Finding a Data Loss Prevention (DLP) system that works for your company is unfortunately not enough to actually make it work. A DLP strategy is something that constantly needs to be iterated, reworked and updated depending on not just how technology changes but also, crucially, how your company and its data changes. Here are the top reasons why your data loss prevention strategy may fail.
- Lack of communication
Communication has to flow to every level of the company and every person in a management position needs to assume responsibility and ownership for doing this. A DLP solution needs buy-in from your employees in order to work and the DLP policy won’t work if no one actually follows it. Ensure roles and processes are defined and communicated clearly.
- Not understanding your employees’ motivation
This one is particularly relevant for maliciously lost data. Internally lost data can be either malicious or accidental. If it’s accidental, you know those employees made a genuine mistake and were not following the policies correctly. A malicious attempt to leak data means that they were intentionally not following policies correctly and therefore the system has to find other ways to detect incidents when sensitive files are being accessed.
- Poor data classification
One key way of ensuring that files are picked up by a DLP system is by implementing a meticulous classification system. Firstly, define what your sensitive files are through a risk management system. Then figure out what are the unique features of your sensitive files that you can pinpoint and classify.
- Ineffective in a work environment
An overzealous solution can sometimes be as ineffective as having no solution at all. If your strategy is too intrusive on the output of your employees, then it’s human nature that they will begin to ignore it, even when it is effectively managed. Likewise, a lot of false-positives in reporting from a very strict policy can mean that actual data breaches are overlooked when they happen.
- Failure to identify all end points
Our increasingly mobile and remote workforce means that the number of networks, systems, devices and end points are also increasing. A DLP solution that focuses on protecting just the centralized network is no longer appropriate. There needs to be wide consideration, particularly for remote devices and the procedures and policies around this.
- Limited reworking
We mentioned this at the beginning because it’s one of the major flaws in many DLP solutions. Some employers view a DLP solution like a firewall – you put it up and then sit back and relax while it does the security work. DLP strategies are much more sophisticated than this and require constant iterations as things change as well as thorough assessments of how it is working in the real world, not just through statistical reporting.
These tips are designed to give you a feel for what can go wrong with DLP strategy implementation. Generally, the foundation for what can go wrong often sits in a lack of understanding about the purpose of a DLP plan, it’s communication and what needs to be done to make it work in today’s modern work environment.