--- title: Getting Your Data Leakage Protection Right description: Getting Your Data Leakage Protection Right --- [![Aujas Logo-1](https://blog.aujas.com/hs-fs/hubfs/Aujas%20Logo-1.webp?width=951&name=Aujas%20Logo-1.webp "Aujas Logo-1")](https://www.aujas.com/) - Services - [Identity and Access Management](https://www.aujas.com/robotics-iam-identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [Privileged Identity Management Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) - [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Technology Automation](https://www.aujas.com/grc-technology-automation-services) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) - [Security Verification](https://www.aujas.com/security-verification-services) - [On-Demand Security Assessment](https://www.aujas.com/on-demand-security-testing-and-services) - [Breach & Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [IoT Security Assessment](https://www.aujas.com/internet-of-things-security-assessment) - [Red Teaming](https://www.aujas.com/red-teaming-services) - [Integrated Security Assurance Program](https://www.aujas.com/isap) - [DDoS Simulation](https://www.aujas.com/ddos-attack-simulation-services) - [DevSecOps](https://www.aujas.com/devsecops) - [API Security](https://www.aujas.com/api-security) - [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Software Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) - [Registered Device Management Platform](https://www.aujas.com/registered-device-management-platform) - [Managed Detection and Response](https://www.aujas.com/managed-detection-and-response-services) - [Offensive Security Services](https://www.aujas.com/offensive-security-services) - [OT Security Services](https://www.aujas.com/ot-security-services) - [Microsoft Sentinel](https://www.aujas.com/sentinel) - [Threat Management](https://www.aujas.com/threat-management-service) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) - [Cloud Security](https://www.aujas.com/cloud-computing-security-services) - [AWS Cloud Security Services](https://www.aujas.com/aws-cloud-security-services) - [Cloud Security Foundation](https://www.aujas.com/cloud-security-foundation) - [Cloud Risk Management](https://www.aujas.com/cloud-risk-management) - [Cloud Security Engineering](https://www.aujas.com/cloud-security-engineering) - Products - [PALM](https://www.aujas.com/platform-for-access-lifecycle-management) - [Saksham](https://saksham.aujas.com) - [CodeSign](https://codesign.aujas.com) - [Aadhaar Registered Device Manager](https://www.aujas.com/registered-device-management-platform) - Company - [About us](https://www.aujas.com/about-us) - [Investor Relations](https://www.aujas.com/investor-relations) - [Team](https://www.aujas.com/team) - [Partnership](https://www.aujas.com/partnership) - [Contact us](https://www.aujas.com/contact-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Studies](https://www.aujas.com/case-study) - [Contact Sales](https://www.aujas.com/contact-us) - ![](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png) ![blue-search](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png "blue-search") ![Aujas Cybersecurity Logo 2024](https://blog.aujas.com/hubfs/Aujas%20Cybersecurity%20Logo%202024.webp "Aujas Cybersecurity Logo 2024") - Services - [Identity and Access Management](https://www.aujas.com/robotics-iam-identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [Privileged Identity Management Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) - [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Technology Automation](https://www.aujas.com/grc-technology-automation-services) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) - [Security Verification](https://www.aujas.com/security-verification-services) - [On-Demand Security Assessment](https://www.aujas.com/on-demand-security-testing-and-services) - [Breach & Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [IoT Security Assessment](https://www.aujas.com/internet-of-things-security-assessment) - [Red Teaming](https://www.aujas.com/red-teaming-services) - [Integrated Security Assurance Program](https://www.aujas.com/isap) - [DDoS Simulation](https://www.aujas.com/ddos-attack-simulation-services) - [DevSecOps](https://www.aujas.com/devsecops) - [API Security](https://www.aujas.com/api-security) - [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Software Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) - [Registered Device Management Platform](https://www.aujas.com/registered-device-management-platform) - [Managed Detection and Response](https://www.aujas.com/managed-detection-and-response-services) - [Offensive Security Services](https://www.aujas.com/offensive-security-services) - [OT Security Services](https://www.aujas.com/ot-security-services) - [Microsoft Sentinel](https://www.aujas.com/sentinel) - [Threat Management](https://www.aujas.com/threat-management-service) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) - [Cloud Security](https://www.aujas.com/cloud-computing-security-services) - [AWS Cloud Security Services](https://www.aujas.com/aws-cloud-security-services) - [Cloud Security Foundation](https://www.aujas.com/cloud-security-foundation) - [Cloud Risk Management](https://www.aujas.com/cloud-risk-management) - [Cloud Security Engineering](https://www.aujas.com/cloud-security-engineering) - Products - [PALM](https://www.aujas.com/platform-for-access-lifecycle-management) - [Saksham](https://saksham.aujas.com) - [CodeSign](https://codesign.aujas.com) - [Aadhaar Registered Device Manager](https://www.aujas.com/registered-device-management-platform) - Company - [About us](https://www.aujas.com/about-us) - [Investor Relations](https://www.aujas.com/investor-relations) - [Team](https://www.aujas.com/team) - [Partnership](https://www.aujas.com/partnership) - [Contact us](https://www.aujas.com/contact-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Studies](https://www.aujas.com/case-study) - [Contact