Whitepaper

Building Your DLP

Strategy & Process
 Building Your DLP Strategy & Process

Contents
Introduction
3 DLP Planning: Organize Your Project for Success
3 DLP Planning: Clarify User Profiles
4 DLP Implementation: Phases of a Successful Project
5 Phase 1: Define Success & Freeze Project Scope
5 Phase 2: Identify Critical DLP User Profiles
5 Phase 3: Identify Sensitive Information & Business Requirements
5 Phase 4: Design & Manage DLP Policies
5 Phase 5: Fine-Tune Policies and Incident Management
6 Phase 6: Implement Awareness & Training Programs
6 Phase 7: Manage the Project & Track Progress

www.forcepoint.com 2
 Building Your DLP Strategy & Process

INTRODUCTION DLP PLANNING: ORGANIZE YOUR PROJECT FOR SUCCESS

Forcepoint works with its clients around the world to develop Because DLP affects so many functions within an organization,
effective strategies and processes for implementing data loss you’ll need to clarify roles and responsibilities across the
prevention (DLP) programs. Our extensive experience and technical workstreams detailed below.
expertise in this area of data security has led to our continuous
industry leadership and product innovation to stop malicious or
inadvertent data leakage. This guide provides you the key points you
Building consensus about these
need to understand as you organize your DLP project, define key workstreams at the outset will make
user profiles that affect your DLP strategy and roll out your DLP
program at every phase of deployment.
it easier for your organization to
implement and manage your DLP
As you read, keep in mind these must-dos:
strategy.
Determine goals and objectives for your DLP program up front.
Program Management — This team ensures that the work effort
As with all change initiatives, DLP programs should help achieve
achieves the goals stated by the steering committee.
strategic business objectives and provide benefits in return for the
Responsibilities include:
costs incurred. Clear and measurable goals and objectives at the
outset will ensure that the program is focused on protecting the • Set and review objectives
data that is most important to the organization.
• Oversee management of project scope and cost

Address all aspects of People, Process and Product. As

1
highlighted throughout this document, DLP revolves around the PROJECT LEADERSHIP
• Program Management
people, the processes and the technology products you use. It’s
• Steering Committee
critical to identify clear roles and responsibilities for individuals,
create effective processes to detect and respond to incidents and
configure your tools accurately to identify and prevent data loss.

2
PROJECT MANAGEMENT
Establish ample executive support and participation. Active • Quality Management
involvement from business and operating units across your • Project Management Office
organization will create more user acceptance of the transition
toward a more secure environment. It will also ensure that
business input is provided at key stages — which is paramount for

3
a successful DLP program. PROJECT TEAM
• Change Management
• Functional Workstream
Define sensitive data. Implementing DLP technology and controls • Solution Workstream
universally across an organization can have an adverse and • Infrastructure Workstream
costly impact on the business. By defining sensitive data up front
and aligning the program to protect their most sensitive data,
organizations can ensure that resources are deployed to manage Steering Committee — This committee should be headed by the
the most important risks. Chief Information Security Officer (CISO) or Chief Information
Officer (CIO) and include all important stakeholders in the project.
Responsibilities include:
Reinforce awareness for end users. In their day-to-day work, end
users are mostly confronted by the limitations imposed by DLP. • Own and oversee implementation of the project’s
Without an awareness of the reasons behind additional security underlying strategies
measures, employees will be more likely to seek work-arounds
• Define the project’s connection to the enterprise’s overall
to bypass controls. Increased awareness also helps users take
business plans and direction
responsibility for classifying and protecting critical information
and assets. • Provide and interpret policy

• Ensure participation of relevant business functions in

Formally define and monitor the effectiveness of DLP controls. the project
Once implemented, the DLP controls and their effectiveness in
• Remove internal and external barriers to achieving the
protecting your data assets should be monitored closely to drive a
project’s goals
cycle of constant improvement.
• Review progress at set intervals to ensure alignment with the
overall strategic vision

3
 Building Your DLP Strategy & Process

Quality Management — Responsibilities include: Infrastructure Workstream — This function addresses technical
deliverables relating to DLP system readiness, management,
• Assess and review project requirements and activities for
maintenance and support. They configure policies and perform
quality planning and controls
operational tasks on the DLP solution itself.
• Ensure adherence to project timelines Other responsibilities include:

• Conduct technical trainings

Project Management Office — Responsibilities include:
• Manage technical issues
• Derive and manage the project plan
• Meet with operations team
• Dynamically allocate and direct resources to ensure product
deliverables, timeline and budget • Generate reports

• Review project progress and coordinate with business • Interact with vendor support team
functions as required
• Create technical documentation
Change Management — Responsibilities include:
DLP PLANNING: CLARIFY USER PROFILES
• Control changes to the project plan
For a DLP roll-out to be effective, it needs clearly defined roles for
• Adapt and implement effective new operational changes key participants, from line-of-business personnel to technical DLP
required to make the project successful specialists to end users.

In many organizations, a single person carries out both the

Functional and Solution workstreams:
Understanding up front what the
different roles are and what each
Functional Workstream — To ensure its success, your DLP project
needs representatives from relevant business functions within the
of them does will help ensure the
organization who understand those critical business processes that success of your DLP program.
deal with sensitive data. Primary responsibilities are:
Business Function Lead
• Understand business requirements from each
This person should be knowledgeable about the critical business
business function
processes and data used within the business function that will be
• Identify and document sensitive data from each addressed by the DLP project. This individual will be involved in data
business function identification and classification and DLP policy approval. After the
project is complete, this member will continue to offer feedback on
• Develop workflows for DLP policy creation and modification,
critical business processes and the data generated from them.
and for incident management and remediation

DLP Consultant — Functional & Solution Workstreams

Solution Workstream — These project members devise effective
The person in this role will perform the functions stated under the
incident management and remediation frameworks, as well as
Functional and Solution workstreams in the prior section. Often, it
structure metrics that allow stakeholders to understand progress
is a good choice to appoint the IT, security or risk specialist already
made on the project, risks addressed by the strategy, the efficiency
responsible for the business function, as this person will need to
of incident management and so on. They should have deep technical
combine understanding of business processes with knowledge
knowledge of the DLP solution. Other responsibilities include:
of the DLP solution. They should also have basic IT knowledge
• Analyze methods to detect sensitive data types covering file directories, databases, directory paths, network
credentials and related topics, and they will benefit from quality
• Recommend best practices for data management
and security audit certifications (e.g. for ISO 27001) as well. When
• Develop DLP policies based on business requirements the project is complete, the DLP Consultant will continue to adapt
DLP policies as needed, working in concert with the DLP Product
• Identify best practices for installation, administration and
Administrator.
operation of the DLP solution

• Conduct training for business teams DLP Product Administrator — Infrastructure Workstream
This team member — usually from the IT Security organization —
must be capable of installing, administrating and supporting the
DLP solution itself, which will require them to have completed DLP
product training and to possess relevant IT knowledge. After the
project is complete, this person will continue to write new policies
and modify existing ones in the DLP product’s management console
as instructed by the DLP Consultant.

www.forcepoint.com 4
 Building Your DLP Strategy & Process

Business Function Incident Manager Phase 3: Identify Sensitive Information & Business Requirements
This member’s role is to interpret, analyze, manage and remediate Even though it relies on advanced technology, DLP is ultimately a
DLP incidents as they arise. In practice, this means reading business strategy meant to reduce risks for your organization.
reports generated by the DLP solution and determining whether a That’s why it’s so important for DLP project stakeholders to hold
non-conforming incident merits further investigation or escalation discussions with Business Function Leads and Business Function
to the Critical Incident Manager or other management. In carrying Incident Managers about which information is critical for each
out this role, the Incident Manager must be familiar with the critical business function and what the operational requirements are for
business processes of their business function, as well as have implementing DLP.
detailed knowledge of the organization’s incident management
and remediation framework. During the project, they will also
review and comment on policies, workflows and metrics and
assist with end-user training.

Critical Incident Manager

This person — likely the CISO, chief risk officer or DLP strategy
owner — must make the final decision on mitigation actions
whenever a case of data leakage occurs. They will also manage any
such incidents arising from the actions of the Business Function
Lead, and the Business Function Incident Manager and other
high-profile users. This member should have a strong background
in security or risk operations, along with solid knowledge of the
critical business processes of the organization.

End Users
During the project, the team should recruit personnel who are
interested in being pilot users to provide feedback on DLP issues
specific to each business function, and to participate in user
acceptance testing (UAT). These pilot users should use the software
applications and have the access privileges of typical end users.

DLP IMPLEMENTATION: PHASES OF A SUCCESSFUL PROJECT

You should enter into your DLP project with a commitment to using Business stakeholders should share what they already know about
best practices that align People, Process and Product to achieve the sensitive data that needs to be protected for their business
effective outcomes. As represented by the diagram, the ongoing function. To prevent scope creep, stakeholders might be asked
challenge of data loss prevention implies a multiphase cycle, to identify their top N types of sensitive information, where N is a
where the successful outcome of your current project feeds into number that fits within the agreed-upon scope for the DLP project.
the initiation of the next project — perhaps by extending the DLP When Forcepoint engages with clients on planning DLP projects,
program to other business units. This section provides you with we share sample data classification worksheets, templates
details for each phase. and questionnaires to streamline the process. Ask if your DLP
technology provider offers similar tools.
Phase 1: Define Success & Freeze Project Scope
For a DLP project to work, it needs be built on well-defined criteria Phase 4: Design & Manage DLP Policies
for success that will demonstrate value to stakeholders across the During this phase, the team reviews data highlighted from every
organization. Too many organizations make the mistake of trying business function in Phase 3, engages the DLP Consultant and
to address data security needs of the entire enterprise through a then derives policies to effectively identify that data. Your DLP
DLP project, but then struggle to demonstrate value. While DLP tool will provide various data identifiers such as patterns, regular
should indeed connect to broader security objectives — for example expressions, keywords, dictionaries, file attributes, fingerprints and
your approach to stopping insider threats — your specific DLP machine learning algorithms. Once these data identifiers have been
project should be tightly defined, with objectives that can actually reviewed, you then must decide which of the identifiers needs to
be measured and achieved. That’s how you win buy-in across the be used to identify the data accurately. Then you can configure DLP
organization, which is critical for long-term success. policies (initially in monitoring mode), capture them in a policy log
and obtain approvals from relevant stakeholders. You should also
Phase 2: Identify Critical DLP User Profiles define appropriate change management controls for raising and
For your DLP strategy to be effective, the user profiles from the approving change requests.
previous section of this paper need to be assigned to staff members
who understand their responsibilities and have the resources they
need to carry them out.

www.forcepoint.com 5
 Building Your DLP Strategy & Process

Policy Management Process Intentional Non-Malicious: Unexamined business processes can

It’s important to have a policy management process to ensure that foster intentional employee behaviors that are inadvertently risky
new policies are created and managed effectively. That process from a data loss perspective. Your DLP project will bring visibility to
should go something like this: these processes, opening the door to productive discussions with
relevant leaders about improving business processes or fine-tuning
1. End User identifies that new sensitive data has been created,
DLP policies to accommodate those that have an acceptable level
or that existing data has become sensitive.
of risk.
2. Business Function Lead confirms that a new data leakage
policy is needed and then sends the requirement for that Malicious Insider: These occur when employees try to steal
policy to the DLP Consultant. information or do harm to the organization by leaking it. These
incidents can be detected only if your DLP solution provides the
3. DLP Consultant translates the requirement into a new DLP
insight needed for profiling risky user behaviors, as Forcepoint’s
policy based on the established framework, updates the DLP
Insider Threat Data Protection solution does. It is critical that
policy log and status files and sends the updated files to the
your organization have defined processes to deal with such
DLP Product Administrator.
high-risk incidents.
4. DLP Product Administrator writes the new DLP policies into
the DLP solution’s management console. With a clear understanding of these type of leaks, your project team
should identify stakeholders with responsibility for security, risk,
The procedure for modifying an existing policy works much the compliance, legal affairs, human resources and so on who need
same, except that it’s initiated when an end user or Business to take part in incident management and remediation processes,
Function Incident Manager determines that an existing policy is then create the workflows — including escalation mechanisms —
ineffective. relevant for those functions.

