10 Data Leak Prevention Tips for Law Firms
Last updated on April 15th, 2020
Data leak prevention (DLP) is a subject that comes up again and again. “How do I stop data leaks from occurring?” and “How do I know if a data leak has happened?” are two questions that legal firms want answers to.
The premise of DLP is to stop intellectual property, client details or other sensitive data from passing into the unprotected Internet. Something that sounds easy, but isn’t. Leaks can happen via email, internet browsing or a breached cloud platform.
You may realise that those are three of the biggest things your firm uses every day and that’s where the difficulty comes in. Setting up a full DLP system is usually difficult and takes a lot of time, technologies and planning. But before you can even start to make a plan you need to understand the fundamentals.
What are the types of data leak?
- In transit
- Being intercepted whilst travelling over the wire, i.e. email, web chat, web traffic, etc.
- At rest
- From areas such as a file share, a database or from a desktop or laptop.
- In use
- From screen captures, clipboard, a printer, USB disk, CD, etc.
Your firm should break down each of these areas, understanding when data is in each vector and how it could leak via the vector. Once you understand what you have and what risks you face on each classification you can start to think about controls and policies. For instance:
- What is your policy on staff plugging in USB sticks?
- What controls will you have to stop sensitive details lying in the printer?
- What is your policy on sharing information via social media?
The controls will vary significantly by but here are 10 areas to consider when contemplating how to keep your sensitive data secure from an accidental or malicious leak.
How can you make data secure?
1. Portable encryption
You should encrypt any sensitive data which leaves the secure confines of your firm’s network. You’ll need software systems to control this as you cannot typically rely on employees to do it. It only takes a lost USB disk, laptop or phone to deliver a severe or critical blow to a firm.
2. Endpoint protection
The data endpoint is typically a computing device, i.e. desktop, laptop, mobile, server, etc. It’s on these devices that IP and confidential data resides or passes through. DLP endpoint protection solutions can protect data inside and outside of the network by controlling functions, such as print, copy, and data transfer to USB devices or a cloud storage platform, such as DropBox.
3. Email content control
Email is a common source of a data leak, as employees use it to send confidential information and documents. Content filtering uses deep content inspection technology to scan the text, images, and attachments of an email, to flag up any potential threats and can alert you if a user tries to send sensitive information.
4. Intelligent firewalls
Data leakage often arises from email, IM or internet use. Firewalls can protect individual computers and whole networks from security threats and can take automatic action against potential data leaks, unauthorised access or malicious behaviour, either by notifying the administrator or by blocking the action.
5. Device control
Endpoint solutions allow administrators to control what devices are in use. They can also see when they have been used, who by and what information was copied, managing the threat of portable storage devices. You should also have effective security policies for your devices, as users typically store email and other sensitive documents on their smartphones and tablets. For example, some required could include the use of complex passwords or to set devices to automatically lock when not in use.
6. Evaluating security permissions
Many users may have access to sensitive data, but do they really need it? Allowing access on a “need-to-know” basis can dramatically reduce your chances of a data leak, accidental or otherwise.
7. Controlling print
Multi-Function printers (MFP) are typically unmonitored and can have a high level of data leak potential. Requiring users to ‘sign in’ before use can reduce this, as they will only have access to certain functions and documents. It also prevents users from leaving sensitive information on the printer, as the document only prints once the correct user has signed in at the MFP.
8. Securing back-ups
Many firms rightly have back-ups of their most important information, but these can be vulnerable too, either from an attack or due to loss. Just like the original data you should encrypt these files, which is a function of most backup software.
9. Image text analysis
Images can be sensitive data in themselves, plus camera-enabled devices like smartphones make it very easy to capture sensitive data. DLP solutions have the ability to analyse text within images, preventing data exposure.
Businesses often assume employees know what information is confidential and what they cannot share. Yet, sometimes a data leak is accidental and can be something as simple as an email to the wrong client. A good security policy is well-defined and easy to understand. Helping users perform important functions with reduced risk and increasing the adoption rate of the policy.
Direct routing turns Teams into a full unified communications solution
Many Telecom providers have now launched direct routing for Microsoft Teams, allowing users to make and receive calls external to their organisation through the platform. Users can now use the normal Teams application whilst remote or on the move without the need for third-party softphones. Microsoft recorded a huge spike in active Teams users since the lockdown was announced, as businesses look for […]
The realities of remote working
Remote working has been around since communications have been available to the roaming and remote worker, in general terms. It’s been pushed and pulled by small, medium and large-sized enterprises. It’s been claimed as the future of working and also criticised as the destroyer of efficiency and culture. But there’s one important question that has […]
13 tips for picking the right IT support provider
So your company has decided it wants to outsource some, or all, of its IT function. You may have noticed that there a great deal of IT support companies out there, but finding the right one for your business can be complicated. Putting a business-critical function, such as IT, in the hands of a third […]