Enterprises today receive millions of email messages and data files daily, containing sensitive data including the records of customers, business partners, shareholders, staff members, and more. With the advent of cloud technology, an organisation's fear of losing data is amplified if its critical data is hosted outside by a third party and not within its total control.
It is a fact that, in today's complex business world, data is seen as the new currency and can be attributed with a monetary value. However, the damage that data loss can do to an inadequately secured enterprise extends far beyond pecuniary matters, and can include reputation loss, regulatory consequences, a decrease in customer confidence, trust issues, a drop in market share, and the development of trade barriers.
A company that holds the sensitive data of customers, business partners and regulators needs to come to terms of with the responsibility of securing this information. Unfortunately, businesses constantly fall victim to massive data loss, and high-profile data leakages involving sensitive personal and corporate data continue to appear, but are often not publicised - especially in South Africa.
This is something that will change when the Protection of Personal Information (PoPI) Act, which highlights the importance of management and control over data, comes into full operation, meaning that organisations need to take measures to understand the sensitive data they hold, how it is controlled, and how to prevent it from being leaked or compromised.
In order to do this, it is important to understand what data loss really is. Data loss can be divided into two overlapping categories: leakage and damage. Leakage occurs when sensitive data is no longer under the organisation's control (such as a loss of confidentiality due to for hacking or identity theft). Damage, or the disappearance of data, occurs when the correct data copy is no longer available to the organisation, resulting in a compromise of integrity or availability.
Data is generally found is three modes: at rest; in motion; and in use. Data at rest includes data that resides in files systems, distributed desktops and data stores/databases; data in use refers to data that being used in end-point devices like mobile devices, USB drives and other end-point devices; and data in motion denotes data that moves through the network to the outside world via email, instant messaging, peer-to-peer (P2P), FTP, or other communication mechanisms. As the digital world evolves and technologies converge, the types of solutions used to move data will become more complex, requiring different treatment of data management.
Data Loss Prevention (DLP) is a strategy to ensure that end-users do not send sensitive or critical information outside of the corporate network. This type of technology requires proper planning and, even more importantly, precise implementation. DLP is a complex issue with no single effective solution; in essence, each organisation has its own challenges, business needs and risk-mitigation strategies. This requires a continuous assessment of DLP requirements on an ongoing basis.
It is imperative that organisations realise that their greatest assets are their people. Unfortunately, people are also a weakness in the system. Creating awareness around the correct management and use of data is a critical element in mitigating risks around data loss. Security awareness training should be mandatory for all staff (including management), thereby establishing a common baseline of security knowledge and removing the 'I didn't know' mindset.
DLP focuses on the three pillars of data security: monitor; protect; and discover. When selecting a DLP solution, it should not interrupt business activities and should operate without deteriorating system or employee performance. DLP products generally come with built-in policies that are already compliant with the relevant compliance standards, like PCI, HIPPA, SOX and so on, but alignment between the organisation's needs and these policies is required.
The key element for a successful implementation of a DLP strategy and subsequent implementation project is to identity the data that needs protection. Adopting a blanket approach across the entire organisation will not work, as the outcome will in a large number of false positives being generated.
Key steps to be adhered to in a DLP strategy roll-out must include:
The multitude of DLP products in the marketplace makes it difficult for an organisation to make its choice. These guidelines should assist in this selection process:
DLP can offer great benefits to an organisation as with greater insight into, and thus control over, its sensitive data. Data management policies can be revised and the ability to manage the risks that relate to data - a key asset - is significantly improved. After all, data is the new currency.
