Don?t neglect Data Loss Prevention (DLP) for the cloud

Posted by Lauren Ellis on August 11th, 2014

There was a time when data loss prevention (DLP) efforts were focused on storage devices, email, and printing.  However, now that you can take your device with you, in the form of a laptop or mobile phone, a lot more attention has been focused on devices themselves.

This makes sense as there are a ton of examples, from the US, but also from abroad of compliance fines for data that was lost via a laptop or mobile device.  The mobile device management (MDM) industry has made significant strides in securing these mobile devices, which tend to get lost or stolen with almost no effort at all.  But this leads to my fourth cloud data security tip – look beyond devices and email and address DLP for the cloud.

The government can be relentless in prosecuting PCI, HIPAA, and HITECH compliance violations, regardless of how seemingly innocent the cause of the breach was.  In both the examples hyperlinked above, the fined party lost the data because a laptop was stolen and the confidential data found within the device was not encrypted.

So, can you imagine how forgiving the government will be when a hospital uses Google spreadsheets to track patient information.

Not convinced this will happen to the cloud services you are using?  Well it probably already has.  For a beautiful and terrifying view into recent and remarkable data breaches, check out Information is Beautiful’s visualization of the worlds biggest data breaches.  You’ll notice quite a few cloud services in there.

So what can you do?  First you have identify all of the cloud security services your organization is using.  Then you need to understand which data is going to which services.  With this visibility you’ll be able to implement a targeted and realistic data loss prevention effort.

It doesn’t make sense to try and block or encrypt every piece of data going to every cloud service.  So, you’ll want to use a trigger-based DLP process that identifies personally identifiable information, financial data, or confidential data that is heading to or living in the cloud.  You’ll want the flexibility to either alert, encrypt, or block that data and you’ll want the flexibility to do this inline or offline.

Using this process, you’ll be able to prevent personally identifiable information (PII) and personal health information (PHI) from hitting the cloud unprotected – in doing so you protect your organization from IP leakage, compliance violations and fines, and the awful PR associated with being in next year’s annual data breaches report.

Author :
Lauren Ellis is a research analyst covering the technology industry’s top trends & topics, focusing on Cloud Security, Cloud Computing, Data Loss Prevention etc.,