Cloud DLP: Data Security for the Remote Workforce

What is Cloud DLP (Data Loss Prevention)?

Data loss prevention (DLP) secures sensitive data and prevents accidental exposure or malicious data exfiltration. It protects data in transit, data at rest, and data on endpoints. DLP solutions encrypt data to prevent its exposure, and monitor and control data transfers to make sure they are legitimate.

As organizations everywhere transition to remote work, Cloud DLP is becoming critical to data security. Cloud DLP solutions are used by organizations that store sensitive data in cloud storage (commonly accessed by remote employees, but also used from office locations). They encrypt data at rest while stored in cloud systems, and ensure data is only sent to authorized applications. Some cloud DLP products anonymize or obfuscate sensitive data to reduce the impact of data exposure.

This article is part of our series of articles about endpoint security.

How Does Cloud DLP Help Secure Remote Workforce Environments?

Multi-cloud environments using tools like Slack, Salesforce, Box, Google G-Suite, and Office 365, promote collaboration and productivity. Employees access these applications from a variety of devices, both corporate and personal, as well as from mobile devices. This raises the need for security policies and controls to safeguard sensitive data.

Different cloud applications employ different security management interfaces and each requires an administration effort. Managing this patchwork of applications and policies can become very complex.

Cloud DLP enables consistent data security and management across different software as a service (SaaS) applications and infrastructure as a service (IaaS) resources, by extending a company’s data security controls to the cloud.

Centralized policies enable cloud DLPs to classify and monitor sensitive data access and protect it, whether in the cloud, in emails and apps, in motion, and at rest. Real-time data protection includes data encryption, masking, and deletion of unnecessary data.

Related content: read our in-depth guides to other solutions that can help secure a remote workforce:

• Endpoint Detection and Response (EDR)
• Endpoint Protection Platforms (EPP)

Key Features of Cloud DLP Solutions

A comprehensive cloud data loss prevention solution should contain the following key features.

Pre-Built and Customizable DLP Policies

Cloud DLP should provide out-of-the-box policy templates built around security best practices. However, these templates should be easily customizable, and the solution should let you build new policies from scratch if needed.

Content and Context-Aware DLP

Content-aware DLP technology is now a standard. It constantly scans data for known alphanumeric strings and key terms that indicate sensitive data (these may be defined as policy rules). Content-aware DLP, for example, should be able to identify a 9-digit string as a social security or ID number, and even recognize whether the string is legitimate, and thus requires protection, or not.

Machine Learning

Machine learning techniques have become a critical part of data protection strategies. Machine learning enables DLP systems to progressively learn what should be flagged as a policy violation or security risk and what should not. Cloud DLP-based machine learning technology reduces false positives significantly, ensuring that only anomalies that have a real security impact are raised as alerts.

Alerts and Notifications

A cloud DLP should enable user notifications and administrative alerts, indicating policy violations that require remediation or investigation. Notifications for users are especially important, because they inform users that they have violated policies, and can instruct them how to handle data safely and reduce future incidents.

Automated Actions

Cloud DLP solutions should support automation of monitoring, auditing, and security controls for cloud-based data. They should not only identify policy violations, but also automatically react to them. You should be able to set policies for deleting, quarantining, or unsharing data or an entire data source.

Cloud Data Loss Prevention Best Practices

Here are some best practices you should adopt to make the best use of a cloud DLP product.

Prioritize Data

Identify which types of data the organization defines as critical for business purposes, and which data is sensitive for security or compliance reasons. A possible parameter for determining how “critical” or sensitive data is, is the level of damage caused by its loss or compromise.

Apply DLP to the most sensitive or valuable data, which may attract an attacker and may result in the biggest risks to the business.

Classify the Data

To manage data more easily, you should classify it based on context. Associate each unit of information by its creator and data store, associated application, etc. Consistent classification tags enable easy tracking.

Leverage the DLP solution’s content inspection to automatically classify data by keywords such as ‘secret’ or ‘confidential’, or by patterns such as credit card or social security numbers. The content inspection feature will usually have configurations suitable for specific compliance standards, such as PCI DSS and GDPR.

Identify Risky Data Flows

Data is at the biggest risk when it is distributed to user devices, customers, partners, or a supply chain. Data is at risk when transferred to a storage device or endpoint, attached to an email, or transmitted in any other way. Map out your data flows, identify the ones that carry the most risk, and set the appropriate security policies via the DLP solution to minimize risk.

Monitor Data in Motion

Sensitive data in motion requires monitoring and a high degree of visibility. A DLP solution should be able to identify behavior that puts data at risk, generate alerts, and allow security teams to easily identify what is happening and whether the incident requires intervention.

Progressively Develop DLP Controls

Business line managers should be aware of DLP procedures. These may be simple, to begin with, targeting common but obviously risky behavior around data. As the program progresses, controls may be fine-tuned and made more granular to target more specific risks.

Train Employees and Leverage Automated Prompting

Unless trained on data security practices, employees will continue to exhibit risky behavior. Training reduces risk by explaining the reasons that can lead to data loss, and sharing best practices. 

Automated user prompting is a simple and effective approach to user education, provided by DLP solutions. In addition to blocking some activity, the solution should notify about company policy or potential risk, and this can often be enough to suppress an activity.

Rollout

Starting small is often an excellent way to deploy a DLP solution. Repeating similar steps on gradually expanding sets of data of data identification and classifications enables fine tuning controls. Begin by focusing on a subset of the most critical data. Then expand outward from the pilot, covering more and more sensitive information. This approach will also enable minimal disruption to business processes.

Enhancing Endpoint Security and Reducing Data Leakage with Perception Point

Perception Point provides enterprise-grade security to protect email, web browsers, cloud collaboration platforms and proprietary apps from all types of cyberattacks.

Enhanced browser-level DLP capabilities deter malicious insiders, partners and contractors and include:

• Clipboard controls (preventing copy and paste);
• Printing controls;
• Configurable download/upload restrictions;
• Watermarking;
• Smart blur of sensitive web apps/data to prevent accidental external screen capture and shoulder surfing
• User activity monitoring and visibility into all installed browser extensions across the organization
• SaaS app login visibility, enabling the organization’s admins and security teams to view the usage of unsanctioned web apps

The all-included managed Incident Response service is available for all customers 24/7. Perception Point’s team of cybersecurity experts will manage incidents, provide analysis and reporting, and optimize detection on-the-fly. The service drastically minimizes the need for internal IT or SOC team resources, reducing the time required to react and mitigate web-borne attacks by up to 75%.

Customers deploying the solution will experience fewer breaches, while providing their users with a better experience as they have the freedom to browse the web, use SaaS applications that they require, and access privileged corporate data, confidently, securely, and without added latency.

Contact us for a demo of our Advanced Threat Prevention solutions, today.