Managing Sensitive Information Types and Trainable Classifiers

0:00[MUSIC PLAYING] Not everything is created equally. We know this. Not all cars are created equal. Some go faster than others. Some can haul things, while others can't. Well, hey, that's true for everything, including ink pens. Think about this, this happened to most of us. We go out to dinner and we're finished. The waiter or waitress, they bring us the check and, of course, a pen to sign with. We pick up that pen, we sign our names.

0:30And we figure out, oh wow, this is the best writing ink pen ever in the existence of the world. I've got to have one of these. Well, most of us have experienced that. But it just begs to prove the point that not all things are created equal. And guess what, this includes your data. So let's talk about that. Now, when it comes to your data, you need to do something with it that is governed. You need to govern your data.

1:01And the idea that not all data is equal really plays into this. Now, the governance is basically the management of your data. It's making sure it's being managed properly, making sure it's being handled properly, classified properly, all of those things. And that leads us to something known as sensitive data. And it could be sensitive for a myriad of reasons. And we're going to talk about some of those. But the idea is that-- but if we have sensitive data, well, then that sensitive data is probably going to need to be handled specially, a little different from your standard everyday data.

1:38We need to provide extra protection around our sensitive data. Now, the thing is, if we don't know that this exists, then we can't provide that additional protection. Just think about this. If your friend called you and wanted you to housesit for her or him for a couple of days, so you say, yeah, sure, why not? And so you go over to your friend's house and it's out here. And it's actually on a farm and it's pretty nice. And they got this little pond over here. So you might go out and do a little fishing and look for some fish there.

2:14Or maybe you're going to just sit out and enjoy the nice weather out here on the farm and the fresh air. So one of the stipulations of you housesitting for your friend is that you need to feed the animals. Now, if your friend tells you, I just need you to feed the animals and then leaves, how are you going to know that you have fed all of the animals if your friend over here hasn't told you that they have 3 dogs, 1 cat, 2 horses, and I'll say 1 pig?

2:49If you don't know that all of these animals exist on this farm, then you're not going to feed all of the animals. And they're going to get left out. And we don't want that. Well, the same goes for our data. We need to know all of the data that exists. And we need to know if any of that data is sensitive data. Because if we don't know that that is sensitive, we don't know that it needs additional protections. So I said, we're going to talk about some various types of sensitive information and it's time for that. So here we go.

3:19Some sensitive data types. Number one would be medical data. Let's talk about that. So medical data, we're talking patient information. So it could be diagnoses, patient numbers, record numbers, all of these things. And this actually falls under the HIPAA compliance. And that is the Health Insurance Portability and Accountability Act. So it's all about patient information. So anything related to patient information is sensitive data.

3:49And we need to protect it. We also have personal identifiable information or PII for short. And this is any information that can be used to identify a person. So we're talking full name, address, phone number, date of birth, Social Security number, all these things, that's PII. And HR or human resources, HR department handles lots of PII. Just think about when you submit a PTO request. Are you submitting any personal information in there?

4:21Well, sure you are. And HR manages all of this information for us. Or it could be that you're a vendor and you've got lots of customers and their personal information. Either way, this is PII, it's sensitive information, and it needs to be protected. There's lots of data privacy laws and regulations such as GDPR. And that is the General Data Protection Regulation. And that is for the protection of the European Union citizens' data.

4:51And there's a whole lot around it. But the idea is that, really, it's about privacy and protecting your personal information. Then, we have credit card information. That's a big one. So credit card data falls under the PCI DSS compliance requirements. And so we're here, we're talking about credit card numbers names, account numbers, CVV numbers, those little CVV numbers where you've got to type in that number in order to process a transaction online. This is all sensitive information that needs to be protected.

5:24But then, there's also information that may be part of a DOD or the military. So it's actually classified information or controlled information. And some of this falls under the CMMC compliance requirements. So the idea is there's lots of different sensitive data types out there. And this isn't all of them. This is just the tip of the iceberg, because there's lots of different sensitive data types that exist. But the idea is you need to know that your organization deals with this type of data.

5:59And then, you need to know where it is, so that you can properly protect it. You can put controls in place to help protect this information. So when it comes to this, we really need to involve a couple of key teams. That would be our legal team and our compliance team. Now, this legal and compliance team may be the same person. And it may be a single person and that's OK. It's just the idea that we need to figure out who deals with legal in our organization, who deals with compliance. And we need to meet with these two organizations, these two teams, or people, or individual person.

6:36But the idea is we need to involve them in this, because they're going to help provide guidance and help us understand what we're working with, what type of compliance we're working with, what type of sensitive data we're working with, so that we can make sure it is all identified. So we can properly protect it. And that is how we deal with sensitive information within our organization. It's really important to perform planning around this and involving the proper personnel and teams, so that we don't miss anything. And we are protecting our data to the best of our abilities.

