Managing Sensitive Information Types and Trainable Classifiers

0:00[MUSIC PLAYING]

0:06Not everything is created equally.

0:09We know this.

0:10Not all cars are created equal.

0:11Some go faster than others.

0:13Some can haul things, while others can't.

0:15Well, hey, that's true for everything, including ink pens.

0:20Think about this, this happened to most of us.

0:22We go out to dinner and we're finished.

0:24The waiter or waitress, they bring us

0:26the check and, of course, a pen to sign with.

0:28We pick up that pen, we sign our names.

0:30And we figure out, oh wow, this is

0:33the best writing ink pen ever in the existence of the world.

0:38I've got to have one of these.

0:40Well, most of us have experienced that.

0:43But it just begs to prove the point that not all things are

0:48created equal.

0:48And guess what, this includes your data.

0:51So let's talk about that.

0:53Now, when it comes to your data, you

0:56need to do something with it that is governed.

0:59You need to govern your data.

1:01And the idea that not all data is equal

1:04really plays into this.

1:06Now, the governance is basically the management of your data.

1:10It's making sure it's being managed properly,

1:12making sure it's being handled properly, classified

1:15properly, all of those things.

1:17And that leads us to something known as sensitive data.

1:22And it could be sensitive for a myriad of reasons.

1:24And we're going to talk about some of those.

1:26But the idea is that--

1:28but if we have sensitive data, well, then that sensitive data

1:32is probably going to need to be handled

1:34specially, a little different from your standard everyday

1:38data.

1:38We need to provide extra protection

1:41around our sensitive data.

1:43Now, the thing is, if we don't know that this exists,

1:48then we can't provide that additional protection.

1:51Just think about this.

1:52If your friend called you and wanted you to housesit for her

1:55or him for a couple of days, so you say, yeah, sure, why not?

1:59And so you go over to your friend's house

2:02and it's out here.

2:03And it's actually on a farm and it's pretty nice.

2:06And they got this little pond over here.

2:08So you might go out and do a little fishing

2:12and look for some fish there.

2:14Or maybe you're going to just sit out and enjoy

2:19the nice weather out here on the farm and the fresh air.

2:23So one of the stipulations of you

2:26housesitting for your friend is that you

2:28need to feed the animals.

2:30Now, if your friend tells you, I just

2:32need you to feed the animals and then leaves,

2:34how are you going to know that you have fed all of the animals

2:38if your friend over here hasn't told you

2:41that they have 3 dogs, 1 cat, 2 horses, and I'll say 1 pig?

2:49If you don't know that all of these animals

2:51exist on this farm, then you're not

2:54going to feed all of the animals.

2:56And they're going to get left out.

2:58And we don't want that.

2:59Well, the same goes for our data.

3:01We need to know all of the data that exists.

3:03And we need to know if any of that data is sensitive data.

3:08Because if we don't know that that is sensitive,

3:10we don't know that it needs additional protections.

3:13So I said, we're going to talk about some various types

3:15of sensitive information and it's time for that.

3:18So here we go.

3:19Some sensitive data types.

3:21Number one would be medical data.

3:23Let's talk about that.

3:24So medical data, we're talking patient information.

3:27So it could be diagnoses, patient numbers, record

3:31numbers, all of these things.

3:33And this actually falls under the HIPAA compliance.

3:38And that is the Health Insurance Portability

3:41and Accountability Act.

3:42So it's all about patient information.

3:46So anything related to patient information is sensitive data.

3:49And we need to protect it.

3:51We also have personal identifiable information or PII

3:58for short.

3:59And this is any information that can

4:01be used to identify a person.

4:02So we're talking full name, address, phone number,

4:05date of birth, Social Security number, all these things,

4:08that's PII.

4:09And HR or human resources, HR department handles lots of PII.

4:15Just think about when you submit a PTO request.

4:18Are you submitting any personal information in there?

4:21Well, sure you are.

4:22And HR manages all of this information for us.

4:26Or it could be that you're a vendor

4:29and you've got lots of customers and their personal information.

4:32Either way, this is PII, it's sensitive information,

4:36and it needs to be protected.

4:38There's lots of data privacy laws

4:40and regulations such as GDPR.

4:44And that is the General Data Protection Regulation.

4:47And that is for the protection of the European Union citizens'

4:51data.

4:51And there's a whole lot around it.

4:53But the idea is that, really, it's

4:55about privacy and protecting your personal information.

4:59Then, we have credit card information.

5:01That's a big one.

5:02So credit card data falls under the PCI DSS compliance

5:07requirements.

5:08And so we're here, we're talking about credit card numbers

5:10names, account numbers, CVV numbers, those little CVV

5:15numbers where you've got to type in that number

5:17in order to process a transaction online.

5:20This is all sensitive information

5:23that needs to be protected.

5:24But then, there's also information

5:26that may be part of a DOD or the military.

5:30So it's actually classified information

5:32or controlled information.

5:34And some of this falls under the CMMC compliance requirements.

5:40So the idea is there's lots of different sensitive data types

5:44out there.

5:45And this isn't all of them.

5:46This is just the tip of the iceberg,

5:49because there's lots of different sensitive data types

5:51that exist.

5:52But the idea is you need to know that your organization deals

5:58with this type of data.

5:59And then, you need to know where it is, so that you can properly

6:02protect it.

6:03You can put controls in place to help protect this information.

6:07So when it comes to this, we really

6:09need to involve a couple of key teams.

6:13That would be our legal team and our compliance team.

6:17Now, this legal and compliance team may be the same person.

6:20And it may be a single person and that's OK.

6:23It's just the idea that we need to figure out

6:25who deals with legal in our organization, who

6:27deals with compliance.

6:29And we need to meet with these two organizations, these two

6:33teams, or people, or individual person.

6:36But the idea is we need to involve them

6:38in this, because they're going to help provide

6:40guidance and help us understand what we're working with,

6:43what type of compliance we're working with,

6:45what type of sensitive data we're working with,

6:47so that we can make sure it is all identified.

6:50So we can properly protect it.

6:52And that is how we deal with sensitive information

6:55within our organization.

6:56It's really important to perform planning around this

6:59and involving the proper personnel and teams,

7:02so that we don't miss anything.

7:04And we are protecting our data to the best of our abilities.

7:08I hope this has been informative for you.

7:09I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:06Now, that we've gone through and identified the various types

0:10of sensitive information we're dealing

0:11with in our organization, it's time

0:14to jump into the Microsoft portal dealing with compliance,

0:18and identify how they can help us manage

0:22our sensitive information, and even identify

0:25that sensitive information.

0:28All right, here we are, We are at compliance.microsoft.com.

0:32And this used to be the compliance portal.

0:35Now, it's known as purview or maybe it's purview,

0:39I'm not sure exactly.

0:40But it is a new branding for the compliance portal.

0:44Now let's talk about this a minute.

0:47What we're going to be looking at

0:48is dealing with compliance in our sensitive data.

0:52And we can actually go over here to data classification here.

0:56And it actually defaults here to the sensitive information

0:58types.

0:59And that's what we're going to be looking at.

1:00So what is a sensitive information type?

1:02Well, it's a certain type of sensitive information.

1:05In the last Nugget, we talked about credit card data.

1:07We talked about HR data, that's our personally identifiable

1:10information.

1:10We talked about what else?

1:12Health information data through HIPAA, like our patient data.

1:16So what we have here is sensitive information types.

1:20And these types, what they are, are pattern based identifiers.

1:24Meaning they search for patterns within data in an effort

1:27to identify a specific type of sensitive data

1:30that they might be.

1:31So, of course, Social Security numbers, date of birth,

1:33account numbers, credit card numbers, medical terms,

1:36things like that.

1:38And when it comes to our data identification,

1:41there's three ways we can use these, OK.

1:44So we have these here to help us identify data,

1:46about how are they used.

1:47Well, we can do it manually.

1:48So a user can actually go and manually

1:50assign a sensitive data type label to a document

1:55if they want to.

1:56And we can allow that.

1:58But we need to take into account training for that,

2:00and human judgment, and human error, all those things.

2:03Automatically that's our other option.

2:06So we can allow Microsoft to go out and scan our documents

2:08and automatically apply a label based on the matches

2:11it makes if we want to.

2:13Or we can even use something based

2:15on machine learning, which analyzes

2:17some samples we provide to it.

2:19And it looks for that data and looks

2:21to see if it matches those samples.

2:23And we're going to get to that later on.

2:25So right now, we're looking at sensitive information types.

2:27And we have a bunch of them in here.

2:29ABA routing number, that's our bank routing numbers.

2:32We've got Acme design document down here.

2:34That's a fingerprint.

2:36And we're going to get into that later on as well.

2:39All full names.

2:40So we're talking about full names, people's names,

2:43looking for medical terms, physical addresses.

2:46Argentina national identity number, pretty interesting.

2:50All right, let's search for U.S. for United States abbreviation.

2:55There we go.

2:56All right, we have US-UK passport numbers, bank account

2:58numbers, driver's license number, individual tax,

3:01identification numbers, physical address,

3:03Social Security numbers, all these different things.

3:06And these are patterns, which we can

3:09use to match on data, which is pretty cool.

3:12Because all these are already in here, 264 of them.

3:16So let's click on one.

3:17Let's go with US Social Security number.

3:20Let's just click on this to find out.

3:22All right, it says, detect formatted

3:24and unformatted US Social Security numbers confidence

3:27level.

3:28So here's our description.

3:29Confidence level is, how confident is

3:31this that it's a proper match?

3:32And right now, it's set to a medium.

3:34Who created it?

3:35That's Microsoft.

3:36Then, we have something called our pattern.

3:39So we have a primary element.

3:40Because what this is, again, it's pattern matching.

3:43And we can have multiple elements.

3:45The more elements you have and the closer they are together,

3:48the more accurate this is going to be.

3:51For example, if I provide a Social Security number

3:55pattern as a primary element, and that's

3:56probably what's done here, we're going to look at that here

3:59momentarily.

4:00So it's looking for that.

4:01But then I add something else in here,

4:02like maybe a name, a full name needs to be in there,

4:06or some other type of information that's often found

4:10with Social Security numbers.

4:11The idea is if we can find several things that

4:14are related, it's going to be more likely that we

4:16have a positive match and not a false positive, which

4:19is a false alarm.

4:21So here we go, our primary element.

4:23And that's really what it's looking for.

4:25So it's looking for that.

4:28And then, supporting elements is down here.

4:31And that is a keyword list.

4:33And these are words and lists that

4:35are somehow related to SSNs.

4:37And what this character proximity is,

4:40is how close in proximity character wise

4:43are words in this keyword list to the primary element.

4:47And it says within 300 characters.

4:49Because if you think about it, if you've got a big document,

4:52and you want two words that are related.

4:54The further they are away from each other, the less likely

4:57they are to be actually related, OK.

5:00So then, we have pattern number two down here.

5:02And it's looking for something else basically,

5:05and pattern number 3, and pattern number 4.

5:07So the idea is you can put multiple patterns in here.

5:09And we're actually going to create one later on.

5:12But something you don't see in here is,

5:15what are these patterns it's looking for?

5:17We don't know.

5:18I can't click on anything to look

5:20for the pattern to get an idea of what it's looking for.

5:22Well, that's because Microsoft doesn't put that in here.

5:25You need to go to their documentation.

5:27So let's click over to documentation.

5:30All right, there we go.

5:31So this is a sensitive information type entity

5:34definitions.

5:35So let's search for Social Security number.

5:36Let's do search there.

5:38Let's do Social Security.

5:41And let's see, we've got a lot of them.

5:42So actually, I should probably use US, there we go,

5:46social, there it is, Social Security number.

5:48That's exactly.

5:49Let me click back just to double check our US Social Security

5:52number.

5:52And I go over here to the documentation.

5:54Yes, that is it.

5:55So the format, nine digits, which

5:58may be in a formatted or unformatted pattern.

6:01And if we scroll down here, we see the patterns.

6:04So it looks like it's looking for some digits

6:07with spaces, digits with dashes, all the digits together.