Sales](https://www.aujas.com/contact-us) - ![](https://blog.aujas.com/hubfs/Aujas%202020/blue-search.png) ![](https://blog.aujas.com/hubfs/Aujas%202020/close.png)     # Getting Your Data Leakage Protection Right - ![Tom](https://app.hubspot.com/settings/avatar/4f94ecdc8fee2d514a857e67586d01ae)[Tom](https://blog.aujas.com/author/tom) - May 31, 2012 - [Data Protection](https://blog.aujas.com/topic/data-protection-2) SHARE *Author: Chandra Prakash, Practice Head, Information Risk Advisory Services* I have been doing consulting around [data protection](https://www.aujas.com/data-protection.aspx) services for quite some time now and have noticed three common mistakes CISOs make while choosing/implementing DLP solutions: 1. They feel data classification is necessary, 2. DLP Technology will solve their leakage problems and they will be able to identify sensitive data across the enterprise using storage DLP and protect at network and end point 3. They are confused as every vendor comes and tells them about their “great” product and 1-2 issues with other products Let me put my thoughts across on this subject and an approach to DLP. First data classification and data labeling shall not be confused, while data classification is good to start to know what is critical so that it can be adequately protected, but it is not absolutely necessary. Data labeling is a tough task and changing the entire enterprise culture to help them identify, label and maintain them either using processes or some auto-classification enforcement tool is a tough task. CISOs think by labeling, DLP will read them and baseline them so that appropriate rules can then be added but truth is that the amount of data movement which is secret and confidential is a lot more to analyze and hence can’t be generalized and converted to rule base. One has to know the authorized movement of data in all of their business processes. It means, if payroll information goes to finance from HR on 15th of every month on emails and then from finance manager to third party for processing, a simple rule asking payroll from HR to finance (person specific) and then from finance to third party shall be allowed for specific time and only through SMTP. Rest all other payroll traffic shall not be permitted is the right approach. Now to further reduce the risk, one can always classify the payroll as secret and use encryption technology integrated with DLP for encryption or rights protection. But, that is entirely different topic to reduce all data leakage risks. Second issue of thinking that technology will solve the problem is a myth. You need a DLP solution and a solution is technology + processes. First, setup the governance for data protection - Classification policy, exception approval and incident management. This shall be followed by creating the processes to get confidential data from businesses processes and manage them regularly. You will need their inputs to verify data movement, its importance, clarification for data movement inside and outside the enterprise etc. This shall be followed by incident management process to identify, report, escalate and close the data leakage incidents. You cannot take a call from IT/ security perspective for business data leakage. It has to be decided by business owners. From the perspective of product vendors, one should identify its own business requirement and objective of implementing DLP and then map product features with its business requirements. Further, create use cases and ask vendors to demonstrate its usability. For example – if the objective is to protect regulated data (card information, PII, SSN etc.) then it is relatively simple and focus on the DLP tool which is easy to manage, has patterns to identify regulated data and can generate detailed compliance specific reports. If you wish to monitor structured data, focus on feature that can find exact matches, has better accuracy and performance and so on and so forth. First, there is hue-and-cry for data classification as a first step for data protection and I am not a big fan of this because of two reasons- 1. Leaving data classification in the hands of end users is difficult and they tend to confuse, over classify data 2. It is impossible to classify and label terabytes of data in structured and unstructured data. What is more effective is data flow analysis, meaning for all the business processes like payroll, billing etc. identify what data the process owner gets, from where, in which format, then what processing is done, in which format and which channel and finally what output is generated, where it is stored and transferred in which form. Based on the input of data, processing of data and output of data, one should ascertain data ownership and its authorized movement. This will clearly indicate the authorized movement of data. Allow data to move to authorized people via authorized channel through this process only and block everything else. This process has a challenge of accurately identifying as not everything can be patterned or protected with keywords, further there is a challenge of data dynamics, i.e. changing over a period. Remember that Data classification is a mean and not an end, and it should not be considered as one off activity. It is a challenging task to classify terabytes of data and its copies for DLP to recognize. Anyway, a better way is to address the challenge is - mass classification for unstructured data. For structured data, create those data sets, which move out in some form like customer transaction statement on a monthly basis in bank, then create pattern for them and protect it accordingly. I believe the right steps are - 1. Garnering executive support – so that business owner gives time to get the data identified in its business processes 2. Establish governance – Identify data owners, define clear roles and responsibilities for business, IT, compliance, information security departments and regulators, governance for ongoing data leakage incident management 3. Perform data flow analysis – Identify flow of information in business