Translated from 日本語 • View original 
In recent years, many information breach incidents have been caused not only by external attacks, but also by internal factors.
Mistakenly sending emails, inadvertent uploads to cloud storage, and taking out USB sticks are often an extension of daily work.
An effective countermeasure against these risks is DLP (Data Loss Prevention).
In this article, we will summarize everything from the basics of DLP to the key points of implementation and operation for internal security personnel.
What is DLP?
DLP is a mechanism to prevent sensitive and important data from being unintentionally leaked to the outside world.
Specifically, it covers the following information:
- Personal information (name, address, My Number, credit card number, etc.)
- Confidential documents (design materials, contracts, sales information)
- Internal limited information (personnel information, financial data)
DLP uses these data to
Identification→ Monitoring→ and Control
This reduces the risk of leakage.
Why is DLP Important?
1. Internal fraud and negligence cannot be reduced to zero
No matter how much education is given, it is difficult to completely prevent human error and rule deviations.
DLP acts as the "last bulwark" that does not depend on human attention.
2. Navigating the Cloud and Remote Work Era
With the proliferation of Microsoft 365 and SaaS, data is expanding beyond the internal network.
DLP is important because it can be controlled across email cloud endpoints.
3. Compliance Response
As a response to personal information protection laws and industry guidelines, DLP
It is the core of technical measures.
Key Features of DLP
Data Identification
- Regular expressions (e.g., credit card number format)
- Keywords and dictionaries
- File attributes (labels, metadata)
Monitoring and Detection
- Attachment inspection when sending emails
- Upload monitoring to cloud storage
- USB copy, local save, print detection
Control and Response
- Send block/warning to users
- Alert notifications to administrators
- Log acquisition and use for post-mortem investigation
Where to apply DLP (where to make it work)
DLP is about designing "where to apply."
- Email: Basics of countermeasures against mistransmission and external sharing
- Cloud storage: control shared links and external collaborations
- Endpoints: USB, local storage, printing, etc.
- Business apps: Teams, SharePoint, OneDrive, etc.
Especially in Microsoft 365 environments, Microsoft Purview DLP can be leveraged to manage these in a unified manner.
Common Mistakes During Implementation
Suddenly start with a "block"
Strict control from the beginning can lead to a greater impact on operations and backlash.
- First of all, monitoring only
- Then click Warning Display
- Eventually block
It is realistic to introduce it in stages.
Policies are at odds with the actual situation on the ground
If you create a policy with only the security personnel,
There are many cases where it does not match the work flow of the site.
- Advance alignment with business departments
- Adjustments during the trial period
will be important.
Key Points of DLP Operation
DLP is more about "operation" than "implementation".
- Stepwise application (monitoring→ warning, → control)
- Monthly log review and policy review
- Clarification of response flow (CSIRT linkage) in the event of an incident
- Operated as a set with education and dissemination for users
DLP is not a product that ends with you, but a system that continues to improve.
Conclusion
DLP is an internal fraud, operation error, and expansion of cloud utilization.
It is a very effective countermeasure against the risk of information leakage in modern times.
The important thing is that
- Design not only technology but also "operations" and "operations"
- Mature step by step
In order to protect internal information assets,
Let's establish DLP as a system that can be used realistically and continuously.
Colorkrew Security can support Microsoft Purview DLP from deployment to operation.
If you have any concerns about Microsoft 365 licenses that are included but not available, please feel free to contact us.