7:08I hope this has been informative for you. I'd like to thank you for viewing.

0:00[MUSIC PLAYING] Now, that we've gone through and identified the various types of sensitive information we're dealing with in our organization, it's time to jump into the Microsoft portal dealing with compliance, and identify how they can help us manage our sensitive information, and even identify that sensitive information. All right, here we are, We are at compliance.microsoft.com.

0:32And this used to be the compliance portal. Now, it's known as purview or maybe it's purview, I'm not sure exactly. But it is a new branding for the compliance portal. Now let's talk about this a minute. What we're going to be looking at is dealing with compliance in our sensitive data. And we can actually go over here to data classification here. And it actually defaults here to the sensitive information types. And that's what we're going to be looking at. So what is a sensitive information type? Well, it's a certain type of sensitive information.

1:05In the last Nugget, we talked about credit card data. We talked about HR data, that's our personally identifiable information. We talked about what else? Health information data through HIPAA, like our patient data. So what we have here is sensitive information types. And these types, what they are, are pattern based identifiers. Meaning they search for patterns within data in an effort to identify a specific type of sensitive data that they might be. So, of course, Social Security numbers, date of birth, account numbers, credit card numbers, medical terms, things like that.

1:38And when it comes to our data identification, there's three ways we can use these, OK. So we have these here to help us identify data, about how are they used. Well, we can do it manually. So a user can actually go and manually assign a sensitive data type label to a document if they want to. And we can allow that. But we need to take into account training for that, and human judgment, and human error, all those things. Automatically that's our other option. So we can allow Microsoft to go out and scan our documents and automatically apply a label based on the matches it makes if we want to.

2:13Or we can even use something based on machine learning, which analyzes some samples we provide to it. And it looks for that data and looks to see if it matches those samples. And we're going to get to that later on. So right now, we're looking at sensitive information types. And we have a bunch of them in here. ABA routing number, that's our bank routing numbers. We've got Acme design document down here. That's a fingerprint. And we're going to get into that later on as well. All full names. So we're talking about full names, people's names, looking for medical terms, physical addresses.

2:46Argentina national identity number, pretty interesting. All right, let's search for U.S. for United States abbreviation. There we go. All right, we have US-UK passport numbers, bank account numbers, driver's license number, individual tax, identification numbers, physical address, Social Security numbers, all these different things. And these are patterns, which we can use to match on data, which is pretty cool. Because all these are already in here, 264 of them. So let's click on one.

3:17Let's go with US Social Security number. Let's just click on this to find out. All right, it says, detect formatted and unformatted US Social Security numbers confidence level. So here's our description. Confidence level is, how confident is this that it's a proper match? And right now, it's set to a medium. Who created it? That's Microsoft. Then, we have something called our pattern. So we have a primary element. Because what this is, again, it's pattern matching. And we can have multiple elements. The more elements you have and the closer they are together, the more accurate this is going to be.

3:51For example, if I provide a Social Security number pattern as a primary element, and that's probably what's done here, we're going to look at that here momentarily. So it's looking for that. But then I add something else in here, like maybe a name, a full name needs to be in there, or some other type of information that's often found with Social Security numbers. The idea is if we can find several things that are related, it's going to be more likely that we have a positive match and not a false positive, which is a false alarm.

4:21So here we go, our primary element. And that's really what it's looking for. So it's looking for that. And then, supporting elements is down here. And that is a keyword list. And these are words and lists that are somehow related to SSNs. And what this character proximity is, is how close in proximity character wise are words in this keyword list to the primary element. And it says within 300 characters. Because if you think about it, if you've got a big document, and you want two words that are related.

4:54The further they are away from each other, the less likely they are to be actually related, OK. So then, we have pattern number two down here. And it's looking for something else basically, and pattern number 3, and pattern number 4. So the idea is you can put multiple patterns in here. And we're actually going to create one later on. But something you don't see in here is, what are these patterns it's looking for? We don't know. I can't click on anything to look for the pattern to get an idea of what it's looking for. Well, that's because Microsoft doesn't put that in here.

5:25You need to go to their documentation. So let's click over to documentation. All right, there we go. So this is a sensitive information type entity definitions. So let's search for Social Security number. Let's do search there. Let's do Social Security. And let's see, we've got a lot of them. So actually, I should probably use US, there we go, social, there it is, Social Security number. That's exactly. Let me click back just to double check our US Social Security number. And I go over here to the documentation. Yes, that is it.

