Data loss prevention (DLP) makes sure that users do not send sensitive or critical information outside the corporate network.
Data loss prevention (DLP) makes sure that users do not send sensitive or critical information outside the corporate network.
The term describes software products that help a network administrator control the data that users can transfer. DLP products use business rules to classify and protect confidential and critical information so that unauthorized users cannot accidentally or maliciously share data, which would put the organization at risk. For example, if an employee tried to forward a business email outside the corporate domain or upload a corporate file to a consumer cloud storage service like Dropbox, the employee would be denied permission.
Organizations are adopting DLP because of insider threats and rigorous data privacy laws, many of which have stringent data protection or data access requirements. In addition to monitoring and controlling endpoint activities, some DLP tools can also be used to filter data streams on the corporate network and protect data in motion.
Best Practices
Here is how to initiate a successful DLP deployment:
- Prioritize Data
Not all data is equally critical. Every organization has its own definition of critical data. The first step is to decide which data would cause the biggest problem if it were stolen. DLP should start with the most valuable or sensitive data that is likely to be targeted by attackers. - Classify the data
A simple, scalable approach is to classify data by context. This means associating a classification with the source application, the data store or the user who created the data. Applying persistent classification tags to the data allows organizations to track their use. Content inspection is also useful. It examines data to identify regular expressions, such as Social Security and credit card numbers or keywords (example: “confidential”). Content inspection often comes with pre-configured rules for PCI, PII, and other standards. - Understand when data is at risk
There are different risks associated with data distributed to user devices or shared with partners, customers and the supply chain. In these cases, the data is often at highest risk at the moment it is in use on endpoints. Examples include attaching data to an email or moving it to a removable storage device. A robust DLP program must account for the mobility of data and when data is at risk. - Monitor data in motion
It is important to understand how data is used and to identify behavior that puts data at risk. Organizations need to monitor data in motion to gain visibility into what’s happening to their sensitive data and to determine the scope of the issues that their DLP strategy should address. - Communicate and develop controls
The next step is to work with business line managers to understand why this is happening and to create controls for reducing data risk. At the beginning of a DLP program, data usage controls may be simple. Controls can target common behaviors that most line managers would agree are risky. As the DLP program matures, organizations can develop more granular, fine-tuned controls to reduce specific risks. - Train employees and provide continuous guidance
Once an organization understands when data is moved, user training can reduce the risk of accidental data loss by insiders. Employees often don’t recognize that their actions can result in data loss and will do better when educated. Advanced DLP solutions offer user prompting to inform employees of data use that may violate company policy or increase risk. This is in addition to controls to outright block risky data activity. - Rollout
Some organizations will repeat these steps with an expanded data set or extend data identification and classification to enable fine-tuned data controls. By initially focusing on securing a subset of the most critical data, DLP is simpler to implement and manage. A successful pilot program will also provide options for expanding the program. Over time, a larger percentage of sensitive information will be included, with minimal disruption to business processes.
DLP Statistics
47% increase in data breaches since 2020
A common misconception is that data loss occurs mainly from malicious attackers. External breaches still account for over half of all data breaches. But internal data breaches are also increasing and account for nearly half of all data breaches. Many data breaches are not from outsiders, but from negligent or disgruntled employees.
84% of IT leaders say DLP is more difficult with a remote workforce
With more staff working from home, administrators have the additional challenge of protecting data on personal devices and stored in the cloud. This makes DLP more difficult as a remote workforce adds risks compared to keeping data internally on corporate controlled devices.
60% to 70% of all data breaches warrant public disclosure
This statistic can be harmful to the reputation of any company. A study conducted by Intel revealed that 70% of data loss incidents in smaller commercial organizations—SMEs or SMBs—warranted either public disclosure or had a negative financial impact.
Why Is DLP Important?
The cost of a data breach averages $4.25 million per incident, but the long-term damage to the brand name can affect future revenue for years. Businesses fall victim to cyber-attacks every 11 seconds, and for this reason DLP solutions are more important than ever. It’s difficult for administrators to defend the environment from numerous risks, so DLP solutions detect potential attacks and other anomalies.
The DLP solution that you choose will work along with strategies to reduce risk. Risk can never be reduced by 100%, so DLP solutions detect sophisticated attacks that bypass your cybersecurity defenses. They also keep your environment compliant so that the organization avoids hefty fines for regulation violations.
