# Endpoint Security is now part of Endpoint Central ## Endpoint Data Security ## Sensitive data discovery & classification Sensitive data discovery is the process of finding and classifying sensitive information within an organization's endpoints. Information sensitivity is a set of methods for controlling access to sensitive data that could harm a company if it is revealed to others. By identifying and monitoring this type of data, such as personally identifiable information (PII), financial records, and health records, organizations can ensure that their sensitive data is protected. ### How is endpoint data discovery implemented? Endpoint Central has a complete endpoint sensitive data discovery mechanism with the following capabilities: - Helps to comply with regulations: Many regulations require businesses to have safeguards in place to protect customer data. Data mirroring can help businesses to meet these requirements. - Perform a forensic evaluation of the data to gather qualitative and quantitative insights, which admins can use to gain a better understanding of their data. - Identify the users and endpoints associated with particular types of data, which is important for mitigating data loss and insider threats. - Once the location of data is known, it is scanned for further analysis. Data discovery is the first step in data classification. ### Why is data classification important? Businesses collect a vast amount of data at any given time, including sensitive information that may be transferred inadvertently during informal exchanges. Data classification software helps administrators identify and protect sensitive data by distinguishing between harmless information and confidential information that requires safeguarding. #### Data classification ![endpoint-central-data-classification](https://www.manageengine.com/products/desktop-central/images/endpoint-central-data-classification.png) ## Data leak prevention Data loss prevention (DLP) is a critical security strategy for protecting sensitive enterprise data from theft, loss, or unauthorized access. A comprehensive DLP solution includes tools for data discovery and classification, data transfer and access control, policy and incident management, and detailed auditing and alerting. ### Why is DLP essential? DLP prevents the impact of data loss and theft, which can have devastating consequences for businesses. For example, a data breach can lead to: - Financial losses from fines, lawsuits, and customer churn - Damage to reputation and brand trust - Loss of competitive advantage - Regulatory compliance violations ### How does data loss happen? **Data loss can happen in a variety of ways, including:** - Human error Accidental deletion, overwriting of files, or sending data to the wrong person. - Physical loss or theft Laptops, mobile devices, and other storage devices can be lost or stolen. - Cyberattacks Malware, ransomware, and phishing attacks can all lead to data loss or theft. **DLP helps to mitigate these risks by:** - Identifying and classifying sensitive data so that it can be protected more effectively - Enforcing policies to reduce the risk of human error - Monitoring and controlling data transfer and access to prevent unauthorized users from accessing sensitive data - Auditing and alerting on data activity so that organizations can quickly identify and address potential problems - Detecting and responding to data breaches and other security incidents ### Do you need a DLP solution? Any organization that collects, stores, or processes sensitive data should consider implementing a DLP solution. DLP is especially important for businesses in regulated industries, such as healthcare, finance, and government. #### Data loss prevention ![endpoint-central-data-loss-prevention](https://www.manageengine.com/products/desktop-central/images/endpoint-central-data-loss-prevention.png) ## Containerization It's a technology that creates a secure, isolated workspace on a personal device. This "container" holds all the corporate apps, data, and configurations managed by Endpoint Central. Personal data and applications remain separate from the corporate container, enhancing data security without compromising user privacy. BYOD offers advantages like increased employee productivity and reduced device costs. However, it also raises security concerns because the organization doesn't have complete control over the device. Containerization addresses this by: - **Segregating corporate and personal data** Work apps and data are isolated within the container, preventing unauthorized access from personal apps or malware. - **Enhanced data security** Even if the device is lost or stolen, corporate data within the container remains secure. IT admins can remotely wipe the container without affecting personal data. - **Improved user experience** Employees can keep using their personal devices for work purposes without worrying about compromising their privacy. ### How does containerization work? - **Android** Endpoint Central typically leverage Android's "Work Profile" feature during device provisioning. This creates a separate, secure work environment for corporate apps and data. Work apps are easily identifiable and cannot interact with personal apps or share data outside the container. - **iOS** While Android offers a built-in Work Profile, iOS relies on containerization software like Endpoint Central. This software creates a secure container on the device specifically for work apps and data. IT admins can configure additional security measures to ensure corporate data remains protected. - **Managed Web Domains** This feature allows you to designate specific websites. Documents downloaded from these sites can only be accessed and stored within the ME MDM app container, adding an extra layer of security for confidential information. - **Virtual Private Network (VPN)** Using a VPN encrypts data transmitted over the internet, protecting corporate data accessed from personal devices. For even tighter security, consider "per-app VPN." This creates a secure tunnel specifically for data accessed through designated work apps within the container. ## De-provisioning wipe When it's time to retire a device or reassign it to a new employee, you can choose between two "wipe" methods to prepare the endpoint for its next chapter: **1. Corporate wipe: BYOD-friendly** This targeted wipe removes all configurations and applications deployed through Endpoint Central. Personal data remains untouched, making this ideal for Bring Your Own Device (BYOD) scenarios. Here's what gets removed: - **Corporate