6:12And so you see now, we can see the pattern it's looking for.

6:16All right, give us some definitions down here.

6:19Because we actually saw some functions here.

6:21If I go back here, let's see, function_ssn.

6:25So if I go back over to the documentation,

6:28we see function_ssn right there.

6:31So it finds content that matches the pattern.

6:34That's what it's looking for.

6:36And then, also a keyword from keyword SSN.

6:40So what is that keyword SSN?

6:42If we scroll down here, there's our keyword ssn.

6:44It's Looking for SSN number.

6:46The word SSN number, the words Social Security number,

6:50any of these typed out.

6:51These are the actual words, SSNs.

6:53So it's looking for these keywords

6:56to identify if a pattern is actually Social Security

7:00number.

7:01And remember, it was looking to see if any of these

7:03are within 300 characters of the pattern it identifies.

7:07So that's how this works.

7:08And that's why we have to go through and look

7:10at the documentation.

7:11Now, something else that we might want to look at

7:13would be something like a credit card number.

7:15So let's see, credit card and number.

7:19There it is.

7:19Format, here's the format, just a bunch of digits there.

7:23Looks for patterns.

7:24Detects card from all major brands

7:27including all of those, OK.

7:30And it provides some definitions.

7:31And if we scroll down here, it provides a keyword list.

7:35Credit verification, credit identification number, CVC,

7:38CVV2.

7:39I'm not going to go through all, of course.

7:41But this is it.

7:42This is a big list of key words that it

7:45used to associate with that.

7:46So let me go back now.

7:48Now, that we know what sensitive information types are,

7:51let me close this out so it'll refresh,

7:53we see how we can use them in our environment.

7:55Again, we can assign them manually.

7:57We can let Microsoft go out and look for them.

7:59But this is a Nugget to let you know these exist.

8:04Microsoft already created a bunch of these for us.

8:07And we can help use them to identify

8:10the sensitive information in our environment.

8:12And then, we can create rules around that.

8:15We can create security rules around rights management,

8:18and data loss prevention, and encryption all

8:21based on these data types and their matches.

8:24So that is pretty darn cool.

8:26Now, in the next Nugget, we're actually

8:27going to create one from scratch that

8:29meets our needs, because we have some special needs when

8:33it comes to matching sensitive data,

8:36because we create special hardware that's

8:39used in certain environments.

8:40And we're going to look at that.

8:42So I hope this has been informative for you

8:43and I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:06All right, here is the scenario.

0:08We work in an organization and we create handles.

0:10[LAUGHS] That's right, these are hardware handles

0:13used by the DOD, and government, military agencies on lots

0:17of their different devices.

0:18And we take pride in our handles.

0:20They're the best of the best.

0:21And they provide some special attributes,

0:24if you will, or features.

0:26And we need to protect our intellectual property, that

0:30is the design of these handles.

0:32And we need to do so using sensitive information

0:35types within Microsoft.

0:37That's right, so let's get started.

0:40All right, here we are.

0:41We're in our Microsoft Purview.

0:43And we're going to go down to Data classifications.

0:46We're going to go to Sensitive information types.

0:48It's going to take this a minute to load up.

0:50And guess what, we're searching for handle.

0:53All right, all right, what do we have here?

0:55Nothing, OK, all right.

0:57Now, let's search for--

0:58I don't know-- design.

1:01And what do-- nothing.

1:02All right, we did handle, design,

1:04maybe part number, part--

1:06how do would we get there?

1:08Nothing, all right.

1:09So basically, the idea is there's

1:11nothing here that's going to match what we're looking for.

1:13So we have to create our own custom sensitive information

1:16type.

1:17So let's do that.

1:18Let's go ahead and click on Create sensitive information

1:20type.

1:21It's going to open that up for us so we can create one

1:24in our friendly name.

1:25All right, we need to give it a name.

1:28All right, let's go with ACME-Design.

1:32Because we're wanting to identify our design drawing.

1:36So, ACME-Design, let's put Drawings.

1:39There we go.

1:40We'll say ACME design drawings.

1:44Excellent.

1:45Next, all right, patterns.

1:47Well, how are we going to figure this out?

1:49We're going to need to take a look at this design.

1:52So let's drag this in here.

1:54Here we go.

1:54This is a drawing of one of our designs.

1:57OK, got a handle here, and we have the word Design here,

2:00and a part number.

2:01And all of our part numbers start with two capital letters,

2:04followed by seven digits.

2:06That's good to know.

2:07That's probably a pattern we can use.

2:09We've got the word Date and a date

2:10that it was approved and approved by.

2:13And we have somebody who approved it.

2:14So Doc Brown approved this.

2:16All right, good.

2:17Now, we have an idea of what we're going to be looking for.

2:19We need a pattern for a part number.

2:21And we also probably want some matching

2:24on words that are close by, like Date and Approved.

2:28So let's do that.

2:29Let me move this out of the way over here.

2:31So the first pattern we're going to do, we're going to go ahead

2:35and click Create pattern.

2:37And we're going to say High confidence level.

2:39We're going to leave that because we

2:41could do high, medium, or low, based

2:43on how confident you are that there's going to be a match.

2:46And I'm going to add a primary element.

2:48And this is going to be a regular expression.

2:52Now, a regular expression, if you're not familiar with RegEx,

2:56It's patterns used to match on data.

3:00So I'm going to go ahead and copy this over here.

3:02I've got a pattern over here.

3:04And we're going to make this a word match.

3:06Because I'm wanting to match on a specific word and, actually,

3:09the part number.

3:10So right here, it says, mention your regex here.

3:13So what I'm going to do is paste that in there.

3:17And there we go.

3:18So let me highlight this.

3:20This is my regular expression, right there.

3:23So it's looking for any letter, capital letter, A

3:25to Z, any capital A to Z. The slash d is for a digit.

3:30And I'm looking for any seven digits.

3:32So that's my pattern to match that.

3:35And I also need to enter a name up here.

3:38So we're going to call this part number.

3:41There we go, super.

3:42And if I wanted to add some type of regular expression

3:44validator, I could do that.

3:46But I don't.

