{"id":2045,"date":"2023-01-10T11:14:45","date_gmt":"2023-01-10T11:14:45","guid":{"rendered":"https:\/\/firmussec.com\/sg-dev\/dev\/?p=2045"},"modified":"2023-01-13T11:31:10","modified_gmt":"2023-01-13T11:31:10","slug":"an-approach-to-effective-implementation-of-data-leakage-prevention-dlp","status":"publish","type":"post","link":"https:\/\/firmussec.com\/sg\/an-approach-to-effective-implementation-of-data-leakage-prevention-dlp\/","title":{"rendered":"An Approach to Effective Implementation of Data Leakage Prevention (DLP)"},"content":{"rendered":"
<\/div><\/div>
By Maj. Maneesh Chandra (Rtd.) \u2013 Chief Technology Officer, FIRMUS<\/h5><\/div>

Data loss can be a devastating experience for individuals and businesses alike. It can occur due to various reasons, such as hardware failure, software corruption, cyber-attacks, or human error. Losing important data can have serious consequences, including financial losses, legal issues, and damage to a company\u2019s reputation. Therefore, it is essential to have proper governance and measures in place to mitigate the risks of data loss and ensure that valuable information is being safeguarded while being available to the authorised people.<\/p>\n<\/div>

<\/div>

What is Data Loss Prevention (DLP)?<\/h2><\/div>

Data leakage prevention (DLP) is a security strategy to detect potential data breaches and prevent the unauthorized or accidental release of sensitive information. It helps prevent users from sending sensitive information or critical information outside the corporate network. The importance of DLP has only been made more critical with the\u00a0trend of working from home<\/a>\u00a0today and the\u00a0increasing importance to deal with cyberattacks<\/a>.<\/p>\n<\/div>

<\/div>

Before You Begin<\/h2><\/div>

DLP is a sub-set of Data Governance, hence implementing the DLP Program starts with defined governance processes which are supported by DLP technologies to realize the organisation\u2019s objectives for protection of its data.<\/p>\n

DLP technologies are deployed both in on-premises environments and as a cloud service. It is important to note that DLP is not a plug-and-play solution. A successful implementation requires significant preparation and diligent ongoing maintenance along with appropriate governance measures. These solutions work by identifying sensitive data, and then monitoring and protecting that data as it moves across the network.<\/p>\n

Hence, DLP should be incorporated into an organization\u2019s cybersecurity journey, rather than be just a pitstop to onboard DLP technologies.<\/p>\n<\/div>

<\/div>

Why is DLP Needed?<\/h2><\/div>

Data is the lifeblood of any organization, and it must be protected as a data breach event can result in financial losses as well as losing trust of clients.<\/p>\n

Organizations that are subject to data privacy regulations such as the Malaysian Personal Data Protection Act (PDPA) or the European Union (EU) General Data Protection Regulation (GDPR) need to have DLP in place to help reduce leaking of sensitive data. By providing alerts or blocking data transfer, and identifying where sensitive data is stored, unauthorized or accidental release of sensitive information can be prevented.<\/p>\n

DLP is needed beyond satisfying regulatory requirements. It is also to honour the trust that clients have in us to safeguard their data.<\/p>\n<\/div>

<\/div>

Good Practices to Implement DLP<\/h2><\/div>

As DLP is a sub-set of Data Governance, a good approach to implementing DLP is to start with Data Governance. Any organisation intending to implement DLP must have a\u00a0Data Governance Structure<\/a>\u00a0so that there is a structure to deal with the frameworks, strategies and plans, policies, guidelines, procedures, etc.<\/p>\n

This organisational structure is required to appropriately classify data into different levels of sensitivity, the risk due to the data being available to unauthorised parties, and the processes to be implemented to reduce the risk to a level acceptable to the organisation. The structure can also help define the accountabilities and responsibilities for managing an organisation\u2019s data as well as sensitive data which is in the organisation\u2019s custody.<\/p>\n

A well-known framework for data governance is the\u00a0Data Management Association International<\/a>\u00a0(DAMA) called the\u00a0DAMA Common Body of Knowledge<\/a>\u00a0(DMBoK). The DAMA Data Management Body of Knowledge is a comprehensive guide to the field of data management, containing chapters on every aspect of the discipline.<\/p>\n

Once the appropriate governance and processes are defined then the organisation would be able to consider the DLP technologies which best support the organisational objectives. The data governance processes and hence the DLP technologies must be able to protect the organisation\u2019s sensitive data in three primary areas such as:<\/p>\n