processes, its sensitivity, its users, form and medium and perform information classification, ownership establishment and risk analysis 4. Perform technology controls/ implementation like DLP/ DRM/ encryption etc. 5. Sustenance framework – Incident management, improvement, reporting, rule base fine tuning 6. If these steps are executed correctly, data protection will become much easier. Lastly again touching base on data classification – my view is that data should just be divided into three forms - regulated data, which you need to monitor, protect and report to regulators, business sensitive data- which matters the most and routine transaction data- an output of general business processes. In this way, protection is sure for first two, reporting for first and monitoring for all. More reading: - [Effective Data Protection Requires More than Technology](http://blog.aujasnetworks.com/more-effective-data-protection.html) - [Data Governance – What We Need to Think About](http://blog.aujasnetworks.com/data-governance.html) - [Data Protection and Controls – Does Format Really Matter?](http://blog.aujasnetworks.com/data-protection-controls.html) ![Footer-Logo](https://blog.aujas.com/hubfs/Aujas%202019/Footer/Footer-Logo.png "Footer-Logo") ## Reach Us [+1 201 389 9011](tel:+1%20201%20389%209011) ## Write To Us **Sales:** [contact@aujas.com](mailto:contact@aujas.com) **Jobs:** [careers@aujas.com](mailto:careers@aujas.com) **HR Queries:** [HRopsteam@aujas.com](mailto:hropsteam@aujas.com)   - [1](https://www.linkedin.com/company/aujas-cybersecurity) - [2](https://twitter.com/AujasIRM) - [3](https://www.facebook.com/AujasCybersec/?ref=py_c) - [4](https://www.youtube.com/@AujasCybersecurity) ## [Identity and Access Management](https://www.aujas.com/identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [PIM Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) ## [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Automation](https://www.aujas.com/grc-technology-automation-service) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management-old) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) ## Company - [About us](https://www.aujas.com/about-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - [Contact us](https://www.aujas.com/contact-us) ## Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Study](https://www.aujas.com/case-study) ## [Security Verification](https://www.aujas.com/security-verification-services) - [Threat Simulation](https://www.aujas.com/threat-simulations) - [loT Security](https://www.aujas.com/internet-of-things-security-assessment) - [Penetration Testing](https://www.aujas.com/crest-certified-penetration-testing-services) ## [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [CodeSign Platform](https://codesign.aujas.com/) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) ## [Managed Detection and Response](https://www.aujas.com/managed-threat-detection-and-response-services) - [Threat Management](https://www.aujas.com/threat-management) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [Automated & Continous Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) ## [Identity and Access Management](https://www.aujas.com/identity-access-management-services) - [Identity Governance Fast Track](https://www.aujas.com/iam-identity-governance-fast-track) - [PIM Fast Track](https://www.aujas.com/privileged-identity-management) - [Cloud Single Sign-on Fast Track](https://www.aujas.com/cloud-sso) - [Robotics Driven IAM](https://www.aujas.com/robotics-iam-services) - [Risk Aware IAM](https://www.aujas.com/risk-aware-iam) - [Consumer IAM](https://www.aujas.com/consumer-identity-and-access-management) ## [Cybersecurity Advisory Services](https://www.aujas.com/cybersecurity-advisory-services) - [Cyber Risk Management](https://www.aujas.com/cyber-risk-management-services) - [Integrated Compliance Management](https://www.aujas.com/cybersecurity-compliance-services) - [GRC Automation](https://www.aujas.com/grc-technology-automation-service) - [Third Party Risk Management](https://www.aujas.com/third-party-risk-management-old) - [Privacy and Data Protection](https://www.aujas.com/data-privacy-data-protection-services) ## [Security Verification](https://www.aujas.com/security-verification-services) - [Threat Simulation](https://www.aujas.com/threat-simulations) - [loT Security](https://www.aujas.com/internet-of-things-security-assessment) - [Penetration Testing](https://www.aujas.com/crest-certified-penetration-testing-services) ## [Security Engineering](https://www.aujas.com/security-engineering-services) - [Secure Development](https://www.aujas.com/secure-software-development) - [Ecosystem Engineering](https://www.aujas.com/ecosystem-engineering) - [CodeSign Platform](https://codesign.aujas.com/) - [Custom Security Development](https://www.aujas.com/custom-security-solution-development) ## [Managed Threat Detection and Response](https://www.aujas.com/managed-threat-detection-and-response-services) - [Threat Management](https://www.aujas.com/threat-management) - [SIEM & Security Monitoring](https://www.aujas.com/siem-security-monitoring) - [Automated & Continous Attack Simulation](https://www.aujas.com/automated-continuous-attack-simulation) - [SecOps Orchestration](https://www.aujas.com/security-orchestration-automation-and-response) - [Google SecOps](https://www.aujas.com/googlesecops) ## Company - [About us](https://www.aujas.com/about-us) - [Careers](https://www.aujas.com/cybersecurity-careers) - [Contact us](https://www.aujas.com/contact-us) ## Resources - [Blog](https://blog.aujas.com) - [Collaterals](https://www.aujas.com/collaterals) - [Case Study](https://www.aujas.com/case-study) Copyrights © 2025 All Rights Reserved by Aujas. - [Terms of Use](https://www.aujas.com/terms-of-service) - [Privacy Policy](https://www.aujas.com/privacy-policy) - [Cookie Policy](https://www.aujas.com/cookie-policy) ![](https://px.ads.linkedin.com/collect/?pid=656027&fmt=gif) ![websights](https://ws.zoominfo.com/pixel/62839c658f43f50012ae3b9a)