The average cost of a data breach in the US rose to $4.24 million in 2021. Remote work due to the COVID-19 pandemic was a major factor in increasing this cost. For large organizations, this cost could be even higher. The cost of the data breach was highest in the Healthcare industry. Many organizations face a challenge of keeping track of all their data. One of the reasons for this is that employees now use multiple devices and store data at different locations such as desktops, laptops, smartphones, notebooks, file servers, and on the cloud. They also use multiple communication channels such as email, shared online folders, social media, and collaborative software to send and share data. Due to these reasons, many organizations are unable to track sensitive data leaving the organization and prevent data loss.
Organizations need to protect sensitive data due to multiple industry and government regulations such as HIPAA and PCI-DSS.
Data Leak Causes
The main causes of data leaks within an organization are:
Data exfiltration by cyber criminals
Cybercriminals target sensitive data and use multiple techniques like phishing, malware, social engineering, and injection attacks to gain access to the organization’s sensitive data and exfiltrate it.
Unintentional data exposure
Some of the data leaks happen due to human errors. An employee might misconfigure access to sensitive data in the cloud or expose secrets in code repositories.
Malicious insiders
A disgruntled employee might compromise privileged user accounts to exfiltrate sensitive data outside the organization.
Data Loss Prevention
Data Loss Prevention is a set of tools and processes that are used to detect and prevent unwanted destruction, unauthorized access, and exfiltration of sensitive data. Organizations use DLP to protect their sensitive data and to comply with regulatory compliances such as HIPAA, GDPR, PCI-DSS, etc. DLP solutions use rules to classify and protect sensitive data so that users cannot accidentally or maliciously exfiltrate sensitive data from the organization. DLP solutions monitor endpoints and networks to protect data-at-rest, in-motion and in-use.
Use Cases for DLP
The main use cases for DLP in an organization are:
Compliance
The organizations that collect and store Personally Identifiable information (PII), payment card information or protected health information (PHI) need to adhere to compliance regulations such as GDPR, HIPAA and PCI-DSS. A DLP solution helps the organization to follow these regulations by identifying, classifying, and monitoring sensitive data.
IP protection
A DLP solution also helps an organization classify its intellectual property and protect against unauthorized access and exfiltration of trade secrets.
Data visibility
A DLP solution can also help an organization track data-at-rest and in-motion on endpoints, networks, and cloud. This provides organizations with more visibility into the types of data stored on the endpoints and in the cloud.
Types of DLP Solutions
There are multiple ways to steal data from an organization. The DLP solution should be able to detect the many ways the sensitive data could be exfiltrated from an organization. The different types of DLP solutions are:
Endpoint DLP
An endpoint DLP solution monitors data on the devices in the network. This solution is installed on endpoints like laptops, servers, smartphones, printers, etc, to monitor and protect the data residing on them. Endpoint DLP protects data on these endpoints even if the endpoint is offline or connected to a public network. This solution also prevents transferring of sensitive data to USBs.
Network DLP
This DLP solution is implemented on the network and monitors data-in-transit. All the incoming and outgoing data can be monitored, protected, and blocked from any device connected to the network. The DLP policies can be enforced on all the devices connected to the network. This solution can only protect data on the devices connected to the network and cannot protect data on offline devices.
Email DLP
The email DLP solution monitors and filters emails based on certain keywords. This solution can reduce the data leakage through emails.
Cloud DLP
A cloud DLP solution monitors and protects the data stored in the cloud. The solution can protect and monitor emails, documents, and other types of files.
DLP Best Practices
To develop an effective DLP program, the recommended best practices are:
- Determine the primary data protection objective in order to determine the appropriate DLP solution for the organization.
- Implement a centralized DLP program and work together with different business units and departments to define consistent DLP policies that govern the organization’s data. This will increase data visibility across the organization.
- Conduct an assessment on the types of data and its value to the organization. Identify the data, whether it is sensitive data and its storage locations. Evaluate the data exit points. Then evaluate the risk to the organization for each type of data if it is leaked.
- Create a data classification system for both structured and unstructured data. Data classifications might include internal, confidential, public, personally identifiable information (PII), intellectual property, and others.
- Create data handling and remediation policies for different types of data. DLP solutions have pre-configured rules based on various regulations such as GDPR, HIPAA, etc. These rules can be customized as per the organization’s needs. Develop controls for reducing data risk. Organizations should develop granular, fine-tuned controls to reduce the specific data risks.
- Educate employees to reduce the risk of accidental data loss by insiders. Employee awareness and understanding of security policies is very important for a successful data loss prevention program. Awareness programs and trainings such as posters, emails, online trainings, and workshops can help in improving the employee understanding and adherence to data security policies and best practices.
Conclusion
Organizations need to protect sensitive data-at-rest, in-transit and in-use. They also need to ensure that data is protected on all devices and on the network, considering the different data exit points. A robust DLP solution can help organizations ensure data protection on all devices and in different stages of the data lifecycle. Encryption Consulting is a customer-focused cyber security consulting firm providing services to various clients on implementing and managing DLP in their environments. To see how we can help your organization, visit our website at www.encryptionconsulting.com
