This article was originally posted on The TechSoup Blog on August 15, 2016. 

Are you a nonprofit with security needs? Are you curious how large technology corporations set, evaluate, and grow their corporate social responsibility (CSR) programs? Do you have ideas on how Symantec and TechSoup together can better support nonprofits?

We are inviting you to reach out and speak with Symantec's corporate social responsibility team. This is the first in a "Get to Know" CSR series.

Join our inaugural Get to Know Twitter chat with Jaime Barclay from Symantec on August 25, 2016 from 1 to 2 p.m. Pacific time. Using the hashtag #GetToKnow, send us your questions and follow the conversation on Twitter.

Jaime will share insights from her 10-year career at Symantec. She's worked with all aspects of Symantec's community relations programs, including employee engagement and cash and in-kind donations.

Jaime currently oversees the global implementation of Symantec's community investment programs. These encompass a $24 million cash and software donation portfolio that touches more than 20,000 nonprofits annually.

Programs also include the Symantec Foundation and the Symantec Cyber Career Connection. The Symantec Cyber Career Connection aims to fill the need for more entry-level cybersecurity professionals through an alternative training program focused on people of color, women, and veterans.

See you on Twitter!

• When: August 25, 2016, 1:00 – 2:00 p.m. Pacific time
• Where: On Twitter using the hashtag #GetToKnow

This #GetToKnow chat is part of our Mission Possible contest with Symantec. Beginning August 29, 2016, share your nonprofit's story with TechSoup. We want to hear how Symantec helps make your nonprofit mission possible, and you can win $1,000 in prizes!

Hi all,

It's 2016. The year where we see more cybersecurity features/articles/alerts than ever. And that means following the latest news is getting difficult.

My main source of news usually come from Twitter, following a few accounts that deals with exports & security news. They are:

@Symantec, @isecguy, @snowden and a few others.

So, what websites/social media do you use/follow to get the most latest news on security, cybercrimes, 0day, etc that you want to be kept up to date to protect your network/infrastructure?

Do share your news sources so we all can be kept up to date.

Blog Feature Image: 

pixelized woman.jpg

The end of August marks the beginning of school for many children across the world. As students begin their studies there is a lot to look forward to – new schools, new teachers, seeing old friends and making new ones. At the same time, parents are focused on how they can best prepare their children for a safe and successful year. How can they help them enjoy their studies, perform well, have good relationships with friends, stay active….the list goes on.

As our world, and especially our youth, become increasingly connected, how to behave safely and responsibly online is always on a parent’s mind. How can they ensure youth have the freedom to learn, game, communicate and connect with friends online while keeping themselves and others safe as well? This isn’t easy when you consider the facts:

• According to Symantec’s Internet Security Threat Report 2016, there were over one million web attacks against people each day in 2015 and nearly 75 percent of all legitimate websites have unpatched vulnerabilities[1].
• In the US, 92% of teens report going online daily[2], and in the UK one in five 8 to 11 year olds and seven in ten 12 to 15 year olds has a social media profile[3].
• While perpetrators of online attacks are getting savvier, children are using multiple devices to go online including tablets, phones, home and school computers, making it harder to track and protect.

The Family Online Safety Institute (FOSI) is one organization helping arm parents with the digital knowledge to keep their children safe online. FOSI’s mission is to “make the online world safer for kids and their families” and the organization focuses on three key areas to achieve this:

• Public policy: educating government, communities, parents, and youth about online safety trends and resources
• Industry best practice: hosting events that bring together experts in online safety to discuss best practices
• Good digital parenting: providing a suite of tools to help guide parents in how to set the stage for a safe online experience

As a member of FOSI, Symantec supports their initiative, called Good Digital Parenting, and FOSI’s newly launched “How to be a Good Digital Parent” program. Symantec joins FOSI’s 30+ members that represent the world’s leading ICT companies including Amazon, Yahoo! and others. 

The “How to be a Good Digital Parent” program is a suite of tools that prepares parents to host online safety workshops in their community as well as how to safely navigate the web with their children. Through the program, parents will gain a strong understanding of online safety opportunities and risks, as well as mitigation techniques, learn the “7 Steps to Good Digital Parenting” providing a strategy for managing their family’s safety online, and leave the workshop with a new confidence they can effectively manage their children’s safety online. Materials include a PowerPoint presentation, presenters guide, handouts, FAQs as well as an instructional video.

In addition to the workshop materials parents can leverage FOSI’s Good Digital Parenting webpage for numerous tools including the 7 steps, how to clean up your digital footprint and the three moments you should not miss to talk to your child about online safety. Additionally, this month FOSI is featuring a “Back to School with Digital Parenting” monthly series including articles on bringing the online safety workshop to your school, online safety tools and resources, understanding data privacy, a back to school digital reputation check list, raising good digital citizens and more.  

Whether a parent, cousin, uncle, friend, or technology professional, we all have a responsibility to understand the risks that youth face online, how these relate to the opportunities technology offers us, and the role we play in keeping our online world as safe as possible.

Past week was totaly covered with ransomware samples. We came across 2 incidences. While one case had a totaly new sample of binaries, other was not. Actual ransomware binary was getting detected but the downloader was not. Attack vector used in theses cases was a spear phishing email with a MS office macro enabled word document as an attachment. While this method isn't new and is widely used, it is still very effective and bypasses most of the security measures. Writing a macro isn't very complecated.

Though the attack vector used was same; the way in which they fetch the binaries for second stage of attack is different. One of the samples uses a macro to download the ransomware binary from its web server; while othe makes no network connection whatsoever. This second sample creates and executable file in users temp folder which in turn creates a ransomware binary in user’s profile.

So we decided to test two different endpoint protection policies to address these two issues.

Case 1: Macro enabled document downloads the binary from web server.

In this case we observerd that MS word makes a direct network connection to web server and downloads the binary as the macro executes on opening the word document. So we created a rule in firewall policy to block any network connection attempted by MS office binaries(i.e word, excel, powerpoint etc.) on port 80/443; except to internal web servers. This requires 2 rules to be added to policy. 1st rule allows connections to internal web servers. 2nd rule blocks all the connections to 80/443.

Case 2: Macro enabled document creates an executable file in user’s profile

VirusTotal Analysis : https://virustotal.com/en/file/9efc192fae6979799481f42cf411d8c32f1b8e3ad91e2bd3ae72e3506402c5d5/analysis/

In this case, we created an application and device control policy that blocks any attempts of MS office binaries( i.e word, excel, powerpoint etc.) to create executable files.

We tested these policies in test environment and it seems they are serving the purpose.

While this may not be all that we need to protect from ransomware attacks, this will surely offer a good level of defence against MS office macro based attack vectors. We are looking forward to collect and test more sampes against these policies so that we can refine them and make then more robust.

Symantec helps nonprofits make their mission possible. What is your nonprofit's mission? What drives you and motivates you to create change in your community? With the knowledge that your information is safe and that your organization is secure, how can you better focus on your mission?

Symantec and TechSoup are launching a two-week contest today in which you tell us how your mission is made possible with Symantec. Eligible nonprofits can win $1,000 in prizes. The grand prize will be a $500 Amazon gift certificate, with five honorable mentions receiving $100 gift certificates.

Our contest begins today, August 29, 2016 and closes September 11, 2016. Now is the time to send in your nonprofit's story! We'll announce the winners the week of September 26, 2016. Tell us about the change in your community.

Share your story here!

See the document attached for Official Rules.

Lewis Haidt is TechSoup’s Senior Manager, Social Media and Online Community

Blog Feature Image: 

Innovation_Blog_v2.png

Almost a billion websites exist today, yet only about three percent of those sites are encrypted, which means cybercriminals are able to make a good living off of vulnerable sites.

We’d like to see 100 percent of legitimate websites secured by 2018. It’s a challenge we’re putting toward the security industry. To help achieve the goal, Symantec recently launched Encryption Everywhere, a freemium website security package that lets web hosting providers integrate encryption technology into every website from the moment it's created. It's an innovative approach to pricing. Through Encryption Everywhere, providers can offer free basic encryption to all users, and then offer upgrades and premium security packages. It’s time to change the game as an industry.

But change requires innovation. Innovation is something we must constantly bring to the table, whether dealing with new products, customer offerings, business models, or processes. Without continual momentum, we become stale. And if we become stale, then the security industry is in trouble. We need to collectively innovate to move our industry forward.

According to the 2016 Symantec Internet Threat Report Vol. 21, more than three quarters of websites scanned contained unpatched vulnerabilities—one in seven (15 percent) of which were deemed critical in 2015. This puts all of us at risk. To encrypt these websites, it’s up to us, the security industry, to innovate the technology. However, we need to first take a breath, step back, and look at what we’re trying to solve for our customers. I’d like to share my insights on innovation, challenges facing the industry and customers, and some best practices.

Challenges Faced

In my experience, the main challenge is how to balance the appropriate care for a business unit with the willingness to take risks. How do you move forward with technology without disrupting revenue? Many companies recognize this dilemma and attempt a few cursory steps towards “innovation." However, they do so in such small increments, results never materialize. The fear of trying new things causes immobility and stagnation. Then, you’re back to becoming obsolete while cyber threats increase.

On the customer side, security products can be complex; that’s why many hosting providers don’t include it in their offerings. If it is included, it’s fragmented and limited to a subject of what they can offer. Innovation gives us the opportunity to solve problems for the customer. As an example, with Symantec Encryption Everywhere, we’ve made it easy for web hosting providers to integrate, sell, and manage a full suite of security solutions mapped to their business. And this is all done with a single platform. 

Innovation Best Practices

When approaching innovation, we need to simplify everything for our customer. As security leaders, we need to develop new technology that, at its core, is easy to comprehend and use. If not, adoption will suffer. 

Here are a few innovation best practices:

1. Ability to pilot—The digital world moves fast, so we need to pilot changes, make adjustments, and then act quickly. We need to constantly innovate.
2. Look at the problem holistically—We need to take a step back and look at the entire problem. What are we trying to solve? Who can disrupt us (who or what can break us)?
3. Learn from other industries—We need to gather broad information from different industries to see how they approach innovation. What’s working for them? What risks are they taking? This can put us all in a different frame of mind.
4. Partner with innovative thinkers—Collective innovation means teaming up with other organizations that have a similar mindset for constant innovation. As an example, Symantec recently acquired Blue Coat—and we are excited about combining our strengths for some very strong offerings. As our Symantec CEO Greg Clark says,“While the opportunity ahead for us is vast, to seize it, we must apply rigor, move faster and continue to transform.”
5. Take sizeable steps at a healthy pace—Have discussions independently about milestones to be met and timing. Review these at monthly deep-dives to gauge progress. When revisiting new ideas, understand if the idea was bad or if the approach was mistaken. Make the correct course adjustment or decide to stop investing if it’s still not working.

Innovating for the Future

I’m looking forward to the opportunities to further innovate. If you don’t innovate, you become irrelevant. Just this August, Symantec finalized the acquisition of Blue Coat. Combining our technological strengths with Blue Coat allows us to help our customers better protect themselves and to make sure that what’s encrypted is not bad or nefarious.

Predicting the future is difficult, but it’s safe to assume there will be a growing number of things being digitized. Do the creators of connected Internet of Things (IoT) devices know about vulnerabilities? What is our role as security leaders within this growing digitized world? How do we help secure all this? What problems are we solving for our customers? These are all questions we must continually ask ourselves. Innovation often requires constant adaptation, if not re-inventing. When we come together as an industry, we can collectively innovate to help secure our shared, future horizons.

Looking more insights? Be sure to follow read Roxane Divol's other Connect posts and follow her @rdivol 

Symantec’s User Experience team is conducting 1:1 design feedback sessions over WebEx for Advanced Endpoint Protection, a new endpoint solution to protect against targeted attacks.  We are looking for SEP Admins working in large enterprise settings to participate in one 60 to 90-minute long session next week, Wednesday through Friday (9/7-9/9). Additional rounds of design feedback will take place in the coming months.

If interested, please email XRM-symcusabil@symantec.com from your work email with:

1. your name
2. your title and brief description of responsibilities
3. your company / employer
4. the number of endpoints you manage

All participants' employer must be listed as Symantec SEP customers in our Salesforce tool.

Participants will receive a gift card for their participation and will help shape Symantec’s future security products.

We look forward to hearing back from you!

From increasing the diversity of our workforce and industry to reducing our environmental impacts to empowering our communities through philanthropic investments and volunteering, corporate responsibility (CR) touches every aspect of Symantec’s business. We’ve defined our strategy and are continually working towards our goals to operate as a responsible global citizen.

In addition to our dedicated global corporate responsibility team, every day Symantec employees across countries and business units collaborate to deliver on our mission of protecting our customers, our communities and our planet.

We are happy to feature a quarterly series – Inspired, United, Ignited: Symantec’s Corporate Responsibility Champions- that profiles stand out examples of our how our employees directly contribute to the implementation of our CR strategy. Some are leaders in our CR team, members of our Green Teams or champions for our employee resource groups, others are innovating to address needs in their function or region. All are inspiring others, uniting communities and igniting change to make Symantec a leading corporate citizen and to make our world a safer place.

Today we highlight our EMEA CTO & Vice President, Technology Services, Darren Thomson.

As a Chief Technology Officer for the world's leading cybersecurity company, everyday I work across our business to build innovative and market leading products and to keep Symantec on the cutting edge of cyber protection so that our customers and our world can safely leverage all that technology has to offer.

However, what I might not have anticipated over 20 years ago when I began my career, is that my role as a technology professional, and now CTO, would not only encompass products and services, but also the ability to influence the way technology impacts society and our planet.

Could we or Should We – That is the Question

As our lives become increasingly connected, IoT is creating vast opportunities, but it is also broadening the way technology impacts our lives. For example, being more connected makes protection more complex. More devices require resources to make and energy to run. New sources of data provide deeper insights, however, it challenges us to think about how we protect the safety and privacy of users.

This has lead me to think about how we define business "responsibility" by looking at the "could we" AND the "should we". For example, how can and should we anticipate any social risks associated with our products as technology advances? How can and should we optimize products to promote efficiencies and reduce environmental impacts? How can and should we educate our customers to see the business value of environmental sustainability? How can and should I encourage passionate employees to join Symantec in serving our communities?

Asking these questions has lead me to focus on three key areas:

• Engaging customers and employees in environmental sustainability
• Driving efficiencies in our most significant source of GHG emissions, our data centers
• Engaging future STEM professionals 

Environmental Engagement

Incorporating the environment into technology conversations is new for many customers. However, meeting with senior leaders from some of our largest customers, I am in a unique position to have this conversation, to broaden the vision of key decision makers.  For example, how we can work together to drive environmental and cost efficiencies through data center optimization – a win for both of us.  On the employee side, I am the executive sponsor of the Green Teams in the United Kingdom where our employees support environmental initiatives both within and outside of Symantec.

Building our STEM Pipeline

My primary focus is around the third area - encouraging our female youth to consider careers in STEM and helping Symantec reach its goal to excite, engage, and educate one million students in STEM education by 2020.

Out of my team of 100+ employees, female representation was low and I directly felt the challenge of recruiting talented females, especially in technical positions. Additionally, the high-caliber female executives I've met in my career have inspired me to look closely at my role and how I can have the largest impact on female STEM talent. 

Research shows that one of the best times to influence job interests and breakdown common stereotypes is during the younger years so I decided to begin mentoring two teenagers interested in STEM through TEAMCLICK, an innovation event for teenagers. 

The program will last 3-4 years where the girls will gain invaluable experience as they approach their university studies. This will include real-world work exposure, interaction with Symantec employees across a variety of functions, attendance at Symantec events, support on university tours, as well as one-on-one mentorship.

But it is not just me who is doing the mentoring. I am also looking forward to the chance for a fresh perspective on our business, as well as a view into the journey of young students pursuing their passions for STEM.