configurations** Wi-Fi settings, security policies, and any other managed profiles are erased. - **Endpoint Central applications** Any apps installed and managed by your Endpoint Management system will be uninstalled. Importantly, the Corporate Wipe does not affect: - **Personal data** Your employees' photos, documents, and other personal files remain safe. - **Pre-installed applications** Factory-installed apps and any non-Endpoint Central applications are left untouched. This option is perfect for BYOD situations when an employee leaves the company or changes roles. They can keep their device for personal use while ensuring corporate data and access are completely removed. **2. Complete wipe: Starting fresh** For a complete clean slate, the Complete Wipe erases all data from the endpoint. This is ideal for devices that will be used by new employees or for situations of device compromise. Here's what gets wiped: - **Everything on the device** This includes operating system data, applications (both personal and corporate), user accounts, files, and settings. - **SD card data** For devices with expandable storage, you can choose to wipe the data on the SD card as well. (This applies to devices with features like Samsung SAFE and KNOX). After a complete wipe, the device essentially becomes "like new" and is ready to be reassigned and configured for a new user. ## Trace and mirror files Data mirroring is a security measure that creates copies of sensitive data on USB devices when they are connected to a network. This data can then be stored in a secure location, such as a password-protected network share. Data mirroring software can be used to configure policies to ensure that data mirroring happens whenever any file action is carried out on a USB, or just when specific file actions are performed. Details regarding the file operation, such as file name, users, devices, endpoints involved, and the time of action, can also be recorded. ### Benefits of data mirroring - Protects corporate data from theft or loss: If a USB device is lost or stolen, the data can still be accessed from the secure network share. - Helps to comply with regulations: Many regulations require businesses to have safeguards in place to protect customer data. Data mirroring can help businesses to meet these requirements. - Provides visibility into data movement: Data mirroring can provide organizations with valuable insights into how data is being moved around the network. This information can be used to identify and address potential security risks. ### Considerations - Bandwidth and disk space requirements: Data mirroring requires considerable bandwidth and disk space. Businesses need to carefully consider their needs before implementing a data mirroring solution. - Policy configuration: It is important to carefully configure data mirroring policies to ensure that the right data is being mirrored and that the data is stored in a secure location. Overall, data mirroring is a versatile and powerful tool that can be used to improve the security, compliance, and performance of IT systems. #### Device access control ![endpoint-central-file-tracing](https://www.manageengine.com/products/desktop-central/images/endpoint-central-file-tracing.png) ## Data Encryption Endpoint Central is a unified endpoint management and security (UEMS) solution that enables IT administrators to seamlessly manage BitLocker encryption on Windows devices across their networks. This helps organizations to ensure that their data is encrypted and protected from unauthorized access, even if a device is lost or stolen. ### Benefits of using Endpoint Central to manage BitLocker encryption: ![centralized_management](https://www.manageengine.com/ems/images/icon/centralized_management.svg) #### Centralized management Endpoint Central provides a single console for managing BitLocker encryption on all Windows devices across the network. This makes it easy for IT administrators to deploy and enforce BitLocker encryption policies, and to monitor the encryption status of all devices. ![aut_enc](https://www.manageengine.com/ems/images/icon/aut_enc.svg) #### Automated encryption Endpoint Central can automatically encrypt Windows devices based on predefined policies. This eliminates the need for IT administrators to encrypt each device manually, and helps to ensure that all devices are encrypted consistently. ![reporting](https://www.manageengine.com/ems/images/icon/reporting.svg) #### Comprehensive reporting Endpoint Central provides comprehensive reports on the BitLocker encryption status of all devices. This helps IT administrators to identify and address any encryption issues quickly and easily. ### How Endpoint Central can help organizations manage BitLocker encryption seamlessly: ![deploy](https://www.manageengine.com/ems/images/icon/deploy.svg) #### Deploy and enforce BitLocker encryption policies Endpoint Central can be used to deploy and enforce BitLocker encryption policies on all Windows devices across the network. This includes configuring BitLocker encryption settings, such as password complexity requirements and encryption recovery key management. ![monitor](https://www.manageengine.com/ems/images/icon/monitor.svg) #### Monitor the encryption status of all devices Endpoint Central provides a real-time view of the BitLocker encryption status of all devices across the network. This helps IT administrators to identify and address any encryption issues quickly and easily. ![manage_bitlocker](https://www.manageengine.com/ems/images/icon/manage_bitlocker.svg) #### Remotely manage BitLocker encryption Endpoint Central allows IT administrators to manage BitLocker encryption on Windows devices remotely. This includes tasks such as encrypting and decrypting devices, and resetting the BitLocker recovery key. #### BitLocker Management ![endpoint-central-data-encryption](https://www.manageengine.com/products/desktop-central/images/endpoint-central-data-encryption.png) ## Frequently Asked Questions ### 01. What are the key components of a strong endpoint data security strategy? A strong endpoint data security strategy includes data discovery and classification, strict access control, encryption for data at rest and in transit, regular patching, continuous monitoring, and incident response. ### 02. How does data encryption work to protect information on endpoints? Encryption converts readable data into ciphertext using algorithms and keys, making it unreadable to unauthorized users. It protects stored data and secures information during transmission, ensuring only authorized users can decrypt and access it.