Cybersecurity is changing all the time. It is naive to assume that there is a list of vacancies that need to be closed and solutions that need to be implemented to guarantee security of the company and forget about it forever. Two years ago, the whole world switched to a remote work format as the primary one and this requires new approaches in security.
Now when most data is generated outside of a secure local work environment, it is critical to ensure that it is well protected based on an enterprise security culture. Moreover, the probability of data leaks in companies where there are many employees in general and few in the direction of IS is extremely high, and the concept of "data privacy" remains blurred at all. That is why strong protection in the new realities is a mix of integrated solutions and security culture at the level of each employee's behavior.
To protect data, many companies use Data Loss Prevention solutions that classify information and prevent it from leaving the perimeter. They can interfere with workflows: mark confidential documents as public and vice versa. It results in employees being able to transfer confidential files to third parties quickly but not being able to share them as part of their work tasks.
The solution is a user classification, in which the employees themselves mark the data according to the degree of importance because no machine will understand it better than the author. Specialized solutions are used to realize this approach – for example, Boldon James from FORTRA.

Combining technologies: the first step towards data protection 

Protection must be automated – this is what any department and system of security solutions strive for. However, as already mentioned, security is a culture and approach. Therefore an attempt to automate the result of human activity cannot be effective in all cases. To do this, employees must know what they are protecting and how vital the file they just received via mail is.
Therefore, user classification in conjunction with Data Loss Prevention is the modern data protection standard. This approach significantly reduces the number of DLP false positives because it has the only source of truth.
This approach has substantial advantages: CISOs receive all the conditions to ensure data protection, and the employees are instilled with a culture of safe behaviour during daily work.

Step Two: Add People to Technology 

It is important for security professionals to standardize as much as possible on all approaches to data classification and control over its use. To do this, security policies must be simple and clear to ordinary employees: why they take this or that step, what it will give, and what ignoring the rules will lead to.
This way, employees can help ensure a unified approach and be involved in data protection through responsible classification. It is a must to involve them in this process because they know best the value of specific data and files that they generate in the work process.
All employees must do this: it is possible to entrust the security department centrally with the classification matters, but it is not necessary. Within one company, employees do not understand the intricacies of the work of people from neighbouring departments, which is normal. For a security officer, all drawings, contracts and accounting reports look the same. But somewhere in the middle of all this, some files will cost the company millions if lost, and they will be stored in the same directory with intermediate data that can be deleted without anyone noticing.
Therefore, the best approach is when the author of the documents themselves puts a label about how confidential this file is, and this label is understood and seen by both the company's employees and the DLP system. It is not always necessary to understand the content; it is enough to know that the file on your device should be protected – end of story.

What are the results? 

With the approach described above, security officers understand what exactly needs to be protected and what policies regarding actions with data are applicable in a particular case. Employees will be involved in working with data and their classification, better understand the value of this or that information, as well as understand the location of data and realize where the entrance is forbidden.
Confidential data is unique for different companies making it impossible to implement a unified approach for all businesses and write a guide on what to do to ensure proper security. Therefore, solutions are needed to be effective and flexible for each organization. Custom classification with Boldon James allows you to achieve this flexibility and make the data leakage prevention (DLP) system even more effective.
Read more about Data Loss Prevention (DLP) and its features here →

Let's summarize 

Data protection begins with the answer to "What should be protected?". Data classification is made to cover this request. Inaction will not work, and neither will half-measures. Inadequate approaches to classifying and protecting information can result in substantial financial losses. Besides, the conditions for success are changing every day.
Involvement of all company employees, automation, and synergy of used user technologies help create a strong security culture and keep data secure.