How a Nuanced Approach to Organizational Loss may Lead to Improved Policies, Better Applied Technologies, and Greater Outcomes

摘要

The most common strategic approach to preventing data loss begins with and primarily focuses on three factors: Data In-Use and related integrated endpoint actions and accessibility issues; Data In-Motion, including applied analytics and interwoven network traffic considerations; and Data At-Rest, which incorporates data location, management, storage issues, and post-event analysis. While this common approach provides value, we challenge the assumption that this approach tells the entirety of the data loss story, especially since it is difficult to define true markers of loss. Instead, we assert that data loss prevention strategies deserve a nuanced approach, including a consideration of what data loss truly means to the organization. Our nuanced approach to data loss evaluates what data loss actually means for the organization and factors this into the solution suite an organization employs to prevent the loss. To clearly consider the full data loss story and choose the best individual or combination of solutions, we assert that the organization may need to consider and define data loss according to a number of factors important to the eventual remediation strategy. Headline-making, intentional, and malicious data loss may remain the focus of the traditional approach and the primary consideration for many organizations. But the nuanced approach explored in this paper--which includes unintentional employee data sharing and unintentional data deletion--should also be incorporated into a more encompassing understanding of data loss when determining a strategy and attendant measures. Data loss measurement also requires considerations as to how it is defined by statute and regulation (as disclosure laws differ by region); from whose perspective the loss is evaluated, as various stakeholder perspectives may include business people with a defined interest in the information, information technology professionals who support that work, lawyers (internal and external) to the business, third party contractors, customers, and day-to-day users of the data (especially in those sectors protecting personal data such as health information); and whether the data loss was categorized as confidential or sensitive, thus deserving of protection from unauthorized access or exposure. Based on these additional considerations of risk and stakeholder perspective, we assert that the considerations presented in this paper will provide a better understanding of data loss, and that their utilization will aid organizations when developing more holistic and relevant data loss prevention strategies.