Data Loss Prevention (DLP) Controls

What is data loss prevention?  Data loss prevention, also commonly referred to as DLP, is a process for ensuring that organizational information is not improperly or accidentally exposed.  It is an important factor in preventing unauthorized users from accessing sensitive or confidential company data.  When DLP policies and procedures are curated and implemented correctly, the risk of data loss and malicious information exposure can be significantly reduced!   

In addition to acting as a key factor in identifying areas needing protection, DLP can also be viewed as means to improve information security and protection, as well as comply with standards and regulations.  Don’t be fooled in thinking that threats may only come from bad actors from the outside.  Even if unintentional, internal users can also potentially be negligent.  DLP is not a one and done deal either, or even mindset, for that matter.  Ensuring that your organization is diligent and adheres to best practices and remains complicit is key.  While an individual’s role can differ, it is an effort that requires awareness and participation from everyone.   

Should your organization bother with DLP?  

In this day and age, it would be throwing caution to the wind if you do not implement these crucial security measures to better protect your organization.  What are some key reasons for implementing DLP controls?  There are many, including: 

• Housekeeping  
• Visibility 
• Audit purposes 
• Guarding your reputation 
• Safeguarding information and assets 
• Compliancy, including HIPAA 
• Prevent exposure of confidential company information (data breaches!) 
• The increase in mobile workforce and mobile devices 
• The reduction/elimination of virtual boundaries as Cloud adoption and usage continues to gain momentum 

Data lives all over the place and can take on many forms.  Data, simply defined, are items of information.  These items of information can be collected for analysis and for reference purposes.  When it comes to organizational data, this can reside in storage (also known as at-rest), be in transit via the network (also known as in-motion), or be in current use (for example, when using your workstation).   

Data can be found on your data storage devices, on your mobile device, or on your laptop to name a few.  Data can be outright identifiable or potentially aide in being identifiable to your organization.  Regardless of its form, it should initially all be equally concernable.  Additionally, data is here to stay and exponentially grow, which means that it is increasingly vital to safeguard this information! 

Data Loss Prevention controls also includes an assortment of techniques, preventative measures, and software products implemented to better control data access and data transfer.  Software can provide various security features that can be tailored to your organizations needs to provide the means to label, monitor, analyze, block, quarantine, alert, and report on.  These all provide excellent opportunity for fine tuning controls and policies in place, as well as implementing new controls and policies based on your organization’s needs. 

You may want to ask yourself a starting question, is there is more that your organization can do to better protect themselves?  Do you believe your organization has a strong need to implement DLP controls or improve them?  Chances are, the answer is Yes.  So, where is a good place to start when it comes to determining “what’s next”?  Below are some guidelines and food for thought: 

• Determine where all of your organization’s data is located.  Remember to think outside the box. 
• Categorize the data, including the overall scope and determine how much of it is sensitive information.  The goal is to determine what exactly needs to be protected. 
• Determine who is accessing the data. 
• Determine for what purpose is the data being accessed. 
• Determine by what means does accessing the data become a risk scenario. 
• Oversee data movement over a period of time (past, present, and plan for the future). 
• Determine what is the goal and desired outcome – what is the end result you seek?  Remember, the goals can be divvyed up and be of varying priority. 
• Determine what controls may already exist 
• Modify or eliminate existing controls; develop new controls, as deemed applicable 
• Test the controls; adjust as needed. 
• Communicate these controls. 
• Ensure the organization’s individuals are aware of the effort.  Provide training, set expectations, ensure there is open communication pertaining to the effort. 
• Implement the controls.
• Monitor. 
• Assess feedback and review results.
• Determine areas of improvement needed, what is working well and plan for present day as well as the future. 

Data Loss Prevention, when used in conjunction with the applicable controls and implemented properly, is a significant factor in protecting the wellbeing of your organization and keeping its proprietary information safe.  DLP is not composed of a single process, tool, or person, but is rather a solution consisting of techniques, best practices, processes, policies, individual contribution, software utilization, and overall management.  Maintenance of the DLP solution is key and your organization will certainly reap the benefits of having a solid DLP plan in place. 

If you have any questions on how DLP can help your business or how to implement it, please feel free to contact us.