3:47I know this is the regular expression that

3:49will work for identifying that part number.

3:50And if you're not familiar with RegExes or regular expressions,

3:53you can just google it.

3:54There's lots of tutorials and such out there for it.

3:56So say Done.

3:58All right, so my primary element is that part number, excellent.

4:02Now, character proximity, detect primary and supporting

4:07elements.

4:07Now, the supporting elements, I'm going to do a word list.

4:10And it's going to have the words Date and Approved in it.

4:13And then, we're really close to the part number.

4:16They weren't very far away at all.

4:18So actually, I'm going to change this to 50 characters, why not?

4:22There we go.

4:23Or, you could say anywhere in the document.

4:25So now, I'm going to go to Supporting elements.

4:26I'm going to add this.

4:27And I want a keyword list.

4:31And this is going to be part number key words.

4:36There we go, case insensitive words

4:38here, or case sensitive here.

4:41I'm going to go with case sensitive.

4:42Since this is a template and those will not change.

4:45I'm going to say Date.

4:46And then, I'm going to put the word Approved.

4:50There we go, excellent.

4:52And let's put By in there as well.

4:54There, super.

4:55All right, word matches, there we go, we say Done.

4:59Excellent.

5:00And then, add any additional checks we want to add in.

5:02So, let me bring this drawing back over.

5:04Right now, we have a regular expression

5:06that will search for this part number.

5:08And then, it's going to look to see

5:10if the words Date, Approved, or By are close by.

5:14And that's going to help make sure that this is actually

5:17identifying a parts design.

5:20Because if I was to only search for this,

5:22well, if there was any document out there that

5:24had any pattern like this in it, it would match.

5:26And that's going to be a false positive, probably.

5:29So by adding this Date and Approved

5:32and By as supporting elements, it's

5:34really going to help me increase the likelihood that when

5:38this rule identifies a document as drawing,

5:42that it's going to be true.

5:43And it's not going to be a false positive.

5:45So let's move this back out of the way.

5:47And let's go ahead and click on Create.

5:49There we go.

5:50We have created our pattern.

5:52All right, excellent.

5:54Now, let's go over here to the recommended confidence level.

5:58And you have high, medium, and low.

6:00Again, and we're going to stick with high.

6:02It means that the matched items will

6:04contain the fewest false positives, but the most false

6:08negatives.

6:08And a false negative is when it doesn't detect something

6:12that it should.

6:13Just FYI, and they just go through here

6:15and give you a little wordage about that.

6:17But I'm pretty confident that this is going to match.

6:19So we'll say Next, and then go ahead and Create.

6:23And now, it's going to create my custom sensitive information

6:26type.

6:26And then, we're going to test it.

6:27We're going to see if it works or not.

6:29And I will show you how, here momentarily.

6:32All right, so this created, I'll say Done.

6:35Excellent.

6:37And there we go, ACME-Design-Drawings

6:39is now up here.

6:41And you can see the publisher is NuggetLabz.

6:43And if I click on it, I come in here

6:46and I see ACME design drawings.

6:47And it has that pattern that we're matching on.

6:50Excellent.

6:50It has my part number keyword list as supporting elements.

6:54And you have an option to test, copy, edit, and delete.

6:57I want to test this.

6:58So I'm going to say test.

6:59It's going to allow me to upload a file.

7:01So what I'm going to do is, you see this drawing right here,

7:04well, I'm going to upload that file.

7:06So let me close out of the drawing itself, close out.

7:11And now, I'm going to drag the drawing in here.

7:14Actually, I'm going to go to--

7:15let's do Upload File.

7:18There we go.

7:19And I want this one here.

7:20This is the part number, you see it right there.

7:23Say Open.

7:25And we'll say Test.

7:26And now, we're going to see if it matches on those results.

7:30And there it goes.

7:31It came back, and it says it matched.

7:33ACME-Design-Drawings, it matched one unique pattern.

7:36And that was the part number there.

7:39Let's see, it also found Date and Approved

7:41and By, all close by.

7:43So there we go.

7:44It found it, so that worked.

7:47All right, let's go ahead and finish that.

7:48But now, let's test it again.

7:50And let's say Test.

7:51I'm going to upload a different file,

7:52this time the one that is empty.

7:54There's no part number in it.

7:56So I'm going to say Open and say Test.

8:00And let's see what-- there it goes.

8:02That was pretty fast.

8:03No sensitive content was found.

8:05Now, those key words were in there.

8:07But there was no part number.

8:08So this just goes to show that it works.

8:11So I'll say Finish.

8:12And so there we go.

8:13We have created our own custom sensitive information types,

8:17looking for a design drawing, for ACME,

8:19and our super duper handles.

8:21And we were able to go in and test to make

8:23sure it identified a drawing.

8:25And then, I provided it a true negative drawing,

8:28meaning one that didn't have a part number in it.

8:31And it didn't match on it.

8:32So that's good.

8:33It tells me that we have created a good and reliable

8:37sensitive information type.

8:39I hope this has been informative for you.

8:40And I'd like to thank you for viewing.

0:06Within our organizations most of us use some sort of templates.

0:10And that's to make sure that we kind of standardize the way we

0:13do things for daily collection.

0:15Maybe recording information or creating

0:18drawings of parts and stuff we use a certain template.

0:21Well, guess what, Microsoft allows us

0:24to do document fingerprinting.

0:26And that's because each document, especially if it's

0:29a template, has some unique characteristics about that,

0:32could be its fingerprint.

0:33So let's jump in and talk about document fingerprinting.

0:37So document fingerprinting is a way

0:40to identify commonly used forms within an organization,

0:44as I had mentioned earlier.

0:46And some of these different forms, they could be HR forms,

0:51they could be design drawings like we've seen previously,

0:55and actually we're going to use as an example here shortly.

0:59Now what about medical records, I have mentioned that earlier.

1:02So medical records.

1:04There could be lots of forms, could be a form for a patent.

1:07So maybe your organization creates lots of new widgets

1:10and you need patents for them, so you

1:12could have a patent form.

1:14So just about any type of form that your organization uses,

1:17it has unique characteristics about it.

1:20And specifically a unique word patterns.

