We live in an age of information where data is often more valuable than money itself. Both raw and processed data, as well as the communication channels that convey it, are the lifeblood of most modern organizations, regardless of the industry, they operate in or their size.

This, unfortunately, also means that losing that data, either through negligence or via cyberattacks, has become an inevitable aspect of running a successful company. 

This leads us to the main subject of this article – Data Loss Prevention (DLP). 

Having a strong Data Loss Prevention strategy in place has become paramount for businesses that would like to prevent their sensitive data from being lost and/or deleted, accessed by entities who are not supposed to access it, or simply stolen. This type of scenario can lead to disastrous consequences. For example, it was reported by the National Archives and Records Administration that 90% of companies that go through critical data loss situations fail to recover and go under during the following year. 

What Constitutes a Strong DLP Policy & How it Benefits Companies?

A proper DLP strategy is one that prioritizes the protection and systematic archiving of sensitive, valuable, regulated, and any other type of data that can cause harm to one’s organization if it gets deleted, lost or falls into wrong hands. Think company secrets, financial info, medical records, intellectual property, etc. 

A DLP strategy typically includes a symbiosis of policies and technological solutions. It involves integrating proper firewalls preventing your data to be physically lost or accessed, as well as having strong formal policies in terms of sharing confidential information through communication channels like email.

DLPs can help businesses with the following aspects of data protection and archiving: 

• Having adequate control of access permissions for critical information-based assets
• Overview and monitoring of activity and dataflow within the infrastructures, servers, networks, workstations, etc. Who has access, can read or copy which documents, and so on. 
• Having control over dataflows both inside and outside the company (remote working employees, clients, third-party entities, etc. 
• Having overview and control over the ecosystem of relevant data-transfer channels and outgoing data streams. 

Let’s now tackle some of the most widely used (and praised) best practices for integrating a potent DLP policy. 

10 Data Loss Prevention Implementation Tips & Best Practices

In order to make the most out of the DLP implementation process and increase your chances of getting this data security plan properly in place, you should consider the following industry standards and best practice tips. Bear in mind that this task is not exactly a walk in the park and can be an important investment for the company implementing it. 

Here are 10 best practices for creating an effective DLP strategy:  

1. Determine What Data is Sensitive & Classify it 

Not all data is made equal. This is why you should identify the documents, files, and other types of information that could potentially cause the greatest damage if it gets lost or is accessed by unwanted parties. It is also a good idea to perform triage in terms of data value and sensitivity. 

Naturally, the most sensitive files that you do not want to be leaked tend to vary from business to business and depend on the industry they are a part of. For instance, healthcare companies would deem Protected Health Information, or PHI, their most important data and would likely put the highest levels of protection to those pieces of information, while other industries tend to protect intellectual property, personal and/or client-related data, and so on.   

2. Define What Data Needs Archiving, When & For How Long

Make sure that your DLP policy tackles all the necessary details for data and email archiving rules. Most data protection and archiving tools have different prices for storing and keeping your documents. Another important aspect is the time frame of data accessibility. Which files need to be accessible quickly and easily, and which documents do not require fast retrieval. 

3. Define The Hierarchy and Chain of Command in terms of Roles and Responsibilities

It is always a good idea to have a well-defined structure when it comes to who within an organization has which role and what responsibilities in terms of utilization and maintenance of a DLP tool and policy. Try and determine who creates the policy, which team implements it, and which team performs revisions and maintenance. Bear in mind that, though the functionality is quite important, it is the security that should be paramount when it comes to your Data Loss Prevention policy, with the prompt response being the main objective. 

4. Track Sensitive Data Flows

Aside from determining which data is most sensitive, it is critical to secure and monitor the channels these pieces of data are traveling through. A lot of data flows between various different systems on a daily basis, which is why great DLP tools are designed to track the path and monitor the location of all important information within this system of data flows. 

5. Find The Right DLP Tool 

Much like not all data is created equal, neither are data protection tools. It is important to come up with the right list of parameters that a DLP platform should fulfill before opting for one. Here are some questions that could help you come up with a valid frame of reference when choosing a DLP tool: 

• Is this tool capable of tracking and monitoring data and its flows according to policies, users, events, etc? 
• Is this tool supporting and complying with all the necessary regulations that my company needs to adhere to?
• Does the tool feature a managed service or is the vendor providing traditional IT support?
• Can I use this solution with my current OS? 

6. Consider Doing a Pilot DLP Projects First

Creating a DLP policy can be a convoluted process that may require a trial and error method to get it right. Instead of going with an all-in strategy, perhaps it is wise to secure your most valuable data first, and then extend the project across other types of data. This can prevent you from backtracking your steps and implementation stages, and mitigate losing precious time and resources through utilizing a suboptimal solution. 

Some organizations decide to go only with the monitoring aspect during this initial stage of the project, and only later expand the service onto auto-encryption, user action blockage, and other similarly restricting features.  

7. Test Your DLP Systems Prior to Full Implementation 

Be sure to choose a DLP tool that can send alerts according to your specific policy-based rules and that can be properly supported by your incident response teams. To establish an optimal system, it is recommended to test your policies and DLP systems thoroughly prior to going live with the implementation itself. 

8. Be Cognizant of All the Limitations of Your DLP System

Be aware that certain DLP platforms, even though they secure higher visibility, accessibility, protection, and control of your company data, these tools also have limitations as well. For example, they cannot fully analyze data that has been encrypted without, especially not decryption keys, while some tools also fail at segmenting documents according to type and format.  

9. Define Parameters For Measuring The Success of Your DLP Plan

Regardless of whether you run a large-scale organization or an SME, creating a multifaceted DLP system is no small investment, which is why you need to figure out the right KPIs in terms of how successful and cost-effective your policy really is. 

Some of the handy KPIs include: 

• The overall number of false positives 
• The accuracy of detection 
• The number of events after you’ve implemented the policy 

10. Summary: Treat DLP as a Process, Not as a Product

It is no secret that traditional data security policies and MOs have become subpar in terms of effectiveness, especially within the modern digital environments where cyberattacks have strongly evolved. Both large organizations and smaller businesses should start shifting their mindsets toward more robust security systems and policies that tackle data protection on both granular and infrastructure levels. 

In order to extract the full potential of these systems, we recommend treating your DLP implementation as a long-term process rather than as a quick-fix security solution.

---

Photo by Mika Baumeister on Unsplash