Netskope named a Leader in the 2022 Gartner® Magic Quadrant™ for Security Service Edge. Get the Report.

  • Platform

    Unrivaled visibility and real-time data and threat protection on the world's largest security private cloud.

  • Products

    Netskope products are built on the Netskope Security Cloud.

Netskope delivers a modern cloud security stack, with unified capabilities for data and threat protection, plus secure private access.

Explore our platform

Netskope Named a Leader in the 2022 Gartner Magic Quadrant™ for SSE Report

Get the report

Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn more

Prevent threats that often evade other security solutions using a single-pass SSE framework.

Learn more

Zero trust solutions for SSE and SASE deployments

Learn more

Netskope enables a safe, cloud-smart, and fast journey to adopt cloud services, apps, and public cloud infrastructure.

Learn more
  • Customer Success

    Secure your digital transformation journey and make the most of your cloud, web, and private applications.

  • Customer Support

    Proactive support and engagement to optimize your Netskope environment and accelerate your success.

Trust Netskope to help you address evolving threats, new risks, technology shifts, organizational and network changes, and new regulatory requirements.

Learn more

We have qualified engineers worldwide, with diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ready to give you timely, high-quality technical assistance.

Learn more
  • Resources

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog

    Learn how Netskope enables security and networking transformation through security service edge (SSE).

  • Events & Workshops

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

Bonus Episode: The Importance of Security Service Edge (SSE)

Play the podcast

Read the latest on how Netskope can enable the Zero Trust and SASE journey through security service edge (SSE) capabilities.

Read the blog

Netskope at RSA 2022

Meet and speak with Netskope security specialists at RSA.

Learn more

What is Security Service Edge?

Explore the security side of SASE, the future of network and protection in the cloud.

Learn more
  • Company

    We help you stay ahead of cloud, data, and network security challenges.

  • Why Netskope

    Cloud transformation and work from anywhere have changed how security needs to work.

  • Leadership

    Our leadership team is fiercely committed to doing everything it takes to make our customers successful.

  • Partners

    We partner with security leaders to help you secure your journey to the cloud.

Netskope enables the future of work.

Find out more

Netskope is redefining cloud, data, and network security to help organizations apply Zero Trust principles to protect data.

Learn more

Thinkers, builders, dreamers, innovators. Together, we deliver cutting-edge cloud security solutions to help our customers protect their data and people.

Meet our team

Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn more
Security Defined Cybersecurity Encyclopedia What is DLP? Data Loss Prevention

Data Loss Prevention (DLP)

7 min read

What is Data Loss Prevention (DLP)?

The definition of Data Loss Prevention encompasses a set of practices and tools meant to prevent data leakage (also known as data exfiltration) by intentional and unintentional misuse. These practices and tools include encryption, detection, preventative measures, educational pop ups (for unintentional movements), and even machine learning to assess user risk scores. Over time, DLP has evolved into the realm of data protection and has become a premier feature of data protection deployment.

For the sake of simplicity, we’re going to use the acronym “DLP” throughout this guide to refer to all of these measures, unless stated otherwise.

dlp meaning

 

The Need for Data Loss Prevention

Losing data is bad for business. It erodes confidence in your brand and can result in financial losses from lawsuits, regulatory non-compliance fines, and exposure of intellectual property. Let’s dig a little deeper into the requirements that drive the need for DLP.

 

1. Compliance with industry and government regulations

Many industries, including healthcare, government contractors, and financial institutions are required by law to safeguard sensitive personal data. These regulations include:

  • HIPAA (Health Insurance Portability and Accountability Act)
  • GDPR (General Data Protection Regulation)
  • PCI DSS (Payment Card Information Data Security Standard)
  • CCPA (California Consumer Privacy Act)
  • PIPEDA (Personal Information Protection and Electronic Documents Act)

Common to all the regulations is the stipulation that sensitive data must be kept in a secure location and isolated from unauthorized users. Companies must have DLP strategies and tools in place, which prevent unintentional or malicious access to, and exfiltration from, the isolated data store.

 

2. Protecting proprietary information

Proprietary information refers to any confidential data or knowledge about the organization and its business structure and operations, or about its clients, customers, partners, or affiliates. Examples of proprietary information include:

  • Internal project plans
  • Proprietary code
  • Patent information
  • Email communications
  • Business documents
  • Internal processes

While some hackers steal information from organizations and government agencies just to see if they can, most do it for the financial benefit of selling or exposing that information. Today, many ransomware attackers not only encrypt the victim’s data and demand money for unlocking it, but also exfiltrate some of the data and demand payment for not releasing it to the public.

Data loss prevention software and strategies help keep your intellectual property safe, not only from outside attacks and exfiltration, but also from unintentional data leaks caused by your own employees. The careless sharing of confidential data and information over unsecured media and public cloud accounts can cause just as much damage as malicious acts of information espionage.


White Paper: Evaluating Data Loss Impact


 

How Does Data Loss Prevention Work?

There are several methods of DLP security, which are implemented through best practices and software tools. The best data loss prevention strategies include a variety of approaches to cover all of the potential breach vectors.

 

The 5 types of data loss prevention

 

1. Data Identification: This is the process by which organizations identify sensitive information within their digital environment, whether it resides within emails, cloud storage applications, collaboration applications, or elsewhere.

2. Data Leak Identification: This is an automated process for detecting and identifying misappropriated data, whether it was exfiltrated or misplaced within an organization’s infrastructure.

3. Data-in-Motion DLP: When data is in transit between locations, DLP network security employs a variety of security measures to ensure that the data arrives untouched at its destination.

