"For a successful DLP implementation it is critical to understand the key stakeholders, identify data loss scenarios"

Building An Effective DLP Programme

In the good old days, when company's information lived on paper, it was much easier to manage and protect. The key users accessed it, classified it and the most secret documents were put in a safe. Copying was difficult. It would take years to photograph or smuggle volumes of documents. Things did not even change much when computers began to appear in the firms. They were used mostly for accounting or other transactional systems. These were self-contained systems to which few people had access.

Also, so far firms have used mostly transactional systems, which track the flow of money, products and people within a company. Now, firms are increasingly investing in “systems of engagement”, technologies that digitize, speed up and automate a firm's interaction with the external world. Mobile devices, video conferencing and online chat are common examples of these technologies.

In today’s fast changing business environment, companies merge, employees join and leave, new regulations and laws are passed. These changes put company’s valuable information at risk. The pressure is regulatory as well as commercial. Stricter dataprotection and other rules are also pushing firms to keep a closer watch on information.

Data Leak Prevention (DLP) protects sensitive data and provides insight into the use of content within the enterprise. DLP should be considered to safeguard the organization from the insider threats eg. inadvertent or deliberate abuse of data, control weaknesses, loss of mobile assets or hacking etc. It is a software that sits at the edge of a firm's network and inspects the outgoing data traffic. If it detects sensitive information, it sounds the alarm and can block the incriminating bits.

DLP is one of the most hyped and least understood element in IT security. Hence for successful DLP implementation it is critical to understand the key stakeholders and identify data loss scenarios. Companies need to realize what kind of information they have and how valuable or sensitive it is. They are often trying to protect everything instead of concentrating on the important stuff. A first step is to decide which data should be kept and for how long. Secondly, companies must classify information according to how sensitive it is.

Although most leaks are not deliberate, many are. It is important to keep an eye on everything that is happening in a corporate network and records all the digital goings-on and then looks for suspicious patterns, creating real-time awareness.

Lastly, technology can't completely solve the problem, it just lower the probability of accidents. DLP is no guarantee against leaks as it cannot tell what is in encrypted files. Data can be wrapped up and smuggled out. It may be useful to think of a computer network as being like a system of roads.