Broadening our View

As technology professionals, we are often not trained to ask the "should we" questions, however, this needs to change.  We have a personal and industry wide responsibility to look beyond the traditional boundaries of our roles and responsibilities. To look at how we can and should uncover the opportunities of technology to do business in a way that drives value for our business, communities and the world. 

Blog Feature Image: 

ThinkstockPhotos-467517220.jpg

There is really no need to tell healthcare they are under attack - - every headline tells them that.  This is not new nor is it news.  In 2015, the primary cause for loss of data shifted from “accidental” (lost devices, lost back up tapes, jump drives) to external attacks.  None of those “accidents” would’ve been reportable breaches if encryption had been deployed. 

Then came ransomware and if all the details on the “Wall of Shame” since 2009 didn’t get our attention, ransomware should have.  It should have changed how healthcare thinks about data.  Cyber security is neither an IT nor a Security issue.  The data is how you run your business.  No one pays ransom so the DBA can run backups or to make the CIO feel good about his uptime.  Healthcare pays ransom when they can’t take care of people.  That’s bad for business and it can be really bad for patients. 

Healthcare data is among the most valuable data in the world (to patients, caregivers and the black market) and healthcare has been historically bad at protecting digital information - - thus the increase in attacks.

I have the privilege of talking with a lot of people who work in health IT and Security.  They want to fix the problem.  I don’t meet with as many CEOs or CFOs in healthcare but when I do, they want to keep from having a security issue at their organization.  You notice the difference in approach.

Short-term solutions rarely fix systemic problems.  Staying out of the headlines (temporarily) is not only a short-term goal it is short sighted.   

Healthcare has been like a lazy dog on a hot summer day since 2003 when the privacy rule went into effect.  The security rule made the dog roll over and go back to sleep.  Even HITECH, PPACA and the final Omnibus Rule caused the dog some twitching but not a fundamental change in the way we addressed IT.

We need fundamental changes in the way we think about information, IT and security in healthcare.  We seem to be doing that for reimbursement and care delivery models - - those changes are inextricably tied to IT and security.  This is all about information and the information technology to collect, store, share, analyze and protect that data.

In this country, this is the time of year we say goodbye to the dog days of summer and head back to school.  Each year you can start back where you ended or maybe you have to get a bit of a refresher and cover some stuff you’ve already done but you come back and move ahead because you have the basics down already.

And this is what we’ve not done in health IT - - mastered the basics so we can meet the new threats by building on a strong foundation.  Because of the pressure on IT - - headcount, budgets, and training at all levels - - we look for the latest, greatest thing that prevents [insert the healthcare threat of the day here].  It could be “ransomware” or “insider threat” or “the Chinese” or “hactivists” or, well you get it.  And we should have tools - - new tools, because the threat landscape is quite different than it was even 5 years ago.

But here is the systemic problem that will have to be addressed before the “new tools and technologies” can actually become effective.

Healthcare will have to get IT right before it can get security right.  Healthcare has legacy systems and biomedical devices running that are, in security terms, ‘ancient’ or built on outdated designs.  They can’t be protected appropriately.  I still see ‘flat’ networks with little segmentation - - the kind of networks most industries abandoned years ago.  Healthcare providers have asset inventories that are out of date, incomplete and not maintained (if they have them at all).  An asset inventory for IT must include all hardware, software and the data itself - - what it is, where, who uses it, how it got there and where and how you ‘share’ it.  If you have that kind of inventory you should have an idea of what is at risk and then you know what needs to be secured and “maintained”.  I have seen:

• Servers that haven’t been patched in six years and Network-Attached Storage (yes, clinical systems) that has gone 18 months without backup.
• Biomedical devices that are 15 years old - - not old in biomed terms, but try to manage/protect them.
• Organizations that have no security protocols; in fact they still don’t have any security policies let alone the procedures that should support those policies.
• Annual security training for staff members although roughly 1.2 million new variants of malware are created each day.
• And while role-based security, which is not easy in healthcare, is an ideal - - I don’t even see basic identity management, control of remote access, or mitigating controls around BYOD.
• And then there is the lack of encryption.

This is basic stuff.  If you are into sports analogies this is “blocking and tackling”.  This is the ante to get into the game.

I’m all for new tools and technologies.  I just want to remind everyone that all that new stuff really doesn’t add much value if you aren’t doing what you need to do to keep the wheels on.  If this were school we’d be on academic suspension.  It is time for a little remedial work and then we need to invest to keep that education current, efficient and effective.  Good security is good for IT.  Good IT is good for the business.  And a well-run healthcare organization should be good for patients.  No one buys a Da Vinci surgical system if they don’t have a modern surgical suite and surgeons.  Why would we expect security to fix everything with some new instruments when they don’t have the tools or staff to do the basics?

Blog Feature Image: 

bluebrain.png

皮尤研究中心声称，美国92%的青少年每天都在上网，且有近88%的青少年使用手机或智能机[1]。而且，英国大多数儿童在16岁完成义务教育前，经常以多种目的使用电脑，访问互联网。我们可以看到，这种类似情况有遍布全球之势。

此外，赛门铁克《2016互联网安全威胁报告》(ISTR)声称在2015年，每一天就会发生100万次针对个人的网络攻击，且75%的合法网站存在着未修补的漏洞。

儿童在网上遇到的风险日益增多。在美国遭受性虐待的儿童中，有42%在网络上结识性虐罪犯[2]。恃强欺弱的行为在全世界横行，而罪魁祸首很可能是日益增加的网络游戏和社交软件。而且，一些儿童在技术上要强于其父母，这种“小聪明”使他们能够隐藏上网行为。

儿童可能精通技术，但他们却不会做出最佳决策，也不知道如何安全可靠地使用相关设备。对于这一难题来说，保护我们的设备、产品和服务至关重要，但教育和宣传也同样起着不可忽视的作用。

我们认为正如教育儿童其它风险一样，我们应教会他们如何躲避网络上的危险。实现网络安全是我们履行企业责任的重要战略和慈善战略。我们每年都贡献人力物力，以加强年轻人和成年人在网络上确保安全的能力。

比如，至2010年起，我们就与常识媒体（一家顶尖的网络安全非盈利机构）进行合作，授权我们的员工、教育工作者和孩子家长们成为网络安全大使。我们帮助常识媒体扩大和改善服务，为其日益壮大的网络安全宣传群体提供技术支持。

通过常识媒体机构的资源，赛门铁克网络安全服务为常识媒体社区计划提供充足的人力资源。这些员工具有与当地学校和其它机构进行合作的所需材料和信息，能够帮助学生和学生家长们应对网络难题，驾驭学习和生活中所遇到的技术问题。

此外，在2015和2016财政年度中，我们对常识媒体的十二年制中小学（K-12）数字公民课程提供支持。该数字核心课程教育学生们如何在数字世界中制定安全合理的决策，内含65节课，适用于每个年级水平。该课程的灵感来自于霍华德·加德纳博士的研究，以及哈佛大学教育研究生院的GoodPlay项目，包括相关课程计划、家庭教育材料、互动活动和教师专业发展计划。该课程涉及的主题包括互联网安全、隐私和安全防护、网络欺凌，自我形象和身份等。

我们在2016财政年度中帮助常识媒体将其项目从澳大利亚扩展至亚洲部分国家。澳大利亚和东南亚的2,300所学校和3,445名教育者注册使用常识媒体（CSM）的在线数字文化和公民资源。此外，美国有90,000所K-12学校和300,000名K-12教育者已在常识媒体的网站注册会员。

正如媒体和技术的快速发展，各种风险也接踵而来。我们必须让这些年轻才俊们对数字常识有所了解，使其能够安全享受当今媒体和技术带来的丰富生活。

赛门铁克员工向加州旧金山市让帕克小学的学生们传授网络安全的知识。

如果您希望获取更多有关赛门铁克志愿者如何在当地学校或课堂教学的相关信息，则请与我们取得联系（电邮：Community_Relations@symantec.com）。

