solutions.

Looking Ahead

Future blog posts will explore the powerful benefits of combining DDR with DSPM. From there, we’ll go further to explore what new levels of data security companies can achieve when they integrate the power of DDR and DSPM with our award-winning DLP solution. 

For more information visit forcepoint.com/ddr or sign up online to talk with a Forcepoint expert on how Forcepoint DDR can help you gain visibility and control over potential data breaches today.  

Also check out a demo of DDR in this video: