Data Loss Prevention: definition and uses

Estimated reading time: 7 minutes

Data loss prevention (DLP) is a set of tools and processes used to ensure that sensitive data is not lost, misused or accessed by unauthorized users. DLP software classifies regulated, confidential and business-critical data and identifies violations of policies defined by organizations or within a predefined policy package. Default policies are typically dictated by regulatory compliances such as HIPAA, PCI-DSS, or GDPR.

Once these possible violations are identified, the DLP applies “remediation” with alerts, encryption, and other protective actions. The goal is simple: prevent end users from accidentally or maliciously sharing data that could put the business at risk.

Data loss prevention software and tools monitor and control endpoint activity, filter data flows across corporate networks, and monitor data in the cloud to protect data at rest, in motion, and in use. DLP also provides reports to meet compliance and auditing requirements. A very useful tool also for identifying areas of weakness and anomalies for incident response.

Is it necessary to use DLP tools?

Data loss prevention addresses three main objectives that are common pain points for many organizations: personal information protection/compliance, intellectual property protection, and data visibility.

Personal Information Protection / Compliance

Does your company collect and store personally identifiable information (PII), protected health information (PHI), or payment card information (PCI)? If so, you are more than likely subject to compliance regulations, such as HIPAA (for PHI) and GDPR (for personal data of EU residents), that require you to protect your customers’ sensitive data.

Data loss prevention can identify, classify and label sensitive data and monitor activities and events surrounding that data. Additionally, reporting capabilities provide the details needed for compliance audits.

Intellectual property (IP) protection

Does the company hold important intellectual property and trade or state secrets that could jeopardize the financial health and/or image of your brand in the event of loss or theft? A DLP solution can classify intellectual property in both structured and unstructured forms.

With policies and controls in place, you can protect against unwanted exfiltration of this data.

Data visibility

Is the company looking to gain additional visibility into data movement? A comprehensive enterprise DLP solution can help you see and track your data across endpoints, networks and clouds. This will provide visibility into how individual users within your organization interact with data. As we have seen other times when talking about social engineering, knowing how users behave is very useful. It is used to draw a basic profile and monitor that there are no anomalies that could indicate compromise of the account.

The ones listed above are main use cases. But DLP can address a variety of other pain points including insider threats, user and entity behavior analytics, and advanced threats.

Why adopt data loss prevention?

In the 2017 Gartner Magic Quadrant for Enterprise DLP, the total data loss prevention market was estimated to reach $1.3 billion in 2020. The size was approximately $2.64 billion. The DLP market is not new, but it has evolved to include managed services, cloud capabilities, and advanced threat protection, among other things.

This, combined with the increasing trend of major corporate breaches, has skyrocketed the adoption of DLP as a means to protect sensitive data. Here are nine trends that are driving DLP adoption.

Growth of CISOs

More and more companies are hiring Chief Information Security Officers (CISOs) who report to the CEO. The latter want to know the strategic plan for preventing data leaks. Data loss prevention tools provide clear value in this regard and give CISOs the reporting capabilities needed to provide regular updates.

Evolution of compliance requests

Global data protection regulations are constantly changing and every organization must be adaptable and prepared. In recent years, EU legislators have approved the GDPR. In the USA a similar event occurred when the State of New York adopted the NYDFS Cybersecurity Regulation. These new regulations have both tightened data protection requirements. DLP solutions allow organizations the flexibility to evolve with changing global regulations.

Increase in “places” where data is kept

The increased use of the cloud, complicated supply chain networks and other services over which you no longer have full control has made data protection more complex. Visibility into events and context surrounding data before it leaves your organization is important to prevent your sensitive data from falling into the wrong hands.

Frequency of data breaches

Nation-state adversaries, cybercriminals, and malicious insiders target your sensitive data for a variety of reasons, such as corporate espionage, personal financial gain, and political advantage. Data loss prevention can protect against all types of adversaries, malicious or otherwise.

In recent years, there have been thousands of data breaches and many other security incidents. Billions of records have been lost in giant data breaches such as: the database misconfiguration that leaked nearly 200 million US voter records in 2015, the Equifax data breach that continued to grow, and the Yahoo breach which affected 3 billion users. These are just a few of the many headlines that highlight the need to protect your organization’s data.

The value of the data is very high

Stolen data is often sold on the Dark Web, where individuals and criminal groups can purchase it and use it for their own benefit. With some types of data selling for up to thousands of dollars, there is a clear financial incentive for data theft.

There is more data to steal

The definition of what is sensitive data has expanded over the years. Sensitive data now includes intangible assets, such as pricing models and business methodologies. From 1975 to 2015, the amount of intangible assets grew from 17% to 84% of market value, according to a study by Ocean Tomo. These assets also reached a record $21 trillion in 2018. This means that your company has a lot more data to protect and using data loss prevention could only help in this regard.

There is a shortage of specialized personnel

The security talent shortage isn’t going away anytime soon, and there has likely already been an impact on your business. In fact, in a 2017 ESG and ISSA survey, 43% of respondents said their organizations were affected by a lack of skilled staff. The shortage is worsening with 3.5 million unfilled security positions expected by the end of 2021. Managed data loss prevention services act as remote extensions of your team to fill this staffing gap.

Adopt a SIEM to implement DLP

Ormai il prodotto di più alto valore di un’azienda sono i dati che gestisce. Il rischio di data exfiltration e conseguente perdita economica e d’immagine è dietro l’angolo. È facile a dirsi che basta proteggere i propri dati, la realtà è che diventa ogni giorno più complicato.

Nowadays, a company’s highest value product is the data it manages. The risk of data exfiltration and consequent economic and image loss is just around the corner. It’s easy to say that protecting your data is enough, the reality is that it becomes more complicated every day.

The places where data are used and stored, as well as the methods of access and consultation, are increasing. Technology, in general, makes our lives easier while at the same time exposing our data. Corporate infrastructures are no exception, indeed, precisely due to the highly valuable nature of the data collected, they are subject to greater risk.

The adoption of an adequate security system is essential and there are many solutions available. We at SOD, speaking of data loss prevention, recommend adopting a SIEM that includes the tools necessary to implement DLP techniques. For even better protection and more granular control of user data, SOC as a Service also provides behavioral analysis performed by an artificial intelligence system (UEBA).

To find out how these services can help your company protect your data and infrastructure, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

Machine learning and cybersecurity: UEBA applications and security

Avoid Ransomware: That’s why it’s best not to take any risks

• Log Management
• Considerazioni sulla conformita’ al regolamento generale sulla protezione dei dati (GDPR) per l’infrastruttura di backup e archiviazione