Jaime Barclay是赛门铁克的企业慈善计划主管。

Blog Feature Image: 

globepoints.jpg

我们在工作中需要与公司外的客户、合作伙伴及供应商日益加深协作，这导致互联设备和应用程序以空前的速度迅猛增长，敏感数据频遭泄露。因此，各安全软件开发团队均竭尽全力以防止这种情况的发生。

赛门铁克的数据泄露防护（DLP）团队致力于为各公司提供相关帮助，预防其最有价值和最为敏感的信息落入他人之手。新版的Data Loss Prevention 14.5新增了二十余种新数据的发现、监测和保护功能，从而消除安全防护盲点，使安全防护团队能够更好地观察和控制相关敏感数据。请阅读以下内容，了解更多相关信息！

尽可能降低云安全风险

我们在去年为BOX、Gmail for Work和Microsoft Office 365 Exchange Online引入了云发现和监测的新功能。DLP 14.5将这些功能加以扩展，使您能够在云端更安全地储存和分享数据。

有了DLP Cloud Storage（DLP云存储）功能，您可以查找其他用户在Box上储存和分享的敏感文档，并识别相关风险，比如那些可访问未授权用户的链接。如果其他用户违反规则 ，您可通过DLP Cloud Storage的文件隔离功能，自动将公开文件和文件夹移动至Box上的安全隔离文件夹中，并在原有位置留下标记文件，以对这些用户进行通知。这样，您不但保护了这些文件，还通过标记文件警告相关用户对敏感文件和文件夹进行自我修复。

在发布DLP 14.5的同时，我们还对DLP Cloud Service for Email（DLP 电邮云服务）进行了更新。DLP Cloud Service for Email是一种云端数据检测服务，可对Gmail for Work、Microsoft Exchange Online和本地Microsoft Exchange Server的电邮进行检测，并可轻易接入DLP Enforce Management Server（DLP执行管理服务器）。 这种服务无论是用于传统的本地电邮应用、公共或是由云电邮服务，还是用于本地和云环境之中，都可为您公司的电邮提供保护。

发现图片格式文档中的个人可识别信息

纳税申报表、保险索赔单和病历中充斥着个人可识别信息(PII)。这些信息通常以图片格式文档储存，因此安全防护软件很难发现。 有了DLP Form Recognition(DLP 格式识别)功能，您就可以发现手写和印刷格式图片中的敏感数据。格式识别是一种新型内容检测技术，通过智能图像处理，发现和阻止机密数据泄露，否则这些数据将在扫描或拍摄的形式下躲过检测。

管理数据在更多应用程序、文件和平台上使用

公司员工们对其在企业防火墙内外所面临的网络安全风险知之甚少。然而，有了DLP Endpoint Agent（DLP 端点代理）功能，您便可在多种情况下监测和保护数据，比如下载数据至移动存储设备，在文档内执行复制和粘贴，或通过网络发送数据，从而使员工们安全地执行工作。在本次发布中，为了使员工们更为安全地储存和分享敏感数据，我们为以下其经常使用的新应用程序、文件类型和操作系统增加了端点覆盖率，其中包括：

• Mac OS 10.11
• Microsoft Office 2016 文件类型
• Microsoft Outlook 2011 电邮客户端
• Box for Office和Box Sync 应用程序
• Chrome、Firefox 和Safari 浏览器(通过HTTP和 HTTPS)
• Cisco Jabber和 Skype企业即时通讯客户端
• Skype即时通讯客户端

防御危险的SSL盲点

为了使用户信息免遭泄露，越来越多的应用程序将信息流加密。在这种情况下，您可能没有留意到公司的内部人员在加密协议（如SSL）的掩护下，正无意泄露或故意隐藏相关敏感数据。在DLP 14.5中，我们将DLP Network Monitor(DLP网络监测)功能和先进的SSL解密产品（如：Coat SSL Visibility和帕洛阿尔托网络公司的下一代防火墙）进行整合，从而为网页、电邮、FTP和IM通讯添加了新的SSL监测功能。

了解更多相关信息

了解更多有关Data Loss Prevention 14.5的最新信息，请访问网址go.symantec.com/dlp。