5:55So the format, nine digits, which may be in a formatted or unformatted pattern. And if we scroll down here, we see the patterns. So it looks like it's looking for some digits with spaces, digits with dashes, all the digits together. And so you see now, we can see the pattern it's looking for. All right, give us some definitions down here. Because we actually saw some functions here. If I go back here, let's see, function_ssn.

6:25So if I go back over to the documentation, we see function_ssn right there. So it finds content that matches the pattern. That's what it's looking for. And then, also a keyword from keyword SSN. So what is that keyword SSN? If we scroll down here, there's our keyword ssn. It's Looking for SSN number. The word SSN number, the words Social Security number, any of these typed out. These are the actual words, SSNs. So it's looking for these keywords to identify if a pattern is actually Social Security number.

7:01And remember, it was looking to see if any of these are within 300 characters of the pattern it identifies. So that's how this works. And that's why we have to go through and look at the documentation. Now, something else that we might want to look at would be something like a credit card number. So let's see, credit card and number. There it is. Format, here's the format, just a bunch of digits there. Looks for patterns. Detects card from all major brands including all of those, OK. And it provides some definitions.

7:31And if we scroll down here, it provides a keyword list. Credit verification, credit identification number, CVC, CVV2. I'm not going to go through all, of course. But this is it. This is a big list of key words that it used to associate with that. So let me go back now. Now, that we know what sensitive information types are, let me close this out so it'll refresh, we see how we can use them in our environment. Again, we can assign them manually. We can let Microsoft go out and look for them. But this is a Nugget to let you know these exist.

8:04Microsoft already created a bunch of these for us. And we can help use them to identify the sensitive information in our environment. And then, we can create rules around that. We can create security rules around rights management, and data loss prevention, and encryption all based on these data types and their matches. So that is pretty darn cool. Now, in the next Nugget, we're actually going to create one from scratch that meets our needs, because we have some special needs when it comes to matching sensitive data, because we create special hardware that's used in certain environments.

8:40And we're going to look at that. So I hope this has been informative for you and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] All right, here is the scenario. We work in an organization and we create handles. [LAUGHS] That's right, these are hardware handles used by the DOD, and government, military agencies on lots of their different devices. And we take pride in our handles. They're the best of the best. And they provide some special attributes, if you will, or features. And we need to protect our intellectual property, that is the design of these handles.

0:32And we need to do so using sensitive information types within Microsoft. That's right, so let's get started. All right, here we are. We're in our Microsoft Purview. And we're going to go down to Data classifications. We're going to go to Sensitive information types. It's going to take this a minute to load up. And guess what, we're searching for handle. All right, all right, what do we have here? Nothing, OK, all right. Now, let's search for-- I don't know-- design. And what do-- nothing.

1:02All right, we did handle, design, maybe part number, part-- how do would we get there? Nothing, all right. So basically, the idea is there's nothing here that's going to match what we're looking for. So we have to create our own custom sensitive information type. So let's do that. Let's go ahead and click on Create sensitive information type. It's going to open that up for us so we can create one in our friendly name. All right, we need to give it a name. All right, let's go with ACME-Design.

1:32Because we're wanting to identify our design drawing. So, ACME-Design, let's put Drawings. There we go. We'll say ACME design drawings. Excellent. Next, all right, patterns. Well, how are we going to figure this out? We're going to need to take a look at this design. So let's drag this in here. Here we go. This is a drawing of one of our designs. OK, got a handle here, and we have the word Design here, and a part number. And all of our part numbers start with two capital letters, followed by seven digits.

2:06That's good to know. That's probably a pattern we can use. We've got the word Date and a date that it was approved and approved by. And we have somebody who approved it. So Doc Brown approved this. All right, good. Now, we have an idea of what we're going to be looking for. We need a pattern for a part number. And we also probably want some matching on words that are close by, like Date and Approved. So let's do that. Let me move this out of the way over here. So the first pattern we're going to do, we're going to go ahead and click Create pattern.

2:37And we're going to say High confidence level. We're going to leave that because we could do high, medium, or low, based on how confident you are that there's going to be a match. And I'm going to add a primary element. And this is going to be a regular expression. Now, a regular expression, if you're not familiar with RegEx, It's patterns used to match on data. So I'm going to go ahead and copy this over here. I've got a pattern over here. And we're going to make this a word match. Because I'm wanting to match on a specific word and, actually, the part number.

3:10So right here, it says, mention your regex here. So what I'm going to do is paste that in there. And there we go. So let me highlight this. This is my regular expression, right there. So it's looking for any letter, capital letter, A to Z, any capital A to Z. The slash d is for a digit. And I'm looking for any seven digits. So that's my pattern to match that. And I also need to enter a name up here. So we're going to call this part number.

