Data leakage prevention

Data classification can be used to give data processors a quick view of how critical data is and how data should be processed and protected.

The data categories used and the corresponding security levels are defined. The category of information is defined by analyzing the confidentiality, integrity and availability of the information in question, as well as any other requirements. Each level is given a clear and descriptive name.

Data classifications can be, for example, the following:

• disclosure of information does not cause harm (PUBLIC)
• disclosure of information causes slight inconvenience or minor operational annoyance (CONFIDENTIAL)
• disclosure of information has significant short-term effects on operations or tactical objectives (LIMITED)
• disclosure of information has serious implications for long-term strategic objectives or jeopardizes the very existence of the organization (PROHIBITED)

CONFIDENTIAL paper information may require e.g. the following protections:

• Locked cabinet
• Trusted transfer partner
• Sealed envelopes
• Safe disposal process

CONFIDENTIAL electronic information may require e.g. the following protections:

• Use the selected encryption level
• Password protection
• Safe disposal process
• More limited access rights

Especially when local or unstructured data needs to be handled a lot due to the nature of the activity, it may be necessary to develop training that describes the risks involved for staff.

Common problems with local and unstructured data include e.g.:

• no backups
• no access management
• hard to locate

For data you do not want to lose, that you want to control, or that is important to find in the future, staff should use data systems designed for it.

Data Loss Prevention (DLP) policies can be used to protect sensitive data from accidental or intentional disclosure. Policies can alert, for example, when they detect sensitive data (such as personal identification numbers or credit card numbers) in email or another data system to which they would not belong.

The organization defines DLP policies related to endpoints in a risk-based manner, taking into account the data classification of the processed data.

A large amount of valuable information in an organization has often accumulated over time into hard-to-find and manageable unstructured data — excels, text documents, intranet pages, or emails.

Once this information has been identified, a determined effort can be made to minimize its amount.Important data outside data systems is subject to one of the following decisions:

• move into a data system
• get rid of (when the information is old, no longer necessary or otherwise irrelevant)
• is kept in use and a responsible person is appointed to manage the risks

The DLP system aims to prevent the loss or leakage of sensitive data. The system can be used to prevent unwanted actions by monitoring, detecting and preventing the processing of sensitive data without meeting the desired conditions. Blocking can be done during use (in-use, terminal operations), in motion (in-transit, network traffic) or in storage locations (at-rest).