6 Cloud Data Loss Prevention Best Practices & Strategies

Data loss prevention (DLP) refers to a category of tools and technologies that classify, detect, and protect information (data) in three states: data in use, data at rest, and data in motion. The purpose of DLP is to enforce corporate data security policies that govern where data does — and doesn’t — belong. 

There are three main approaches to data loss prevention: network, endpoint, and cloud DLP. Cloud DLP is, as the name suggests, a category of tools and strategies designed to protect data stored in the cloud. Everyday work tools like Google Drive, Slack, and Atlassian use cloud storage to keep businesses running. Cloud data loss prevention is growing in importance: As of 2021, around 50% of all corporate data is stored in the cloud, according to Statista. 

As such, there are some key strategies and best practices required to use and store data in the cloud. By following these cloud data loss prevention best practices, and implementing the right DLP tools, organizations can reduce the risk of a data leak or breach from business-critical cloud platforms. 

Respect customer privacy

Today, privacy and security can no longer be treated as siloes. Respecting a user’s privacy — the rights they have to control access to and the use of their personal information — is the first step to protecting customer data in the cloud. 

There’s a reason why, in recent years, governments around the world have passed a range of privacy regulations (such as GDPR and the California Consumer Privacy Act). The more data that a company collects from a customer, the more information the company must protect from bad actors seeking to compromise data security. 

The easiest solution is to only collect the information you need from a customer. To be both compliant with privacy regulations and lower the risk of a data breach, organizations must implement a robust set of processes and tools that encompass user permissions and control over what data is shared. 

Create a data classification system 

Data classification is the process of identifying the type of sensitive information a company collects and determining how it is stored and used by employees. The process categorizes data that is: 

• Structured: usually quantitative data that is well organized and easily read by machine learning algorithms.
• Unstructured: usually qualitative data that cannot be easily processed and analyzed using common data tools.

When data classification is done well, it empowers an organization to determine the content and context of the data the company uses and stores. Data classification helps the business make actionable insights regarding what to do with its data and how to secure it.

There are many approaches to data classification. For instance, some data discovery tools with classification features might use regular expressions, or regexes, to determine the content of data. Other tools might apply heuristics to assess the context of data. 

Once the data discovery process is complete — after structured and unstructured data has been scanned — the cloud DLP tool will classify data based on predetermined categories, such as “important”, “confidential”, or “sensitive”. Admins can then locate and assess batches of data and prioritize securing information based on these labels.

Nightfall is unique from these traditional approaches in that we’ve built custom machine learning detectors specifically trained to identify common types of personally identifiable information (PII) across a variety of SaaS and IaaS environments. This allows our platform to account for both the context and improve the accuracy of our detection and classification capabilities. 

Put IAM controls in place

Identity and access management (IAM) is the practice of defining and managing user roles and access for individuals within an organization. IAM involves both tools and policies to make sure the right people can access the right resources at the right time, and for the right reasons. At a basic level, IAM strategies enforce the principle of least privilege: that minimal access should be given to any user or component, and that level of access should only be increased when explicitly instructed by an administrator.

There are a number of IAM controls and policies that can help data loss prevention. Some of these practices include: 

• Create individual credentials for each user (e.g., no group emails/accounts)
• Require strong passwords that are updated regularly
• Use 2FA or multifactor authentication 
• Regularly review user privileges and account permissions
• Implement IAM security, such as IDaaS and CIAM 

IAM helps organizations control who gain view, use, and share data, thereby mitigating the risk of insider threat. 

Enforce a cloud DLP policy

Tools and technology can only do so much to protect the security of user and company information. At some point, user training must be included to help employees understand the risks associated with sharing, using, and storing customer data. This is where a data loss prevention policy or strategy can help. 

According to Gartner, a DLP strategy should cover the following steps: 

• Step No. 1: Define Sensitive Data Types and Locations
• Step No. 2: Define Expected Data Flows
• Step No. 3: Define DLP Policies
• Step No. 4: Define Workflow and Incident Handling
• Step No. 5: Integrate With Additional Security Technologies

For non-technical employees, make sure they’re aware of cloud DLP policies, data types, and data locations. There should also be some training on how to handle incidents where data is improperly shared or stored, and how to escalate a situation before user information is further compromised. 

Investigate native cloud DLP controls

Many cloud platforms, such as Google Drive and Slack, come with built-in security protocols to help organizations keep their information safe. And, naturally, many companies assume that these native DLP protocols are sufficient. However, the reality is that these platforms are full of vulnerabilities, whether through user error, misconfigurations, or because compliance regimes require stricter controls. 

Take, for instance, Slack, one of the most popular remote working tools. Slack is a popular target for hackers both because of its ubiquity and its configurations. It is often incumbent on businesses to configure Slack’s security to its most rigorous standard. 

As CNBC reported, “[A]ll of these tools only work if companies use them. In many organizations, cloud-based tools like Slack enter from the ‘bottom up,’ meaning that normal employees start using them for work productivity without drawing IT into the loop. As a result, the people administering Slack channels may have no idea that these tools are available or know how to use them — they may not even be aware of the risks.” 

Businesses that are unaware that additional configurations are needed can inadvertently put their data at risk. IT teams should understand the out-of-the-box protocols that each cloud solution offers, and layer additional security accordingly. 

Implement a cloud DLP solution

Cloud DLP tools serve three main purposes. They can help organizations be compliant with HIPAA, GDPR, and CCPA. Cloud DLP solutions can also help protect your business’s intellectual property and trade secrets from falling into the wrong hands. And, finally, cloud DLP allows companies to understand where data lives and how it moves, enabling IT security to layer endpoint and network protections as needed. 

Cloud DLP tools can also take the burden of monitoring for vulnerabilities and inappropriate data sharing off the IT team. Cloud DLP tools automate alerting and redaction, giving IT teams the bandwidth to focus on more high-value tasks. Because cloud DLP tools are built to support API connectivity, they can integrate with a variety of platforms and systems: from Slack and Google Drive to Jira and Confluence. 

Nightfall is a comprehensive, modern cloud DLP tool that can help with data loss prevention. The ideal solution for organizations working remotely, Nightfall leverages machine learning to scan IaaS and SaaS environments using machine learning-trained detectors. Administrators can set up notifications to let users know when they’ve shared data in risky ways within your cloud applications. 

Nightfall is able to scan both structured and unstructured data, using ML to understand the surrounding context with a high degree of accuracy. Nightfall’s classification is automatic, eliminating the time spent tagging data manually, reviewing false positives, and grappling with alert fatigue. This allows IT teams to focus on high value-add activities that help the organization master cybersecurity to the best extent possible. 

To learn more about Nightfall, set up a demo using the calendar below.