3:41There we go, super. And if I wanted to add some type of regular expression validator, I could do that. But I don't. I know this is the regular expression that will work for identifying that part number. And if you're not familiar with RegExes or regular expressions, you can just google it. There's lots of tutorials and such out there for it. So say Done. All right, so my primary element is that part number, excellent. Now, character proximity, detect primary and supporting elements. Now, the supporting elements, I'm going to do a word list. And it's going to have the words Date and Approved in it.

4:13And then, we're really close to the part number. They weren't very far away at all. So actually, I'm going to change this to 50 characters, why not? There we go. Or, you could say anywhere in the document. So now, I'm going to go to Supporting elements. I'm going to add this. And I want a keyword list. And this is going to be part number key words. There we go, case insensitive words here, or case sensitive here. I'm going to go with case sensitive. Since this is a template and those will not change.

4:45I'm going to say Date. And then, I'm going to put the word Approved. There we go, excellent. And let's put By in there as well. There, super. All right, word matches, there we go, we say Done. Excellent. And then, add any additional checks we want to add in. So, let me bring this drawing back over. Right now, we have a regular expression that will search for this part number. And then, it's going to look to see if the words Date, Approved, or By are close by. And that's going to help make sure that this is actually identifying a parts design.

5:20Because if I was to only search for this, well, if there was any document out there that had any pattern like this in it, it would match. And that's going to be a false positive, probably. So by adding this Date and Approved and By as supporting elements, it's really going to help me increase the likelihood that when this rule identifies a document as drawing, that it's going to be true. And it's not going to be a false positive. So let's move this back out of the way. And let's go ahead and click on Create. There we go.

5:50We have created our pattern. All right, excellent. Now, let's go over here to the recommended confidence level. And you have high, medium, and low. Again, and we're going to stick with high. It means that the matched items will contain the fewest false positives, but the most false negatives. And a false negative is when it doesn't detect something that it should. Just FYI, and they just go through here and give you a little wordage about that. But I'm pretty confident that this is going to match. So we'll say Next, and then go ahead and Create.

6:23And now, it's going to create my custom sensitive information type. And then, we're going to test it. We're going to see if it works or not. And I will show you how, here momentarily. All right, so this created, I'll say Done. Excellent. And there we go, ACME-Design-Drawings is now up here. And you can see the publisher is NuggetLabz. And if I click on it, I come in here and I see ACME design drawings. And it has that pattern that we're matching on. Excellent. It has my part number keyword list as supporting elements.

6:54And you have an option to test, copy, edit, and delete. I want to test this. So I'm going to say test. It's going to allow me to upload a file. So what I'm going to do is, you see this drawing right here, well, I'm going to upload that file. So let me close out of the drawing itself, close out. And now, I'm going to drag the drawing in here. Actually, I'm going to go to-- let's do Upload File. There we go. And I want this one here. This is the part number, you see it right there. Say Open.

7:25And we'll say Test. And now, we're going to see if it matches on those results. And there it goes. It came back, and it says it matched. ACME-Design-Drawings, it matched one unique pattern. And that was the part number there. Let's see, it also found Date and Approved and By, all close by. So there we go. It found it, so that worked. All right, let's go ahead and finish that. But now, let's test it again. And let's say Test. I'm going to upload a different file, this time the one that is empty. There's no part number in it.

7:56So I'm going to say Open and say Test. And let's see what-- there it goes. That was pretty fast. No sensitive content was found. Now, those key words were in there. But there was no part number. So this just goes to show that it works. So I'll say Finish. And so there we go. We have created our own custom sensitive information types, looking for a design drawing, for ACME, and our super duper handles. And we were able to go in and test to make sure it identified a drawing. And then, I provided it a true negative drawing, meaning one that didn't have a part number in it.

8:31And it didn't match on it. So that's good. It tells me that we have created a good and reliable sensitive information type. I hope this has been informative for you. And I'd like to thank you for viewing.

0:06Within our organizations most of us use some sort of templates. And that's to make sure that we kind of standardize the way we do things for daily collection. Maybe recording information or creating drawings of parts and stuff we use a certain template. Well, guess what, Microsoft allows us to do document fingerprinting. And that's because each document, especially if it's a template, has some unique characteristics about that, could be its fingerprint. So let's jump in and talk about document fingerprinting.

0:37So document fingerprinting is a way to identify commonly used forms within an organization, as I had mentioned earlier. And some of these different forms, they could be HR forms, they could be design drawings like we've seen previously, and actually we're going to use as an example here shortly. Now what about medical records, I have mentioned that earlier. So medical records. There could be lots of forms, could be a form for a patent.

1:07So maybe your organization creates lots of new widgets and you need patents for them, so you could have a patent form. So just about any type of form that your organization uses, it has unique characteristics about it. And specifically a unique word patterns. That's really what Microsoft is going to look for when it creates this fingerprint. So the idea is we're going to create a sensitive information type for each of these fingerprints. And that way we have a tool, a sensitive information type, that we can use in protecting our data.

1:44Now as of the recording of this, the only sensitive information type that you can use a document fingerprint with is a DLP sensitive information type. And that is a data loss prevention. So this allows us to create DLP rules around these sensitive information types, which classify our documents that we create fingerprints for. And also there is a note here. I want to note that as the recording of this Nugget, this DLP sensitive information type is a detection method that can only be used in Exchange Online.

2:24Now, hopefully that will change in the future, but as of this recording, that's what it is. So we can only use it with DLP rules and Exchange Online. So here we're looking for probably email attachments, because we're looking at document fingerprints and you're going to attach that document here to our email. And that way we could maybe stop the email from going out because it's a sensitive document that shouldn't be leaving the organization. Or maybe we force encryption on that email. So how does this work?

2:54What's the process of creating this sensitive information type with a document fingerprint? Well, the idea is we have our document here. And what we do is we upload that to Microsoft 365 DLP. That's key here. It uses the data loss prevention area of Microsoft 365. And DLP provides some analysis. It takes a look at the document itself, and it's looking for the unique word patterns to create a fingerprint.

3:25And once it has this fingerprint, that fingerprint then represents that document. So it's a way to identify that document through DLP. At that point, we can use this fingerprint to create a sensitive information type. And then, of course, we can create rules for DLP around using that sensitive information type. And, again, right now it's only for Exchange Online. But, again, hopefully that will change soon. Now there are a couple of instances where document fingerprinting simply doesn't work.

3:58So what are those instances? Well, maybe we have a password protected file. If it's password protected, Microsoft DLP cannot analyze that file. So, therefore, it can't tell what it is. Well, what about a document that contains only images? Well, there's no text there, there's no words in the fingerprint. It's created by looking for unique patterns of words. So if there's only images in the file, well, it's not going to work. Thirdly, files greater than 10 megabytes in size.

4:32So if your file is larger than 10 megabytes, DLP will not be able to scan it and perform this analysis. And then lastly, a document that was altered, and it doesn't contain the original fingerprint. So an example of this instance here is if you had a template, and everybody used it to request purchases maybe. It's your purchase order request form. All right, and then one day you decide we're going to update this form to include a couple of new fields.

5:06Well, guess what, this signature that you have created for this document is now invalid because the signature doesn't match. So this brings to point that we need to update our signatures. If we ever update the form that we create a signature for, well, we need to update that signature as well, because that signature or fingerprint will change at that point. All right, now that we know what the document fingerprint is, we get an idea about how to create it and when it will not work.

5:37It's time to go ahead and take a look at creating one of these now. We can only do this through PowerShell at this point. So we're going to jump into our server, and we're going to go ahead and create a document fingerprint. All right, here we are on our server here. And I have an administrator PowerShell open here. So let's take a look at the commands down here. All right, here we go. So first we're going to connect to Microsoft using Connect IPPSSession, provide a user principal name of me. And that's going to get us connected in there so we can use the DLP commands.

6:10I've seen that you can also use connect to Exchange Online. But oftentimes not all the commands are there when I do that so I prefer to use this here. And then here are the commands we're going to run. We're starting off with by creating a variable ACME_Designs. We're going to use PowerShell to read in the contents of that file, and the file sits on my desktop, ACME-Design.pptx, so it's a PowerPoint with our design in it. And, again, what's going to happen is DLP isn't going to read through all the text in there and create a fingerprint from the text.

6:43And then we end up creating a variable for our fingerprint. And we're going to base it on our ACME_designs file, and we're going to give it a description. So at this point we have a fingerprint. Then we need to tie that fingerprint into a DLP sensitive information type. So we're going to create a new DLP sensitive information type, we're going to give that a name, "ACME Design Document." Reference that fingerprint so we can attach it there, and then give it a description. Pretty straightforward. Now before we jump in, I want to look at the Microsoft documentation real quick, and actually take a look at our drawing.

7:16So this is my ACME-Design-Pptx. I'm going to open that up here in the web PowerPoint just so you can see what it looks like. It's very generic, very simple. And this is the only words, right here these are, here in this document. So it's going to look at design, date, approved by. And, of course, it's going to try to then create a fingerprint from this information. And where it is in the document and how they are placed in relation to each other. So there's the drawing. And if we go over to the Microsoft documentation, this is it.

7:50I'm going to scroll up here to the top talking about document fingerprinting. And you can read through this. But what I want to show you down here is that there are only certain file types that are supported. So if we click on this link, it's going to open this up here. And this is the table of acceptable file types that can be used to create a document fingerprint. Here we have Office 2007 and later, so all these. So there we go, it looks pretty good. Small office 2003. Other office files, Adobe PDF, HTML, XML, some text files.

8:23And as we scroll down, there's some open documents AutoCAD drawings. So if we use AutoCAD to create a DXF file for this part drawing, well, hey, that would work for us as well. And there are some images in compressed file archives. So just keep in mind that there are limitations on the file types that can be used for this, but you still have a pretty good selection. So what do you say we go ahead and create this document fingerprint already. So let's go up here, let's go ahead and grab this.

8:55And I'm going to paste it in here, there it goes. It's connecting now. Yeah, right, I'm connected. And it didn't ask me to authenticate because I had done so just a few minutes ago in testing to make sure this is going to work exactly right the first time. All right, there we go. So now I'm going to copy these commands down here that we talked through just a couple of minutes ago, we're going to copy those. Let's go ahead and paste those in here. And actually before I do that-- wait a second, let's go over here.

9:25Let's go over here to our Compliance, let's go to Data classifications, let this load up. Then we're going to go to our sensitive information types because I want to show you that this doesn't exist yet. There's no smoking mirrors here, folks. All right, there we go. This is pre-loaded, our 263 sensitive information types. And if I filter by type, I've got BundleEntity, then Entity. And if I go again I just have Entity. So I only have those two types right now. And if I go here and filter by Publisher, up and down you won't see Microsoft Corporation here.

9:59There's nothing from Nugget Labz. All right, so we can see that it's not there. So now I'm going to go ahead and paste these in, there we go, hit Enter. And this does take a few minutes, actually, because it's going to upload that file to DLP, DLP is going to perform analysis on the file, creating the fingerprint. At which point, it's going to go ahead and take that fingerprint and create that new DLP sensitive information type. And it went much faster than in testing. Excellent, hey, that's pretty cool. All right, so we didn't get any errors, it doesn't look like.

10:31Let's just make sure up here. Nope, I don't see any errors. So let's go back here and let's do a refresh now, refresh there. Give that a minute to refresh. And look at it right there at the top, ACME Design Document, fingerprint is the type. And that is our NuggetLabz.onmicrosoft.com, super. So if I click on there it says the description design document owned by ACME. And if we go down here to my command, that was the description I gave right there. And that's how we go about creating a document fingerprint.

11:02Now we could go to create our DLP rules for Exchange Online, and we can use this sensitive information type to help identify those sensitive documents that are in our environment. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00[MUSIC PLAYING] So we've been looking at sensitive information types, and we've been dealing with creating patterns and matching on patterns and such. But maybe we have a list of key words that we want to match on-- not necessarily a pattern, but exact words. Wouldn't that be interesting? So we can actually have a list of all of our part numbers in it, and we could use that to match against. So let's look at how we might do that.

0:30All right, here we are in Microsoft Purview. I'm going to go down here to Data Classifications, Sensitive Information Type. There we go. It loaded up. And what we're going to do is creating a keyword dictionary. Now, this is simply a list of words that we would want to use to classify something as sensitive information. For example, maybe we're going to match against anything that includes one of our part numbers that are actively being used. Now, let's go ahead and look at how to do that. We would go in here to create a new sensitive information type. So I'll click on that and let that load up.

1:01Now, while this is loading, there is a limit of 50 keyword dictionary sensitive information types per tenant. So not 50 words per dictionary. Not that, but 50 dictionary sensitive information types. So what creating now-- I can only create 50 of these per tenant. So just keep that in mind. So we're going to put ACME hyphen Part hyphen Numbers. There we go. We'll say these are the ACME part numbers. Excellent. Now we'll say, Next. And what we're going to do is we're going to create a new pattern.

1:33So we'll say, pattern. And I'm going to go with medium confidence. Since I'm only matching on this one thing and I'm not providing any supporting elements, then I'm going to go with medium confidence, OK? So I'm going to add that primary element. And it's going to be a keyword dictionary. And what I'm going to do here is you could choose from existing dictionaries or upload a dictionary. I'm going to say, upload a dictionary. And it has to be a text or CSV. I'm going to select CSV. I'm going to select ACME Part Numbers. Open that up.

2:03And there it goes. It went ahead and populated all the data I had in there. And this is just some sample part numbers. So here, we're going to say the name for this list is part hyphen numb dash dictionary. There we go. Super. Go ahead and say, Done. It's going to upload those. All right, excellent. So it's that simple. I now have my dictionary here that I'm using. Now, if I wanted to provide supporting elements, I could. It would make it more accurate. But in this instance, I'm just looking for anything that contains a part number, all right?

