Datalossprevention-EY.pdfVIP

Insights on governance, risk and compliance October 2011 Data loss prevention Keeping your sensitive data out of the public domain Contents Introduction 1 Understanding the problem 2 Challenges 6 Employing a holistic approach 10 Data governance 13 Data loss prevention controls 16 Supporting information security processes 17 Using technology to support the DLP program 18 Ernst Young insights and lessons learned 20 Don’t be a victim 21 Data loss prevention (DLP) is the practice of detecting and preventing confidential data from being “leaked” out of an organization’s boundaries for unauthorized use. Data may be physically or logically removed from the organization either intentionally or unintentionally. Introduction Over the last few years, companies in every industry sector around the globe have seen their sensitive internal data lost, stolen or leaked to the outside world. A wide range of high-profile data loss incidents have cost organizations millions of dollars in direct and indirect costs and have resulted in tremendous damage to brands and reputations. Many different types of incidents have occurred, including the sale of customer account details to external parties and the loss of many laptops, USB sticks, backup tapes and mobile devices, to name just a few. The vast majority of these incidents resulted from the actions of internal users and trusted third parties, and most have been unintentional. As data is likely one of your organization’s most valuable assets, protecting it and keeping it out of the public domain is of paramount importance. In order to accomplish this, a number of DLP controls must be implemented, combining strategic, operational and tactical measures. However, before DLP controls can be effectively implemented, your organization must understand the answer to these three fundamental questions: