Enterprise Governance Risk & Compliance

Risk

Impact

Mitigation Strategy

Improperly tuned network DLP modules

• Disruption of business processes
• Lost time and revenue
• Damage to customer or business partner relationships
• Loss of business stakeholder support

Proper tuning and testing of the DLP system should occur before enabling actual blocking of content. Enabling the system in monitor-only mode will allow for tuning and provide the opportunity to alert users to out-of-compliance processes and activities so they may make adjustments accordingly. Involving the appropriate business and IT stakeholders in the planning and monitoring stages will help ensure that disruptions to processes will be anticipated and mitigated. Finally, establish some means of accessibility in the event there is critical content being blocked during off-hours when the team managing the DLP solution is not available.

Improperly sized network DLP module

• Missed or dropped network packets allowing data to pass uninspected

Ensuring that the size of the DLP module is appropriate for the amount of network traffic is a critical design consideration. However, it is just as important to monitor the DLP network modules to ensure that network traffic does not increase over time to a point that renders the module ineffective.

Excessive reporting and false positives

• Wasted staff time
• Missing valid threats
• Tendency to ignore logs over time

Similar to an improperly configured intrusion detection system (IDS), DLP solutions may register significant amounts of false positives, which overwhelm staff and can obscure valid hits. Avoid excessive use of template patterns or “black box” solutions that allow for a little customization. The greatest feature of a DLP solution is the ability to customize rules or templates to specific organizational data patterns. It is also important that the system be rolled out in phases, focusing on the highest risk areas first. Trying to monitor too many data patterns or enabling too many detection points early on can quickly overwhelm resources.

Conflicts with software or system performance

• System downtime
• Performance degradation
• Breaking of DLP or other controls or processes

DLP systems, particularly crawlers and end-point agents, can conflict with other system software and performance. Allowances must be made for ample planning and testing before deployment. Ideally, a permanent testing and staging environment should be available. Check with the vendor for known conflicts. Ensure that crawlers are properly configured and tuned and that their operation is scheduled in such a way as to avoid peak system processing windows. When avoidable, end-point scans should not be scheduled for peak work hours or when systems are remotely connected. Also, ensure that all patches and upgrades are tested within the test environment prior to deployment to production.

Changes in processes or IT infrastructure rendering DLP controls ineffective

• Reduction of DLP effectiveness due to circumvention of DLP controls

The DLP system administrator or a representative should be involved in change control processes to ensure that changes made do not circumvent or otherwise degrade DLP capabilities. In addition, the enterprise should be well prepared for changes associated with DLP to reduce the risk of intentional bypassing of the DLP system in the name of efficiency.

Improperly placed DLP network modules

• Missed or uninspected data streams

It is important to ensure the proper placement of DLP network modules. Ensure that accurate network maps are available and that the modules are placed at the outermost egress point for data flows the enterprise wishes to monitor. 

Undetected failure of DLP modules

• Data not inspected due to partial or complete module failure

DLP modules can fail, but do not always report their state to the console. It is important to periodically test to ensure that modules and their associated filters are performing as expected. 

Improperly configured or incomplete directory services

• Inability to trace violations to the appropriate end-users

The directory service is the key connection between a network address and an actual user, and most enterprises will want to have this process in place as opposed to manual discovery of this information, which can be time-consuming and is not always possible. Enterprises that lack or have incomplete directory services should consider addressing this gap prior to implementing a DLP solution.