Phase 5: Fine-Tune Policies and Incident Management Phase 6: Implement Awareness & Training Programs Awareness
This phase is crucial for creating an effective policy framework Your DLP solution can be used as a great tool to spread awareness
and configuring DLP policies in enforcement mode. It starts with about your organization’s data security policies, and to understand
understanding why DLP incidents occur, because not every data high-risk users who violate DLP policies because of ignorance.
leak is either intentional or malicious. Leaks fall into four main Options for raising awareness include:
types, and each is best addressed by a different strategy:
• Display pop-ups to end users when they are about to
violate policy
Accidental Leak: At least 60% incidents arise from employee
ignorance, when someone is unaware of the risks of sharing critical • Send notification emails to end users (and optionally
information. The remedy is employee education.
managers) after they have violated policy

Malicious Outsider: These arise when systems are infected with • Allow users to enter a justification message before
malware and attempt to exfiltrate data. The remediation strategy is
performing an action which may violate policy
to detect and remediate, identifying machines that are affected and
then cleaning those machines. These awareness options can significantly reduce incidents
triggered by end user negligence.

DATA LEAK SOURCE REMEDIATION STRATEGY Training

It’s very important that a proper training program is in place for
EMPLOYEE different DLP user profiles. Training should be given at regular
ACCIDENTAL
EDUCATION
intervals, with the following modules suggested for different types
of users:
MALICIOUS DETECT AND
OUTSIDER • Incident Management & Reporting Training — Targeted for
REMEDIATE
personnel that will access the reporting system to check
alerts generated by the DLP solution. This training is relevant
INTENTIONAL VISIBILITY for Business Function Leads, Business Function Incident
(NON-MALICIOUS)
Managers, Critical Incident Managers and, optionally, DLP
Product Administrators.
RISKY USER
MALICIOUS BEHAVIOR • System Admin & Maintenance Training — Targeted for the
INSIDER PROFILING IT personnel that will be responsible for maintaining the
DLP solution from a technical perspective. DLP Product
Administrators must attend this training before performing
the responsibilities of that role.

www.forcepoint.com 6
 Building Your DLP Strategy & Process

• Data Classification & Policy Training — Targeted for Monthly Reports to Senior Management
personnel that will be creating new policies and modifying
Top policy category violations
existing ones. This training is relevant for Business Function
Leads, DLP Consultants, DLP Product Administrators and, Top users and business processes that violate policies
optionally, Business Function Incident Managers.
Reports with sample incidents highlighting business risks for
• End User Training — It’s very important to keep end users each business function
aware of the processes that they must follow to make the DLP
Policy violations per channel or application (USB, email, etc.)
strategy successful for your organization. This training should
be offered through online modules at least once per quarter. Risk reduction reports, based on the number of incidents
per week
Phase 7: Manage the Project & Track Progress
To ensure that your project is successful — and that stakeholders
understand its importance for the organization — It’s critical
By grouping incidents specific to each
to use meaningful metrics that track how the DLP project is business, you can help stakeholders
being executed.
understand the relevant risks that
For instance, you want to know whether sensitive data is being the DLP solution and the overall DLP
copied to removable media such as DVDs or USB sticks. Your DLP
solution monitors that activity and protects you from it, but it also
strategy are identifying and preventing
keeps track of how often that type of activity happens — and who for them.
attempts it. Over time, you will be able to see metrics for whether
your DLP project, tied to an awareness program, is effective in It’s vital that you inform stakeholders about how the strategy
reducing that risk. reduces business risks so that they, in turn, will lead their teams to
adopt more risk-averse behavior to maintain data security.
We recommend that you use at least the following
reporting metrics: When you have achieved that, you’ll know your DLP program
is a success.
Weekly Reports to Business Function Leads and Business
Function Incident Managers

Top 10 endpoints/users violating the policy for each

business function

Top policy category violations

Policy violations per channel or application (USB, email, etc.)

Incident reports

Incident status reports

Incident trend reports

CONTACT ABOUT FORCEPOINT

www.forcepoint.com/contact © 2017 Forcepoint. Forcepoint and the FORCEPOINT logo are trademarks of Forcepoint. Raytheon is a registered trademark of Raytheon
Company. All other trademarks used in this document are the property of their respective owners.
[WHITEPAPER_BUILDING_DLP_PROCESS_ENA4] 200045.021317

www.forcepoint.com 7