How Data Classification and Data Loss Prevention Go Hand in Hand

In an age when data discovery and the protection of sensitive data have become key to reaching compliance with laws and international standards such as the EU General Data Protection Regulation (GDPR), HIPAA, and PCI DSS, data classification and Data Loss Prevention (DLP) solutions have emerged as essential tools for effective data management strategies and data breach prevention.

In this week’s blog post, we take a closer look at data classification, what it is and how DLP solutions benefit from integration with it.

What is Data Classification?

Much like its name implies, data classification is the process of organizing data into appropriate categories for more efficient use and protection of data across company networks.

In the context of information security, data is tagged, either manually by employees or automatically by the data classification solution, based on its level of sensitivity, making it easier to find, track and safeguard sensitive information. In this way, data classification tools significantly contribute to risk management, regulatory compliance, and data security.

Major categories of sensitive data

While data classification categories can vary depending on the companies, there are four major categories when it comes to sensitive data:

• Highly sensitive data: information that, if made public, puts the company in danger of legal action, regulatory noncompliance, or financial loss. This refers especially to personally identifiable information (PII) but also intellectual property (IP) and other industry-specific categories of sensitive data.
• Internal sensitive data: information that, if revealed, can pose a risk to company operations. These include sales data, customer information, employee salaries, etc.
• Internal data: information that, while not sensitive, is not publicly available such as organizational charts, marketing strategies, etc.
• Publicly available data: information that everyone within and outside the organization has access to, for example, product descriptions, company address, etc.

While the temptation would be to categorize all data, few companies can afford to. Given the enormous amounts of data organizations now process, it’s only natural that tagging every data item is a cumbersome, time-consuming, and ultimately expensive endeavor.

Therefore, it is essential that companies build their own data classification categories that include both sensitive data as defined by various regulations that they are obligated to comply with and what can be considered industry-specific sensitive information.

Making sensitive data easily identifiable to a data processor is essential under regulations such as GDPR that require companies not only to be able to find such data and protect it but to demonstrate their ability to do so. It is also essential for organizations to comply with users’ requests to access or erase their personal data within a given time frame. Failure to do so can result in heavy fines and a loss of customer trust.

How Data Classification works with Endpoint Protector

Endpoint Protector’s Content Aware Protection (CAP) module works well with data classification solutions such as Boldon James to provide companies with the best protection against insider threats and data leaks.

While creating CAP policies, companies can build their custom dictionaries using their data classification tags. In this way, Endpoint Protector’s content scanner easily picks up metadata consisting of the tags added through automated classification processes. Different remediation actions can then be applied depending on the type of data tag. For example, policies can be created that block the transfer of data tagged as highly sensitive or that only report the transfer of internal data.

Endpoint Protector currently extracts classification metadata from numerous file types, and new ones are added all the time.

Data classification represents an added layer of data security when used in conjunction with DLP solutions. It makes highly sensitive information instantly recognizable to DLP tools scanning data classification tags, thus ensuring that the right policies are applied to restrict or block their transfer.