Data Loss Prevention for Email

To help protect ECU information and avoid the accidental breach of sensitive data, Microsoft's Data Loss Prevention (DLP) component scans outgoing email for certain "markers." For example, DLP may flag digits formatted like a social security number (xxx-xx-xxxx) or a long string of numbers near a date that could indicate a credit card number. Since DLP cannot read the message but only filters for certain formatting, you must make the final decision for encryption. No one is reading your email. Encrypted messages are delivered straight to the recipients while unencrypted messages sent outside the ECU network are checked against the sensitivity markers. If the message meets certain criteria, the following happens:*

1. High Sensitivity. Messages are encrypted and delivered. Senders are reminded of the encryption policy through an email.
2. Low Sensitivity. Sensitive messages are delivered unencrypted. Again, senders are reminded of the encryption policy through an email.

Here is what all users sending sensitive information should do:

1. Encrypt emails containing sensitive data addressed to non-ECU users by typing [ sendsecure] in the subject line or setting the Confidential tag. See the email encryption page for exact instructions with screen shots.
2. Make sure that sensitive pdf files have Optical Character Recognition (OCR) applied to make the text searchable. Images cannot be read by the DLP filter.

*Transition to Microsoft 365 solution

ECU has begun the transition to the newest Microsoft 365 DLP option beginning with emailed Payment Card Industry (credit card) information on June 1, 2021. This updated solution enables data protections throughout the entire 365 suite, including Exchange Online (email), OneDrive cloud storage as well as SharePoint and Teams collaboration services. Over the next few months, PII, HIPAA and FERPA data will transition to the new DLP version and the other 365 components, like OneDrive, SharePoint and Teams, added to the DLP process.

Like the current DLP, new messages with an outside email address are scanned to detect possible PCI information. If possible PCI information is detected within an email, the new system:

1. Encrypts the message (as usual).
2. NEW - Shows an Outlook tool tip explaining the PCI policy. To learn more, see this Financial Services website on Payment Card Industry policies at ECU.
3. NEW - An incident report is sent to the PCI data steward for possible follow up.
4. If the email is sent, the sender receives a notification with additional policy information (as usual)
   
   
   

Learn More

For more information on sensitive data at ECU, see these websites:

• Email Encryption
• Guidelines for Protecting Sensitive Data
• Sensitive Data Storage
• Social Security Numbers
• FERPA
• Payment Card Industry (PCI)