4. Data-at-Rest DLP: This type of protection covers data that is not currently in transit and is typically stored in some kind of database or file sharing system. It utilizes several methods to ensure safe storage of data locally and in the cloud, from endpoint protection to encryption to prevent any unauthorized use of data.

5. Data-in-Use DLP: Data that is currently in use by those within an organization must be protected from any type of potentially harmful interaction with the data, such as altering, screen-capturing, cut/copy/paste, printing, or moving information. In this context, DLP is meant to prevent any unauthorized interactions or movements of data, as well as take note of any suspicious patterns.


White Paper: Protecting Data Using Machine Learning
Datasheet: Top Questions to Ask Your Cloud DLP Vendor


 

Data Loss Prevention Best Practices

1. Educate your employees

One of the most effective best practices for preventing data loss starts with training your employees everything they should and shouldn’t do when handling your organization’s precious data. Employee DLP education should include safe practices for transferring, viewing, and storing data. For maximum effect, training should be sponsored at the executive level and should be repeated at regular intervals to reinforce and update best-practice behavior.

 

2. Establish data handling policies

A key component of DLP best practices, data handling policies include:

  • Where data can be stored
  • How data is to be transferred
  • Who can view certain types of data
  • What types of data you are allowed to store
  • And many others

Since these policies drive all other data handling behaviors and assessments, they should be established at your earliest opportunity. They should also be updated regularly to reflect changes in the organization, the industry, and in regulations. Once data handling policies are in place, you can move onto more technical remedies and best practices to ensure your data remains where it ought to be.

 

3. Create a data classification system

The key to creating data loss prevention policies is to start with a data classification system. This taxonomy will provide a reference for talking about the stringency and methods of protection needed for different types of data. Common classifications include personally identifiable information (PII), financial information, public data, and intellectual property. There are many others. A unique set of protection protocols can be established for each classification.

 

4. Monitor sensitive data

Successful data protection requires the ability to monitor your sensitive data. Data loss prevention software typically includes capabilities for monitoring all aspects of data use and storage, including:

  • User access
  • Device access
  • Application access
  • Threat types
  • Geographical locations
  • Access times
  • Data context

As part of the monitoring process, DLP software sends alerts to relevant personnel when data is used, moved, deleted, or altered in an unauthorized manner.

 

5. Implement a DLP software that accommodates shadow IT

It can be complicated enough to protect the data used by your known inventory of applications. But you also need to account for data accessed by shadow IT. This is the growing trove of software-as-a-service (SaaS) applications that employees subscribe to independently, without approval from the IT department—and often without its knowledge.

Even if employees are thoroughly trained in DLP best practices, it is hard for them to accurately assess the safety of these cloud-based applications. Under most SaaS models, the SaaS provider is responsible for the applications themselves, but users are responsible for the data that the application uses. Users, who are focused on achieving business objectives, are not in a position to protect data from attacks that may come through a compromised SaaS application. It is up to you to hold the line on data leakage and misuse. That’s why you need a DLP software solution that is able to recognize shadow IT and prevent users from accessing data or moving data to these applications, until you can bring them out of the shadows and into the fold of secure IT operations.

 

6. Set up different levels of authorization and access

This best practice goes hand-in-hand with data classification, as the combination of these two will allow you to grant access to data only to those who have clearance to that information. Your DLP software should also incorporate certain zero trust data protection policies that don’t inherently grant trust to any users while consistently verifying identities and clearance.

 

7. Adopt companion tools of DLP

DLP doesn’t live in a vacuum. The entire concept of DLP relies on an ecosystem of tools that work together to provide insights, plans of action, and active protections of your data. These tools include secure web gateways, cloud access security brokers, email security, and zero trust infrastructures.


Demo Video: Advanced Cloud DLP in Action
Datasheet: Netskope Data Loss Prevention


 

What is endpoint DLP?

Endpoint DLP is a form of endpoint security that takes all of the principal features of data loss prevention and applies them to all endpoints that have access to networks, cloud infrastructure, and sensitive data. But before we take a deep dive into this concept, what is an endpoint?

An endpoint is any physical device that is able to send, receive, and interpret data from a network, including:

  • Laptops
  • Smartphones
  • Servers
  • Tablets
  • Internet of Things (IoT) devices

Endpoint data loss prevention is made to protect data that is accessed by any and all of these endpoint devices.

How does endpoint DLP work?

Endpoint DLP solutions protect data by providing visibility and protection capabilities on devices. By monitoring data-at-rest, data-in-motion, and data-in-use, endpoint DLP is able to intervene when certain behaviors violate policies set by security administrators, such as:

  • Unauthorized movement of protected data
  • Exfiltration of protected data
  • Deletion of protected data

Once the endpoint DLP agent detects and responds to the violation, administrators are notified and the incident is analyzed for the sake of future mitigation efforts. This continuous monitoring and behavior analysis also allows for contextualized intervention so as not to impede legitimate work functions.

Resources

Netskope Data Loss Prevention (DLP)

Netskope Data Loss Prevention (DLP)

Demo-Email DLP

Demo - Email DLP

Evaluating Data Loss Impact

Evaluating Data Loss Impact

Top Questions to Ask Your Cloud DLP Vendor

Top Questions to Ask Your Cloud DLP Vendor

Adoption Guide for SASE

Adoption Guide for SASE

Demo - Stop sensitive data exposure in the cloud

Demo - Stop sensitive data exposure in the cloud

Protecting Data Using Machine Learning

Protecting Data Using Machine Learning

Top 6 Questions To Ask Your Cloud DLP Vendor - Microsoft 365 Edition

Top 6 Questions to Ask Your Cloud DLP Vendor

Subscribe to the
Threat Labs Report

Get the monthly Threat Lab Report as soon as it’s released.