2:36So I'm going to go ahead and say, Create, Next. And this is a medium confidence level. Next. Create. Excellent. Say Done. There it goes. All right, and here is our ACME Part Numbers. I'm going to click on that there. It's going to open this up. And we're going to run a test just like we did before. We're going to say Upload File. I'm going to say, Documents. Let's go over to the design right there. It has that part number in it. I'm going to say, Open Test.

3:08And it found the part number. Excellent. Finish. I'm going to test this again. This time, I'm going to upload the one that has no part number in it. Say, Open and Test, and it should come back with nothing. And it did. No sensitive information was found. All right, so I'm going to finish that. And there we go. Now, I do want to mention, when you're using a dictionary, if you're only using that one dictionary and you're not using any supporting elements, you're just looking for that one pattern or a list of patterns really, yes.

3:38But the idea here is, if I were to use this ACME Part Numbers in search for things, it's going to hit on anything with a part number in it. So it could be an email. It could be somebody has a document with one part number in it. And it's not sensitive really. It's not going to match, necessarily, only on drawings. The design drawings and support elements, it's going to be much more accurate. So when you're using these, it's better off to use them to identify certain types of data. And just keep in mind that it's not going to be all that accurate.

4:09So I just want to plant that seed so you understand that without the supporting elements, it's not really that accurate. And don't like to use those a whole lot. Much rather use something with supporting elements. And maybe it's that you want to use supporting elements, and you use two dictionary files. One is your primary pattern, and then one is a supporting element. You could always do that as well. So that is how we create and use keyword dictionaries. I hope this has been informative for you. And I'd like to thank you for viewing.

0:06We're continuing with trying to identify different types of data. And we've done so via sensitive information types. But there's something else called a trainable classifier. It sounds pretty interesting. Well, it really is. So let's jump in and take a look at trainable classifiers. All right, so the question is on everybody's mind, well, what is it? Well, a trainable classifier is a way to create a classifier. So this classifier here allows us to classify data.

0:38It identifies specific data and then classifies it as something, something like adding a label to it, very similar. And it allows us to use machine learning in order to identify data through a classifier. And it does this by learning. So what we do is we create what's called seed content. And this really is sample data. I'm going to put that down here, samples. And we take those samples, and we have the ML read that seed content or those samples, and analyze those samples.

1:13And then create a classifier based on its analysis with machine learning of those samples or seed content. Now, once this is completed and we have a classifier, well, we can use it to do things. We can do things apply sensitivity labels, or apply compliance requirements, or even apply retention label policies. So the idea is we can take some samples, use machine learning to analyze it, and then create a data classifier from that that we can use within our compliance activities.

1:53So that's pretty darn cool. Now the question comes up, well, why would we really want to use this one? This type of identifier over something like sensitive information types? Well, this is really handy for identifying certain types of documents used within an organization. And generally, this comes into play when the content that we're analyzing, that content is not easily identified by using automated pattern matching.

2:26And it's when we have this scenario, when we're having a lot of false positives and we're just not able to get these types of documents identified using sensitive information types, when those aren't working for us, then it's time to take a look at trainable classifiers. Now a couple of examples of this is when we're looking for things like profanity, threatening language, resumes, believe it or not, and discrimination. Now, several of these, like the profanity, threatening language, and discrimination, really are different.

3:00We're generally not looking for these things when we're looking at identifiers, we're trying to find data, we're looking for sensitive data. Well, sometimes we need to identify other types of data as well. And that's oftentimes when we move to a trainable classifier. Now the next question is, well, when would we use to choose a trainable classifier over another sensitive information type that we're dealing with? Well, it comes down to a couple of scenarios. Number one, we can manually assign our sensitive data types.

3:34And when we're doing that, well, oftentimes we run into human error because it comes down to a person's judgment to make that decision. And oftentimes we will want to avoid that. So we may need to look at another option, such as a trainable classifier. Then number two, we have our pattern matching that we can use as well. But sometimes those have a hard time identifying the type of data we're looking for.

4:06So they really don't work too well in some situations. And then when both of these-- when they're having a problem, I properly identifying the type of data we're looking for, that's when we need to go to a trainable classifier. Now there are actually two types of trainable classifiers. We have what are known as, number one we have pre-trained classifiers. And these are classifiers that Microsoft has created and provided to us to use.

4:37And then number two we have custom classifiers. And these are the ones that we create ourselves. So the next question is, well, how do we get started with creating a custom trainable classifier? So getting started. Well, when you go into your Data classification for the first time and go under Trainable classifiers, you're going to receive this pop up window. And it's going to say, get started with trainable classifiers. And a global administrator has to go ahead and click on Start skinning process.

