Information is an entity that, like everything else in nature, has its own life cycle. It is created or acquired, transferred, used, stored and finally disposed of. During the whole period of its existence, unwanted transfers, copies or deletions can occur, intentionally or by chance. For this reason, today we talk about information leaks and how to prevent them.
At the moment data is stored or published, in any of the myriad of current technological mechanisms for disseminating information, without proper screening for sensitive or confidential information they may contain, and without subsequent authorisation by staff responsible for the information, In this case, it must be declared as a loss of data, and in this case, sensitive data.
Examples would include storing sensitive information on personal equipment that is not protected by a DLP; Whether on internal, external or cloud storage drives, sending by mail, publishing on web servers and social networks or sharing via insecure mechanisms.
DLP's role in complying with GDPR
GDPR, The European Union's data protection regulation, which became mandatory on 25 May, has been one of the driving forces behind the increased adoption of DLP solutions.
One of the principles to which legislation obliges is the protection of personal data, preventing them from being lost or leaked, whether they are in use, in motion or at rest. With this in mind, it is clear that the market of Data Loss Prevention is at the forefront of helping companies comply with GDPR in a number of ways.
First of all, DLP helps to know where personal data is stored, which is one of the requirements of GDPR. Most DLP solutions offer discovery services that allow identifying the information and its location, which is very useful in case of a request from the data protection agency or if a consumer wants to make use of the famous Right to be Forgotten.
GDPR also requires that personal data collected is deleted when the purpose of such collection has ended. With the services mentioned in the previous point, administrators will be able to remotely delete personal data. So, generically, administrators can control what personal data remains on the company's networks and devices.
The regulation also requires that it must be ensured that personal data is not used for any other purpose outside of the services for which it was designed. DLP solutions can help meet this requirement by monitoring data in use, enforcing policies that restrict or block its transfer outside or within the organisation. As a result, users will no longer be able to upload, copy, paste or print personal data.
The GDPR introduced the concept of security by design and makes companies legally responsible for any loss or unauthorised use of the personal information they collect. DLP solutions were built to prevent such incidents.
Data Loss Prevention (DLP) applications
These are systems designed to monitor, detect and block sensitive information when it is in any of the following three states:
- NetworkedInformation that is being transported through the network (is in motion).
- In useInformation with which the user is interacting.
- At restOld“ information, which is permanently stored.
In this sense, MetaClean Monitor File Systems in such a way that it detects in real time when a file is created or modified, analyses the content and metadata of these files and, based on certain policies configured by the administrator, will allow or block the transfer of this file through the different media:
- EmailMetaClean for Outlook is a component for the Microsoft Outlook email client that analyses the content of attached files before they are sent. If any of these files do not comply with the established security policies, the sending of the file will be blocked and the system administrator will be informed of the incident.
- Storage on internal, external or cloud drivesMetaClean Sync monitors all storage drives and detects in real time when a file is created or modified, thus ensuring that when a file is transferred to another medium, it will be analysed and blocked in case of non-compliance with security policies, informing the system administrator of this event.
MetaClean Sync also allows you to include custom metadata. automatically on all files that have been created or modified on the Monitored Disk Drives so that these files are perfectly labelled, and this information can be used by other DLP Systems or Document Management Systems.