1:24That's really what Microsoft is going

1:25to look for when it creates this fingerprint.

1:29So the idea is we're going to create a sensitive information

1:34type for each of these fingerprints.

1:37And that way we have a tool, a sensitive information type,

1:40that we can use in protecting our data.

1:44Now as of the recording of this, the only sensitive information

1:48type that you can use a document fingerprint with

1:52is a DLP sensitive information type.

1:55And that is a data loss prevention.

1:57So this allows us to create DLP rules

2:00around these sensitive information

2:03types, which classify our documents that we

2:06create fingerprints for.

2:07And also there is a note here.

2:09I want to note that as the recording of this Nugget,

2:14this DLP sensitive information type is a detection method that

2:18can only be used in Exchange Online.

2:24Now, hopefully that will change in the future,

2:26but as of this recording, that's what it is.

2:29So we can only use it with DLP rules and Exchange Online.

2:32So here we're looking for probably email attachments,

2:36because we're looking at document fingerprints

2:38and you're going to attach that document here to our email.

2:42And that way we could maybe stop the email

2:44from going out because it's a sensitive document that

2:46shouldn't be leaving the organization.

2:48Or maybe we force encryption on that email.

2:53So how does this work?

2:54What's the process of creating this sensitive information type

2:58with a document fingerprint?

2:59Well, the idea is we have our document here.

3:02And what we do is we upload that to Microsoft 365 DLP.

3:08That's key here.

3:09It uses the data loss prevention area of Microsoft 365.

3:13And DLP provides some analysis.

3:16It takes a look at the document itself,

3:19and it's looking for the unique word patterns

3:23to create a fingerprint.

3:25And once it has this fingerprint,

3:27that fingerprint then represents that document.

3:31So it's a way to identify that document through DLP.

3:35At that point, we can use this fingerprint

3:37to create a sensitive information type.

3:40And then, of course, we can create rules for DLP

3:43around using that sensitive information type.

3:46And, again, right now it's only for Exchange Online.

3:51But, again, hopefully that will change soon.

3:53Now there are a couple of instances

3:55where document fingerprinting simply doesn't work.

3:58So what are those instances?

4:01Well, maybe we have a password protected file.

4:05If it's password protected, Microsoft DLP cannot analyze

4:09that file.

4:10So, therefore, it can't tell what it is.

4:12Well, what about a document that contains only images?

4:16Well, there's no text there, there's

4:18no words in the fingerprint.

4:19It's created by looking for unique patterns of words.

4:22So if there's only images in the file,

4:24well, it's not going to work.

4:26Thirdly, files greater than 10 megabytes in size.

4:32So if your file is larger than 10 megabytes,

4:34DLP will not be able to scan it and perform this analysis.

4:40And then lastly, a document that was altered,

4:44and it doesn't contain the original fingerprint.

4:48So an example of this instance here

4:51is if you had a template, and everybody used

4:55it to request purchases maybe.

4:57It's your purchase order request form.

4:59All right, and then one day you decide

5:02we're going to update this form to include

5:04a couple of new fields.

5:06Well, guess what, this signature that you

5:08have created for this document is now invalid

5:11because the signature doesn't match.

5:13So this brings to point that we need to update our signatures.

5:20If we ever update the form that we create a signature for,

5:23well, we need to update that signature as well,

5:25because that signature or fingerprint will

5:28change at that point.

5:29All right, now that we know what the document fingerprint is,

5:32we get an idea about how to create it

5:34and when it will not work.

5:37It's time to go ahead and take a look at creating one of these

5:40now.

5:40We can only do this through PowerShell at this point.

5:43So we're going to jump into our server,

5:46and we're going to go ahead and create a document fingerprint.

5:50All right, here we are on our server here.

5:52And I have an administrator PowerShell open here.

5:55So let's take a look at the commands down here.

5:57All right, here we go.

5:58So first we're going to connect to Microsoft

6:00using Connect IPPSSession, provide a user principal

6:05name of me.

6:06And that's going to get us connected in there

6:08so we can use the DLP commands.

6:10I've seen that you can also use connect to Exchange Online.

6:13But oftentimes not all the commands

6:16are there when I do that so I prefer to use this here.

6:19And then here are the commands we're going to run.

6:22We're starting off with by creating

6:23a variable ACME_Designs.

6:25We're going to use PowerShell to read in the contents of that

6:29file, and the file sits on my desktop, ACME-Design.pptx,

6:33so it's a PowerPoint with our design in it.

6:36And, again, what's going to happen

6:37is DLP isn't going to read through all the text in there

6:41and create a fingerprint from the text.

6:43And then we end up creating a variable for our fingerprint.

6:47And we're going to base it on our ACME_designs file,

6:51and we're going to give it a description.

6:52So at this point we have a fingerprint.

6:54Then we need to tie that fingerprint into a DLP

6:57sensitive information type.

6:58So we're going to create a new DLP sensitive information type,

7:02we're going to give that a name, "ACME Design Document."

7:05Reference that fingerprint so we can attach it there,

7:08and then give it a description.

7:09Pretty straightforward.

7:11Now before we jump in, I want to look at the Microsoft

7:13documentation real quick, and actually

7:15take a look at our drawing.

7:16So this is my ACME-Design-Pptx.

7:19I'm going to open that up here in the web PowerPoint

7:22just so you can see what it looks like.

7:24It's very generic, very simple.

7:25And this is the only words, right here

7:28these are, here in this document.

7:30So it's going to look at design, date, approved by.

7:33And, of course, it's going to try

7:36to then create a fingerprint from this information.

7:39And where it is in the document and how

7:42they are placed in relation to each other.

7:45So there's the drawing.

7:46And if we go over to the Microsoft documentation,

7:50this is it.

7:50I'm going to scroll up here to the top talking

7:52about document fingerprinting.

7:53And you can read through this.

7:55But what I want to show you down here

7:56is that there are only certain file types that are supported.

8:00So if we click on this link, it's

8:02going to open this up here.

8:03And this is the table of acceptable file types

8:09that can be used to create a document fingerprint.

8:11Here we have Office 2007 and later, so all these.

8:15So there we go, it looks pretty good.

8:17Small office 2003.

8:18Other office files, Adobe PDF, HTML, XML, some text files.

8:23And as we scroll down, there's some open documents

8:27AutoCAD drawings.

8:28So if we use AutoCAD to create a DXF file for this part drawing,

8:33well, hey, that would work for us as well.

8:35And there are some images in compressed file archives.

8:38So just keep in mind that there are limitations on the file

8:43types that can be used for this, but you still

8:46have a pretty good selection.

8:47So what do you say we go ahead and create this document

8:49fingerprint already.

8:51So let's go up here, let's go ahead and grab this.

8:55And I'm going to paste it in here, there it goes.

9:00It's connecting now.

9:02Yeah, right, I'm connected.

9:03And it didn't ask me to authenticate

9:05because I had done so just a few minutes ago in testing

9:08to make sure this is going to work

9:10exactly right the first time.

9:11All right, there we go.

9:12So now I'm going to copy these commands down here that we

9:16talked through just a couple of minutes ago,

9:18we're going to copy those.

9:19Let's go ahead and paste those in here.

9:21And actually before I do that--

9:23wait a second, let's go over here.

9:25Let's go over here to our Compliance,

9:28let's go to Data classifications,

9:31let this load up.

9:32Then we're going to go to our sensitive information types

9:34because I want to show you that this doesn't exist yet.

9:36There's no smoking mirrors here, folks.

9:39All right, there we go.

9:40This is pre-loaded, our 263 sensitive information types.

9:44And if I filter by type, I've got BundleEntity, then Entity.

9:49And if I go again I just have Entity.

9:51So I only have those two types right now.

9:54And if I go here and filter by Publisher,

9:56up and down you won't see Microsoft Corporation here.

9:59There's nothing from Nugget Labz.

10:01All right, so we can see that it's not there.

10:03So now I'm going to go ahead and paste these in, there we go,

10:06hit Enter.

10:07And this does take a few minutes, actually,

10:10because it's going to upload that

10:11file to DLP, DLP is going to perform analysis on the file,

10:15creating the fingerprint.

10:16At which point, it's going to go ahead and take that fingerprint

10:20and create that new DLP sensitive information type.

10:22And it went much faster than in testing.

10:26Excellent, hey, that's pretty cool.

10:28All right, so we didn't get any errors, it doesn't look like.

10:31Let's just make sure up here.

10:32Nope, I don't see any errors.

10:34So let's go back here and let's do a refresh now,

10:38refresh there.

10:39Give that a minute to refresh.

10:41And look at it right there at the top, ACME Design Document,

10:44fingerprint is the type.

10:45And that is our NuggetLabz.onmicrosoft.com,

10:49super.

10:50So if I click on there it says the description design document

10:53owned by ACME.

10:54And if we go down here to my command,

10:56that was the description I gave right there.

10:59And that's how we go about creating a document

11:01fingerprint.

11:02Now we could go to create our DLP rules for Exchange Online,

11:07and we can use this sensitive information type

11:11to help identify those sensitive documents that

11:15are in our environment.

11:16I hope this has been informative for you,

11:18and I'd like to thank you for viewing.

0:00[MUSIC PLAYING]

0:06So we've been looking at sensitive information types,

0:09and we've been dealing with creating patterns and matching

0:12on patterns and such.

0:14But maybe we have a list of key words

0:16that we want to match on-- not necessarily a pattern,

0:18but exact words.

0:20Wouldn't that be interesting?

0:22So we can actually have a list of all of our part numbers

0:25in it, and we could use that to match against.

0:27So let's look at how we might do that.

0:30All right, here we are in Microsoft Purview.

0:32I'm going to go down here to Data Classifications, Sensitive

0:35Information Type.

0:36There we go.

0:37It loaded up.

0:38And what we're going to do is creating a keyword dictionary.

0:40Now, this is simply a list of words

0:42that we would want to use to classify something

0:45as sensitive information.

0:46For example, maybe we're going to match against anything

0:49that includes one of our part numbers

0:52that are actively being used.

0:53Now, let's go ahead and look at how to do that.

0:56We would go in here to create a new sensitive information type.

0:59So I'll click on that and let that load up.

1:01Now, while this is loading, there

1:03is a limit of 50 keyword dictionary

1:06sensitive information types per tenant.

1:08So not 50 words per dictionary.

1:10Not that, but 50 dictionary sensitive information types.

1:14So what creating now--

1:15I can only create 50 of these per tenant.

1:17So just keep that in mind.

1:18So we're going to put ACME hyphen Part hyphen Numbers.

1:22There we go.

1:23We'll say these are the ACME part numbers.

1:26Excellent.

1:27Now we'll say, Next.

1:29And what we're going to do is we're

1:31going to create a new pattern.

1:33So we'll say, pattern.

1:34And I'm going to go with medium confidence.

1:36Since I'm only matching on this one thing

1:40and I'm not providing any supporting elements,

1:42then I'm going to go with medium confidence, OK?

1:45So I'm going to add that primary element.

1:47And it's going to be a keyword dictionary.

1:50And what I'm going to do here is you

1:52could choose from existing dictionaries

1:54or upload a dictionary.

1:55I'm going to say, upload a dictionary.

1:57And it has to be a text or CSV.

1:58I'm going to select CSV.

2:00I'm going to select ACME Part Numbers.

2:02Open that up.

2:03And there it goes.

2:04It went ahead and populated all the data I had in there.

2:07And this is just some sample part numbers.

2:09So here, we're going to say the name for this list is part

2:12hyphen numb dash dictionary.

2:17There we go.

2:17Super.

2:18Go ahead and say, Done.

2:20It's going to upload those.

2:22All right, excellent.

2:23So it's that simple.

2:25I now have my dictionary here that I'm using.

2:28Now, if I wanted to provide supporting elements, I could.

2:31It would make it more accurate.

2:32But in this instance, I'm just looking

2:33for anything that contains a part number, all right?

2:36So I'm going to go ahead and say, Create, Next.

2:40And this is a medium confidence level.

2:43Next.

2:44Create.

2:45Excellent.

