CrowdStrike Falcon Data Security: Real-time Data Movement Monitoring and Protection

CrowdStrike's Falcon Data Security is designed to address the challenges of protecting sensitive data in modern, distributed environments. The solution focuses on discovering, classifying, and securing data across endpoints, browsers, SaaS applications, cloud services, and GenAI tools. Traditional data security approaches often struggle to keep pace with the dynamic nature of data movement within organizations. Falcon Data Security aims to provide real-time visibility into how data is accessed, transformed, and shared, enabling security teams to detect and prevent data theft. It leverages a unified Falcon sensor and platform context for comprehensive investigation and response capabilities. The platform is designed to help organizations secure their most critical information against a range of risks, from employee mistakes to malicious insider activity, or adversaries operating with valid credentials to steal data.

Attack Chain

This brief describes the capabilities of Falcon Data Security, not a specific attack chain. However, we can infer potential stages of an attack that Falcon Data Security is designed to mitigate:

1. Initial Access: An attacker gains initial access to an endpoint or cloud environment, potentially through compromised credentials or exploiting a vulnerability.
2. Data Discovery: The attacker attempts to locate sensitive data, such as PCI, PII, or PHI, within the environment.
3. Data Access: The attacker accesses sensitive data, potentially through a legitimate application or service.
4. Data Exfiltration: The attacker attempts to move sensitive data out of the authorized environment via web uploads, removable media, or cloud services.
5. Egress Channel Selection: The attacker selects an egress channel to use for data exfiltration, such as a web browser, file sharing service, or direct API access.
6. Data Transformation: The attacker may transform the data (e.g., compress, encrypt) to evade detection during exfiltration.
7. Data Transmission: The attacker transmits the stolen data to an external location.
8. Impact: Sensitive data is compromised, leading to potential financial loss, reputational damage, and legal liabilities.

Impact

Successful data breaches can result in significant financial losses, reputational damage, legal liabilities, and regulatory fines. Industries such as healthcare, finance, and retail are particularly vulnerable due to the sensitive nature of the data they handle. The impact can range from individual identity theft to large-scale compromise of customer data, potentially affecting millions of individuals. By providing real-time visibility and control over data movement, Falcon Data Security aims to mitigate these risks and prevent data breaches before they occur.

Recommendation

• Deploy the Falcon Data Security solution to gain real-time visibility into data movement across your environment.
• Configure the classification engine to accurately identify sensitive data types relevant to your organization (PCI, PII, PHI) as described in the overview.
• Implement policies to detect and prevent risky data movement, such as unauthorized data exfiltration attempts via removable media or cloud services as mentioned in the "See and Stop Risky Data Movement in Real Time" section.
• Integrate Falcon Data Security alerts with your existing SIEM or SOAR platform to facilitate rapid investigation and response using the Falcon platform context.
• Enable Sysmon process-creation logging to enhance visibility into processes accessing and moving sensitive data.