SmallBizResource Blog -- Networking & Communications

Best Practices For Data Protection

Posted by Judy Mottl Tuesday, Oct 23, 2007, 07:57 AM ET

Managing data is one of those daily tasks that’s never going to go away, or get any easier. Just one data theft or loss can hit a small business hard—-from damaging a company's reputation to losing customers.

But there are some good best practices you can put in place to reduce risk.

Whether it's email, instant messaging, Web mail, a form on a website, or file transfer, most electronic communications exiting a company are uncontrolled and unmonitored –- not a good situation.

A new report, “Data Loss Prevention Best Practices, Managing Sensitive Data in the Enterprise,” from IronPort Systems outlines tips that organizations can employ to help prevent leaks, enforce compliance, and protect its brand value and reputation.

“When it comes to DLP, the heart of the matter is uncontrolled communications,” explains Tom Gillis, SVP of Marketing at IronPort Systems. “Electronic communications and data in motion is the most significant data loss vector in the enterprise today. Current firewall and other network security solutions do not include data loss prevention capabilities to secure data in motion. Important controls, such as content scanning, blocking of communications containing sensitive data and encryption, are missing.”

Here's what to do:

1: Take Time to Define DLP Needs
The critical first step toward addressing the data loss problem is to develop a comprehensive understanding and inventory of the types of sensitive data that exist within the organization and what policies are needed to control and enforce how that data can be shared. To do this, organizations need to review the extent to which their company or agency is affected by regulatory compliance, intellectual property protection and appropriate use enforcement.

2: Prioritize the DLP Focus
Focusing first on the most significant DLP areas - those that represent the greatest potential loss vectors - makes it easier to justify solutions and get started on plugging the leaks.

3: Ensure Effective, Comprehensive Coverage
Overall, a DLP solution must comprehensively detect attempted policy violations. This includes:
• Multi-protocol monitoring and prevention
• Content-level analysis of all major file and attachment types
• Selective blocking and/or quarantining of messages
• Automatic enforcement of corporate encryption policies

4: Make the Solution Unobtrusive
The best DLP solution is non-intrusive. Overcoming the challenges of maintaining effective communications (while ensuring management and control of customer and sensitive information) requires: well thought out policies; and processes for monitoring communications content. Organizations should select a DLP solution for email and Web applications that can manage ever-increasing message volumes and handle future bandwidth requirements.

5: Look for Work Flow, Administration and Reporting
A DLP solution cannot be effective without detailed reports of all suspected violations. Administrators and policy officers should have the ability to receive reports outlining detected violations and providing in-depth information to enable them to take action. These details include: the message sender, contents, attachments, intended recipients and information about the violating content.

6: Combine Best-of-Breed Solutions
Companies should avoid selecting a DLP solution that inhibits them from integration in the future. As the industry evolves, it will be crucial to have the flexibility and support to take full advantage of future third-party solutions through connectivity and data sharing.

Networking & Communications