2:46Say Done.

2:48There it goes.

2:50All right, and here is our ACME Part Numbers.

2:54I'm going to click on that there.

2:55It's going to open this up.

2:56And we're going to run a test just like we did before.

2:59We're going to say Upload File.

3:00I'm going to say, Documents.

3:02Let's go over to the design right there.

3:05It has that part number in it.

3:06I'm going to say, Open Test.

3:08And it found the part number.

3:09Excellent.

3:10Finish.

3:11I'm going to test this again.

3:12This time, I'm going to upload the one that

3:14has no part number in it.

3:15Say, Open and Test, and it should come back with nothing.

3:20And it did.

3:20No sensitive information was found.

3:23All right, so I'm going to finish that.

3:25And there we go.

3:27Now, I do want to mention, when you're using a dictionary,

3:30if you're only using that one dictionary and you're not

3:32using any supporting elements, you're just

3:34looking for that one pattern or a list of patterns really, yes.

3:38But the idea here is, if I were to use this ACME Part

3:41Numbers in search for things, it's

3:43going to hit on anything with a part number in it.

3:46So it could be an email.

3:47It could be somebody has a document with one part

3:50number in it.

3:50And it's not sensitive really.

3:52It's not going to match, necessarily, only on drawings.

3:55The design drawings and support elements,

3:57it's going to be much more accurate.

4:00So when you're using these, it's better off

4:02to use them to identify certain types of data.

4:06And just keep in mind that it's not

4:07going to be all that accurate.

4:09So I just want to plant that seed

4:12so you understand that without the supporting elements,

4:14it's not really that accurate.

4:16And don't like to use those a whole lot.

4:18Much rather use something with supporting elements.

4:21And maybe it's that you want to use supporting elements,

4:24and you use two dictionary files.

4:26One is your primary pattern, and then one

4:28is a supporting element.

4:29You could always do that as well.

4:30So that is how we create and use keyword dictionaries.

4:34I hope this has been informative for you.

4:35And I'd like to thank you for viewing.

0:06We're continuing with trying to identify

0:08different types of data.

0:10And we've done so via sensitive information types.

0:13But there's something else called a trainable classifier.

0:18It sounds pretty interesting.

0:19Well, it really is.

0:21So let's jump in and take a look at trainable classifiers.

0:24All right, so the question is on everybody's mind,

0:28well, what is it?

0:30Well, a trainable classifier is a way to create a classifier.

0:34So this classifier here allows us to classify data.

0:38It identifies specific data and then classifies it

0:41as something, something like adding

0:43a label to it, very similar.

0:45And it allows us to use machine learning in order to identify

0:51data through a classifier.

0:54And it does this by learning.

0:56So what we do is we create what's called seed content.

1:01And this really is sample data.

1:02I'm going to put that down here, samples.

1:05And we take those samples, and we

1:07have the ML read that seed content or those samples,

1:11and analyze those samples.

1:13And then create a classifier based

1:17on its analysis with machine learning of those samples

1:21or seed content.

1:23Now, once this is completed and we have a classifier,

1:27well, we can use it to do things.

1:29We can do things apply sensitivity labels,

1:33or apply compliance requirements,

1:36or even apply retention label policies.

1:40So the idea is we can take some samples,

1:43use machine learning to analyze it,

1:46and then create a data classifier from that

1:49that we can use within our compliance activities.

1:53So that's pretty darn cool.

1:55Now the question comes up, well, why would we

1:58really want to use this one?

2:00This type of identifier over something

2:04like sensitive information types?

2:06Well, this is really handy for identifying

2:09certain types of documents used within an organization.

2:12And generally, this comes into play

2:15when the content that we're analyzing, that content

2:19is not easily identified by using automated pattern

2:24matching.

2:26And it's when we have this scenario, when

2:28we're having a lot of false positives

2:30and we're just not able to get these types of documents

2:34identified using sensitive information types,

2:37when those aren't working for us,

2:39then it's time to take a look at trainable classifiers.

2:43Now a couple of examples of this is

2:46when we're looking for things like profanity,

2:48threatening language, resumes, believe it or not,

2:52and discrimination.

2:54Now, several of these, like the profanity,

2:56threatening language, and discrimination,

2:58really are different.

3:00We're generally not looking for these things

3:02when we're looking at identifiers,

3:04we're trying to find data, we're looking for sensitive data.

3:07Well, sometimes we need to identify other types of data

3:11as well.

3:12And that's oftentimes when we move to a trainable classifier.

3:17Now the next question is, well, when

3:19would we use to choose a trainable classifier

3:22over another sensitive information type

3:26that we're dealing with?

3:27Well, it comes down to a couple of scenarios.

3:29Number one, we can manually assign our sensitive data

3:34types.

3:34And when we're doing that, well, oftentimes we

3:38run into human error because it comes down to a person's

3:43judgment to make that decision.

3:46And oftentimes we will want to avoid that.

3:48So we may need to look at another option,

3:51such as a trainable classifier.

3:54Then number two, we have our pattern

3:57matching that we can use as well.

4:00But sometimes those have a hard time identifying the type

4:05of data we're looking for.

4:06So they really don't work too well in some situations.

4:10And then when both of these--

4:12when they're having a problem, I properly

4:15identifying the type of data we're looking for,

4:17that's when we need to go to a trainable classifier.

4:22Now there are actually two types of trainable classifiers.

4:26We have what are known as, number one

4:28we have pre-trained classifiers.

4:31And these are classifiers that Microsoft has created

4:34and provided to us to use.

4:37And then number two we have custom classifiers.

4:41And these are the ones that we create ourselves.

4:43So the next question is, well, how

4:45do we get started with creating a custom trainable classifier?

4:49So getting started.

4:51Well, when you go into your Data classification

4:53for the first time and go under Trainable classifiers,

4:56you're going to receive this pop up window.

4:59And it's going to say, get started

5:01with trainable classifiers.

5:03And a global administrator has to go ahead and click on Start

5:08skinning process.

5:10Now the thing is, this is going to kick off the scanning of all

5:13of your datas within Microsoft 365,

5:15and it's going to go through and look at what you have.

5:18It's going to try to identify certain things.

5:20Now the thing is it will take seven to 14 days

5:25for the scanning to complete.

5:28Just keep that in mind.

5:29This is not something you're going to jump in there

5:31and set up in one day.

5:33Just doesn't happen that way.

5:34So keep that in mind, and you use

5:37that in your timing and planning as needed.

5:40But, remember, if you don't do this

5:42when you go into your Trainable classifiers,

5:45the Create trainable classifiers button will be grayed out

5:49and you won't be able to create one.

5:50All right, once you click on this, and it goes through,

5:52and it finishes, and it's seven to 14 days later,

5:55and you're create trainable classifiers

5:57button is not grayed out, and you can click on it,

6:00then we can take a look at how to set this up.

6:03So here's how we do this, we go and we create a new SharePoint

6:09site, this has to be SharePoint, or we use

6:12an existing SharePoint site.

6:13We create two new folders that you see here, here's one,

6:17here's the other.

6:18They don't have to have any type of name in particular,

6:20but you need to name them something.

6:22And I would recommend something like TC,

6:25for trainable classifier, - seed, because that's our seed

6:30data or our sample data.

6:32And then another one TC - train.

6:35And we'll talk about training here in a moment.

6:38So now that we have these folders created,

6:40we need to upload some samples.

6:42So we need to upload between 50 and 500 examples of what

6:48we're looking for, all right.

6:50So you have to have at least 50.

6:52So we're going to say, we're going

6:53to upload 50 examples into our Seed folder of the type of data

6:58that we want our trainable classifier to identify.

7:02Excellent.

7:03Once we do that, we need to upload at least 200 documents

7:09into our training folder.

7:11Now this should be a mix of documents

7:14that match our classifier, and do not match our classifier.

7:23And you do not want to use any of these Seed documents

7:26in here.

7:26Don't do that.

7:28We need a separate example.

7:29So the idea is you'd probably upload 75 or 100 documents that

7:35match the data you're looking for,

7:37and then some others that are just

7:39random data that don't match.

7:40And we're going to talk about why

7:42we would do that momentarily.

7:43Now once we upload all that data into those folders, well,

7:46there's a period we need to wait.

7:48We need to wait about 24 hours for everything to be indexed

7:53and crawled, and everything on the back end

7:56set up and doing what it needs to do, OK.

7:59Then we can go into our Trainable classifiers,

8:01click on that Create trainable classifier button here.

8:05And then you're going to go through and create

8:07a name for it.

8:08And you're going to point it to the folder where

8:11your Seed data resides, OK.

8:14And then they're going to click Create,

8:15and it's going to go through and it's

8:17going to take a few hours to go ahead and create that.

8:20Once it's created, it's time to train our classifier.

8:26Now the way this is done, once it's created, you go in

8:29and you click on the link that says Add items to test.

8:34So you're going to have a link that says Add items to test.

8:39You're going to click that link, and you're

8:41going to point it to your training folder.

8:43And then it's going to go through and it's going

8:46to identify which of those match your classifier and which

8:50don't.

8:51And once it completes that, if you

8:53go into your trainable classifier,

8:54you're going to get some statistics,

8:56let's say exactly how well it did at matching.

8:59And then you're going to have a link

9:02to go ahead and publish that trainable classifier so you

9:06can start using it.

9:07Now these statistics may not look so hot,

9:10maybe it's like a 72% matching or something.

9:14Well, at that point you're going to need to do something

9:16called Re-training.

9:19And that's when you go into your Trainable classifier,

9:22and there's a tab in there that says Tested items to review.

9:28So you want to go and click on that Tested items

9:31to review tab.

9:32And it's going to show all the items, the documents,

9:36that it tested.

9:37And what you need to do is go through each of them.

9:39You click on that item, and then you're going to get an option.

9:43There's a button that says match or not a match.

9:47And you're going to need to select if it does match

9:50or if it does not match.

9:52And this is kind of a manual process of retraining

9:56and telling the machine learning, hey,

9:59this one is a match.

10:00So that's good, add that to your data set.

10:03This one is not a match, ignore these types.

10:06So we're kind of manually re-training.

10:07And the key with this, you have to do at least 30

10:12of these manual reviews.

10:14That means you have to click on at least 30

10:17of these documents in here, in your Tested items

10:20to review tab, and say if it's a match or not a match.

10:23That's a key number there.

10:25So once you hit 30, it's going to go into a re-training state.

10:29And it's going to take that information you provided to it,

10:32and it's going to provide some additional machine learning

10:35activities around that and really focus in on those

10:39and try to improve our number over here.

10:42So we get from a 72 to maybe like

10:45an 85% match or a 90% match.

10:48So that's how we go through and set this up.

10:51Now before you can do this, you've

10:53got to have the right licensing requirement.

10:55So let's talk about that really quick.

10:57So you need to have either a Microsoft 365 E5

11:05license, or the Microsoft 365 E5 compliance feature license.

11:13So those are what you've got to have, Microsoft 365 E5--

11:17let's make that three a little better there, there we go--

11:19or the Microsoft 365 E5 compliance license feature.

11:25And then lastly, what kind of permissions

11:27are needed to do this?

11:28Well, first of all, we need a global admin permissions.

11:33And that is to do that opt-in.

11:35It's referred to as opt-in when we click on the image.

11:40Let me bring this image back up here.

11:42This one right here.

11:44When we click on this Start scanning process

11:46to kick off our trainable classifiers process,

11:50you have to have a global admin permissions in order

11:53to do that.

11:53And that's known as-- let me put that over here--

11:56opting-in.

11:57That's what that opt-in is, all right.

12:00Now secondly, after that's done, you

12:03can use the compliance administrator permissions

12:07to perform classifier training.

12:09So you don't have to be a global admin

12:11to perform classifier training, you

12:13can use your compliance administrator permissions.

12:16And there we go.

12:17That is trainable classifiers, what they are,

12:19why we would want to use them, when we'd want to use them,

12:22how we create them, the licensing required,

12:25and, of course, the permissions needed.

12:27I hope this has been informative for you,

12:28and I'd like to thank you for viewing.