5:10Now the thing is, this is going to kick off the scanning of all of your datas within Microsoft 365, and it's going to go through and look at what you have. It's going to try to identify certain things. Now the thing is it will take seven to 14 days for the scanning to complete. Just keep that in mind. This is not something you're going to jump in there and set up in one day. Just doesn't happen that way. So keep that in mind, and you use that in your timing and planning as needed.

5:40But, remember, if you don't do this when you go into your Trainable classifiers, the Create trainable classifiers button will be grayed out and you won't be able to create one. All right, once you click on this, and it goes through, and it finishes, and it's seven to 14 days later, and you're create trainable classifiers button is not grayed out, and you can click on it, then we can take a look at how to set this up. So here's how we do this, we go and we create a new SharePoint site, this has to be SharePoint, or we use an existing SharePoint site.

6:13We create two new folders that you see here, here's one, here's the other. They don't have to have any type of name in particular, but you need to name them something. And I would recommend something like TC, for trainable classifier, - seed, because that's our seed data or our sample data. And then another one TC - train. And we'll talk about training here in a moment. So now that we have these folders created, we need to upload some samples. So we need to upload between 50 and 500 examples of what we're looking for, all right.

6:50So you have to have at least 50. So we're going to say, we're going to upload 50 examples into our Seed folder of the type of data that we want our trainable classifier to identify. Excellent. Once we do that, we need to upload at least 200 documents into our training folder. Now this should be a mix of documents that match our classifier, and do not match our classifier.

7:23And you do not want to use any of these Seed documents in here. Don't do that. We need a separate example. So the idea is you'd probably upload 75 or 100 documents that match the data you're looking for, and then some others that are just random data that don't match. And we're going to talk about why we would do that momentarily. Now once we upload all that data into those folders, well, there's a period we need to wait. We need to wait about 24 hours for everything to be indexed and crawled, and everything on the back end set up and doing what it needs to do, OK.

7:59Then we can go into our Trainable classifiers, click on that Create trainable classifier button here. And then you're going to go through and create a name for it. And you're going to point it to the folder where your Seed data resides, OK. And then they're going to click Create, and it's going to go through and it's going to take a few hours to go ahead and create that. Once it's created, it's time to train our classifier. Now the way this is done, once it's created, you go in and you click on the link that says Add items to test.

8:34So you're going to have a link that says Add items to test. You're going to click that link, and you're going to point it to your training folder. And then it's going to go through and it's going to identify which of those match your classifier and which don't. And once it completes that, if you go into your trainable classifier, you're going to get some statistics, let's say exactly how well it did at matching. And then you're going to have a link to go ahead and publish that trainable classifier so you can start using it.

9:07Now these statistics may not look so hot, maybe it's like a 72% matching or something. Well, at that point you're going to need to do something called Re-training. And that's when you go into your Trainable classifier, and there's a tab in there that says Tested items to review. So you want to go and click on that Tested items to review tab. And it's going to show all the items, the documents, that it tested. And what you need to do is go through each of them.

9:39You click on that item, and then you're going to get an option. There's a button that says match or not a match. And you're going to need to select if it does match or if it does not match. And this is kind of a manual process of retraining and telling the machine learning, hey, this one is a match. So that's good, add that to your data set. This one is not a match, ignore these types. So we're kind of manually re-training. And the key with this, you have to do at least 30 of these manual reviews.

10:14That means you have to click on at least 30 of these documents in here, in your Tested items to review tab, and say if it's a match or not a match. That's a key number there. So once you hit 30, it's going to go into a re-training state. And it's going to take that information you provided to it, and it's going to provide some additional machine learning activities around that and really focus in on those and try to improve our number over here. So we get from a 72 to maybe like an 85% match or a 90% match.

10:48So that's how we go through and set this up. Now before you can do this, you've got to have the right licensing requirement. So let's talk about that really quick. So you need to have either a Microsoft 365 E5 license, or the Microsoft 365 E5 compliance feature license. So those are what you've got to have, Microsoft 365 E5-- let's make that three a little better there, there we go-- or the Microsoft 365 E5 compliance license feature.

11:25And then lastly, what kind of permissions are needed to do this? Well, first of all, we need a global admin permissions. And that is to do that opt-in. It's referred to as opt-in when we click on the image. Let me bring this image back up here. This one right here. When we click on this Start scanning process to kick off our trainable classifiers process, you have to have a global admin permissions in order to do that. And that's known as-- let me put that over here-- opting-in.

11:57That's what that opt-in is, all right. Now secondly, after that's done, you can use the compliance administrator permissions to perform classifier training. So you don't have to be a global admin to perform classifier training, you can use your compliance administrator permissions. And there we go. That is trainable classifiers, what they are, why we would want to use them, when we'd want to use them, how we create them, the licensing required, and, of course, the permissions needed. I hope this has been informative for you, and I'd like to thank you for viewing.