International peer-reviewed academic journals call for papers, http://www.iiste.org

1. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
Protection and Defense against Sensitive Data Leakage Problem
within Organizations
1-Sahem A. Nawafleh
E-business & E-commerce department - University Of Petra
2-Muneer Y. F. Hasan
Management information system department - University Of Petra
3-Yousef Nawafleh
The Jordanian Ministry of Justice
4-Suha Amin A. Rahman Fakhouri
AL-Ghad international medicl science colleges
Abstract
Information security has never been as important as it is today for the business, health, and educational organizations,
in addition to individuals because many organizations around the world depend, today, on reliable information to
perform their daily tasks. Additionally, the information needs to be timely, accurate, complete, valid, consistent and
relevant to
any use on the organization. The information, confidentiality, is measured as a main topic for many
organizations around the world that attempt to find the best way to protect them from hackers' attacks, so it is possible
for organizations and individuals to protect themselves by being skilled on the importance of security and gaining
awareness of the possible security attacks that they may encounter. This paper proposed an integrated solution for
preventing and reducing intentional sensitive data leakage actions through implementing a series of effective
procedures, for instance: monitoring user’s actions, protecting sensitive data properly against any intentional or
accidental leaks, and guarantee these data not to be reached to the wrong individuals or groups from inside/outside
the organization. The proposed sensitive Data Leakage Prevention (DLP) solution involves identification, monitoring,
and protecting three groups of significant organization's data: data at rest, data in use, and data in motion.
Index Terms : Sensitive data, Data Leakage,
Data Leakage Prevention (DLP) solution,
Acceptable Use of Information (AUI),
Data in use, Data at rest, Data in motion.
1.
Introduction
Nowadays, Information Security became a vital and a major subject especially with the spreading of information
sharing among private and public networks for all organizations across different industrial sectors e.g. telecom,
banking and education all over the world. The importance of securing information is playing a significant role
especially when sharing, distributing, accessing and publishing any information that's been classified as a
sensitive either for the organization itself or the clients whom sharing their private information with the
organization, like information that has been stored, shared, distributed and viewed through the electronic
document systems and/or images of paper document systems which is widely used by a lot of organizations.
Many organizations have a great deal of attention that has been given to protect their sensitive data from outside
threats by using a set of security countermeasures like: intrusion prevention systems, firewalls, and management
of thevulnerable points inside them. So, organizations must now turn their attention to equal critical situations
that forms, for them, as a big challenge today’s: the problem of data leaking or loss from the inside.
In fact, in many organizations, there is a gap in controlling, monitoring, and protecting its business environment
and electronic data assets from leakage or loss to the wrong individuals or groups intentionally or accidentally.
This gap is now ubiquitous in businesses, health, educational organizations and individuals who are needed to
communicate with each other over the Internet networks. In our days, many electronic communications which
are used heavily inside any organization for many purposes ,for instance: local mail, instant messaging, web mail,
transferring data files , and also organization's website, are still used largely in different destinations without any
limitations, monitoring , and controlling for its movements from the organization, thus the expected result for
this issue that there is a huge potential confidential information of the organization to surely fall into the wrong
hands. From this significant point, this organization's sensitive data should be protected very well or will be
faced with tragedy results like: business loss, reputation damage, bad publicity, strategic customer loss, and loss
87

2. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
of the competitor with other organizations. As a result, any organization that uses a similar electronic document
system must keep a close eye for securing sensitive information that is going forth/back through this system or
the application to maintain business continuity and reputation and to ensure regulations, law compliance along
with differentiating from others.
In this paper we talk about one of the most new methodologies and techniques solution that has been raised to
the top is the Data Leakage Prevention (DLP) solution which is basically protecting sensitive data of an
organization from being viewed by wrong individuals, being from outside the organization, or even from inside
it. This basically means that specific data can be viewed by only a specific set of an authorized individuals or
groups [3]. The sensitive Data leakage prevention (DLP) became one of the most critical issues that faces Chief
Information Officers (CIOs), Chief Security Officers (CSOs), and Chief Information Security Officers (CISOs).
On the other hand, the DLP's solution is considered as one of the most vital security approaches and techniques
that effectively assist organizations today in protecting the organization's sensitive data from leaking into the
wrong hands. It's playing a major role as a part of the overall information security system framework that can
integrate with existing infrastructure and systems like electronic document management systems to provide a
comprehensive , holistic and effective information security strategy inside the organization [5].
2.
Background
Many published papers and reports talk about the importance of (1) identification of sensitive data in any
organization, (2) applying a suitable information policy to protect it from leakage into the wrong hands, (3)
finally explain the benefits that any organization can gain from preventing data leakage and prove this issue that
can be satisfied by controlling and monitoring the document viewer side. Eric Maiwald thinks that the
identification of information policy within any organization is considered as the most important part according to
many justifications like [1]:
(i) The information policy defines what sensitive data is within the organization and that data should be
protected. This policy should be constructed to cover all data within the organization.
(ii) Each employee is responsible for protecting sensitive data that comes into the employee's
possession.
These data can be in the form of electronic documents or paper records, thus the organization's policy must take
both into account.
(iii) To protect your data from leakage you must classify the data documents into a set of levels according to
their importance like:
1- Public Classification (lowest level):
The data are not sensitive and can be provided to the public.
2- Private Classification (Medium level):
The data are confidential and can be provided only to the authorized employees or to other
organizations.
3- Sensitive Data Classification (Highes level):
The data are very sensitive and must be restricted to a limited number of employees within the
organization. These data must be protected well by not provided to all employees or to the individuals
outside of the organization.
(iv) The information policy must address how sensitive data is transmitted. The sensitive data can be
transmitted through a number of ways such as (Email, Fax, and so on), and the policy should address each
of them very well.
Securosis -information security company- report which published on Feb/2009 described the
(A)
Main features of Data
Leakage Prevention (DLP) life cycle, where all these
(B)
features are tied together in the DLP cycle as the following [7]:
88

3. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
Fig1: DLP Features Cycle [7]
1. Define: The first feature which concerns with building a proper organization information policy that
defines the data to be protected, and how to protect it very well.
2. Discover: The second feature which uses the DLP solution to find the definition data throughout the
organization. And then relocate or remove information where it shouldn’t be.
3. Monitor: The third feature which concerns in track usage of the defined data at risk, in motion, and in use.
Then it can generate a proper warning alert if and only if any organization's Information policy had been
violated.
4. Protect: The fourth feature which concerns with protecting sensitive data from leaking by quarantine emails,
relocate files, block copies to portable storage, and other enforcement actions.
(B) Define Data Leakage Prevention concept as
"Products that, based on central policies, identify, monitor,
and protect data at risk, in
motion, and in use through deep content
analysis". This definition contains
the core
components of a DLP solution: centralized
management, identification of defined data,
monitoring of usage, and protection from
policy violations. A DLP solution can do
this in data storage,
on networks, and on
employees' computers, using advanced
analysis techniques, thus this solution can
provide better protection and more cost
effective in the long term.
(C) They expected more benefits that can be gained from implementing a proper DLP solution within any
organization like the following [7]:
 Risk Reduction: You can reduce the risk of threats and the possibility of data leakage by knowing where
your data is stored and how it’s being used.
 Cost Savings: DLP solution may help to reduce other costs associated with data management and security.
 Compliance support: DLP solution helps to reduce the direct costs associated with some regulatory compliance
from all employees within the organization.
 Policy enforcement: Many data management policies in different organizations are difficult or impossible to
enforce. The DLP solution supports enforcement of Acceptable Use of Information (AUI), not just security
controls.
 Data security and Threat management:
While no security tool stops all threats, DLP solution reduces the risk of certain malicious activity.
on March 2008, many of specialized corporations such as International Data Corporation (IDC), which is a
leading center in the world of information security researches' and analysis specifically for many sectors such as:
89

4. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
information technology, and telecommunications. Its report which was published to demonstrate the dangers of
accidental exposure for organization's sensitive data and considered it as the number one threat. [8].
At the end of the same year, another study for the same corporation has shown many important facts like: 80
percent of respondents in the survey have agreed on that data security was one of the biggest challenges facing
them, and with 50 percent of respondents have possessed a good experience to deal with incidents of leakage of
sensitive data inside different sectors of the organization. [9]
Another important IDC’s survey indicated that the problem of intellectual property has now become one of the
most acute problems that faces many organizations today, especially for the sensitive data leakage problem. 81
percent of those surveyed saw that Information Protection and Control (IPC) – can definitely be considered, as
monitoring, encrypting, filtering, and blocking sensitive data contained in data at risk, data in motion, and data in
use, as an important part of the overall strategy to protect the data within the organization.
The highest priority of information protection and control (IPC) solution was data leakage prevention (DLP)
which deployed at the organization’s perimeter and on all endpoint computers within the organization. [8]
Fig2: Importance of monitoring employee use [8]
The respondents to IDC’s survey demonstrated the importance of [monitoring employee use] and showed that
the accidental or intentional exposure of confidential information of the organization, is ranging from legally
protected personal information to intellectual property and any significant secrets about organization, is
something that affects on the IT environment in its widest sense, involving lost or stolen laptops, hacking
employees' emails and any other vital applications for them. Nowadays, the main challenge for many
organizations is not how to find the best way to protect the sensitive data from the threat or corruption of
malware programs , but just how it can add a proper second security layer that can prevent data that's being
accessed if it is lost.
A Sophos white paper which published on Feb/2009 under the title “Stopping Data Leakage” demonstrated the
importance of enabling DLP solution within the organization by creating and enforcing an Acceptable Use Policy
(AUP) to support any attempts to stop data leaking from the organization. It also proposed three steps to make an
AUP success [5]:
Step (1): Create the suitable policy within the organization.
Step (2): Educate employees and users about the policy.
Step (3): Enforce the policy properly.
The AUP should cover many issues that are very important for the employees within the organization to be
known for them clearly such as [5]:
i. Determine clearly what information or documents must not be emailed.
ii. Determine whose persons or organizations are authorized to access, receive, and see the sensitive data
documents.
iii. Determine what operations/actions are allowed on the sensitive data documents.
90

5. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
iv. The organizational policy in sending a specific document over the web or downloading it from the web.
v. The organizational policy on storing sensitive data on desktops, PC’s, laptops, and so on.
3.
Main Work
Nowadays, many business organizations have become vastly depending on online transactions; to complete its
works efficiently and accurately, thus saving time and cost for them. This option makes a big chance for
transferring data between many nodes within the organization in a more flexible way, but at the same time it
faces many challenges and limitations for instance finds the best way for monitoring, keeping, and preventing
data from leakage to unauthorized people. Many organizations over the world find themselves, after years of
enforcing viruses, intrusions, and email spam problems, facing a significant new security issue but it becomes
more important in huge data leakage. Therefore, different organizations sectors today (e.g. Health, telecom,
banking, and education) are becoming increasingly more aware of the acute need to control, very well, the
information that flows into, through and out of their own networks.
One of these solutions is a DLP Solution which is considered as the best solution that can be used by the
organizations and vendors who are offering services or products to prevent
Sensitive data from reaching to
unauthorized
persons and others [4]. The most important
part in any DLP solution involves developing
awareness training courses for the users to achieve data leakage prevention through teaching them how to deal
with
expected security attacks that can happen for them at any moment. However, this solution does not
guarantee a complete protection as data leakage may occur intentionally by leaking data or accidentally by
sending data to wrong receivers.
The main contribution of this paper is describing a new security solution [DLP Solution] which can be used
effectively in reducing intentional sensitive data leakage actions through monitoring user’s actions properly.
On the other hand, this solution can be regarded as “integrated” if and only if it is able to:
• Protecting the organization's sensitive data against any accidental or intentional leakage.
• Securing the organization's sensitive data so that, if it leaked or lost, it cannot easily be read by others.
4.
The Process of Identifying
Sensitive Data
Sensitive data is any data that when it leaks, it can cause harm to somebody or an organization.
Sensitive data may contain:
1- Personal Information
2- Information about the organization.
There are various examples of sensitive data:









Social Security number (SSN).
Credit card number.
Personal information about patients.
Financial data of the organization.
Personal information about students.
Students’ records (study plans, marks).
Employees personal information.
Research data within the university.
University special Legal data.
5.
The Process of Identifying Sensitive
Data Leakage Prevention (DLP) Solution
Data Leakage Prevention (DLP) is a computer security term that involves the identification, monitoring,
91

6. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
and protecting three groups of organizing data [7]:
6.
Data at Risk
“Data at Risk” is a recorded and stored data in media storage or any data that resides in filing systems, databases
and other storage methods [3, 6]. This data can be regarded as “Secure” if and only if:
• The data is protected by strong encryption (where “strong encryption” is defined as “encryption requiring a
computationally infeasible amount of time to brute force attack”).
• The key (required to decrypt the data) is (i) not presenting to the media itself (ii) not present on the node
associated with the media; and (iii) is of sufficient length and randomness to be functionally immune to a
dictionary attack.
7.
Data in Use
• “Data in Use” is all data that is not at risk state, and only on one particular node in a network (for example,
in resident memory, swap, processor cache or disk cache, or memory) [3, 6]. This data can be regarded as
“Secure” if and only If:
• The Access to the memory is thoroughly controlled (the process that accessed the storage media data and
read it into memory is the only process that has an access to the memory.
• Regardless of how the process (the owner of the data) terminates, (either by successful completion, killing
the process, or shutting down the computer), the data cannot be retrieved from any location other than the
original at risk state, requiring re-authorization.
8.
Data in Motion
• Or “Data in Transit” is all data being transferred between two nodes in a network [3, 6]. This data can be
regarded as “Secure” if and only if:
• Both nodes (the source and the receiver of the data) are capable of protecting the data in the previous two
classifications from any threats.
• The communication between the two hosts is identified, authenticated, authorized, and private; meaning
that no third node over the network can overhear the communication between the two endpoint nodes.
9.
Data Leakage Prevention (DLP) Techniques
Protecting those data groups is achieved through the following techniques that can be found in DLP literature
[ 6]:
• Deep content inspection (Advanced Option).
• Contextual security analysis of transaction (attributes of originator, data object, medium, timing, and
recipient/destination).
• A centralized management framework. The systems are designed to detect and prevent the unauthorized use
and transmission of confidential information.
10. How is Data Leakage Prevention (DLP) different from other security technologies?
Conventional security tools that have been in use, such as firewalls and An Intrusion detection system (IDS)
/Intrusion prevention system (IPS) look for anything that can form or pose a threat to the organization's
information and then obtain set of steps to deal with these threats. But Data leakage prevention (DLP) solution is
interested in identifying the sensitive data inside the organization and then the first option is monitoring the
users’ usage and the last option is preventing them from leakage to unauthorized organizations or people [3].
92

7. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
11. DLP Integrated Solution
The truth is that, most business organizations in the world across different sectors (governmental establishments,
ministries, specialized companies, banks, and universities), for example, don’t have enough technical staff,
governmental /special funds, resources, and they need for intensive efforts to implement suitable security
requirements within the sturdy strategy security plan to face the data leakage problem effectively.
Accordingly, an urgent need emerged for organizations to implement a series of new security solutions that
combine the features of a DLP solution with other security tools to provide an integrated solution to this problem
from its roots. Hence, this paper has proposed an integrated solution based on the achievement of two main
phases [Two Layers of Defense], which can be summarized as following:
Phase (1): (First layer of defense)
Protecting sensitive data of an organization
Endpoint protection (Protecting Data inside Organization): The proposed procedures to guarantee endpoint
nodes inside the organization are safely.
Table 1: Endpoint Protection Procedures
Prohibiting the use of non-necessary applications such
as wireless network connections, sharing files, FTP
clients, instant messaging service (IM), and
unauthorized email clients. Therefore, all employees
should be fully aware of the dangers of sending and
sharing organization’s data via these applications.
Blocking different spyware programs that can be used
effectively by information's hackers in hacking
sensitive data of an organization by using powerful
anti-malware solutions.
Checking carefully that every PC connected to network
within the organization is compatible with the
organization’s security policy.
Managing properly access operations to any type of
portable storage devices such as USB keys and others.
Consequently, these devices can cause a high security
risk within any organization, because they can be easily
lost.
Gateway protection (Protecting Data outside Organization): At present, many organizations have their own
websites and e-mail; these may contain a lot of security functions that can be used to prevent
sensitive/confidential data from being sent outside the organization or to un-authorized users within the
organization.These Features include:
Table 2: Gateway Protection Procedures
Monitoring and Controlling users from accessing particular
websites, well-known webmail sites (e.g. Yahoo! Mail and
Google email), and applications which can cause a serious
threat to the organization itself.
Preventing users from uploading or downloading certain
types of data files and warn them clearly from unauthorized
file types which are received in their emails.
Controlling and blocking the unauthorized use of Instant
Messaging (IM) and FTP traffic between the users
themselves or with other users/organizations from outside.
93

8. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
Adopting a series of preventive measures to protect against
“drive-by-downloads” feature’s which secretly place
specific spyware code on the user’s PC when they
accidentally visit a particular sabotage website.
Consequently, these tricks require from the users' within the
organization to be well aware the seriousness of these
threats if occurred.
Verifying the contents of web traffic periodically to ensure
it is free from any Viruses, spyware, and malware. On the
other hand, being confident that these programs will not be
downloaded into the user’s PC.
Scanning accurately the Contents of email messages and
attachments of various kinds to control and prevent
sensitive data from leakage by identifying a specific
keywords relating to confidential data of the organization.
Phase (2): (Second layer of defense)
Securing sensitive data of an organization
In fact, despite of having the best solutions for data leakage problem and the best policies for securing the
sensitive data of an organization, there still a possibility of leakage or loss at any moment in the wrong hands
intentionally or accidentally. So it is essential to have a second layer of defense [Encryption Sensitive Data].
Data encryption is considered as one of the traditional methods that have been used effectively for a long period
to protect data when moving from one place to another. Over the past years, many researchers and specialists in
information security agreed on that the percentage of the potential risk, for the organization itself or the users,
will be reduced if data had been encrypted very well compared with non-encrypted data. If the organization
wants to secure its sensitive data and devices, they should:
Table 3: Secure Data Procedures
Perform full disk encryption for PC’s,
laptops, and notebooks according to their
importance.
Encrypt sensitive data which are stored on
removable storage devices (e.g. USB drives,
CDs and DVDs).
Encrypt E-mail’s content to prevent
unauthorized users from reading them.
Encrypting sensitive data and devices, that is used in the organization, this way indicate that both are subsisted in
a safe mode, even if they reached the wrong hands. But the main question which must take into consideration;
whether if encrypting sensitive data only, is enough to protect it from any risk
12. Conclusion
Sensitive Data leakage prevention problem, become as one of the most vital security issues facing Organizations
today. The most effective solution to the problem is to see Data Leakage Prevention solution (DLP) as part of the
overall security problem. This solution can be integrated fully with other security tools within organization to
form a comprehensive security strategy plan to protect these data properly .DLP solution can be used effectively
in reducing intentional sensitive data leakage actions through monitoring user’s actions and protecting three
groups of organizing data: data at risk, data in use, and data in motion. This solution can be regarded as
“integrated” through the achievement of two main phases [two layers of defense]: protecting sensitive data and
securing sensitive data of an organization. The organization also needs to create an Acceptable Use Policy (AUP)
for users, at the same time ensuring both are compliant with organizational policies.
94

9. European Journal of Business and Management
www.iiste.org
ISSN 2222-1905 (Paper) ISSN 2222-2839 (Online)
Vol.5, No.23, 2013
To avoid data leakage, organizations must evaluate their weakness and respond appropriately in many ways like:
Endpoints protection, Gateway protection, and encryption data.
13. References
[1] Eric Maiwald, “Fundamentals of Network Security”, McGraw-Hill November 2003.
[2] John M. Carrol, “Computer Security”, Third Edition Butterworth-Heinemann 1996.
[3] Prathaben Kanagasingham, “Data Loss Prevention” (Aug/2008), Retrieved November
14, 2009 from http://www.sans.org/reading_room/whitepapers/dlp/data_loss_prevention_32883.
[4] Sans Security Institute, “SANS What Works in Data Leakage Prevention & Encryption
Summit” (Jan/2010), Retrieved January 16, 2010 from http://www.sans.org/data-leakage-prevention2010.
[5] Sophos Institute, "Stopping data leakage: Making the most of your security budget", Published 19
November 2009, Retrieved January 18, 2010 from
http://viewer.bitpipe.com/viewer/viewDocument.do?accessId=11492295.
[6] Sans Security Institute and Securosis, "Understanding and Selecting A Data Loss Prevention Solution"
(2009), Retrieved January 24, 2010 from http://www.websense.com/site/Docs/whitepapers/en
/Understanding_and_selectinga_DLP_solution_wp. Pdf.
[7] Securosis Information Security Research and Analysis, "The Executive Guide to Dat Loss Prevention" (2009),
Retrieved January 24/ 2010 from http://www.websense.com/site/docs/whitepapers/en/Mogull_DLP_WP.pdf.
[8] IDC, “Information Protection and Control Survey: Data Loss Prevention and Encryption Trends”, Doc #
211109, March 2008, Last accessed August 24, 2010
[9] www.networkworld.com/news/2009/011409. Encryption-told-to-stop-ignoring.html? fsrc=rsssecurity, Last accessed August 24, 2010.
95

10. This academic article was published by The International Institute for Science,
Technology and Education (IISTE). The IISTE is a pioneer in the Open Access
Publishing service based in the U.S. and Europe. The aim of the institute is
Accelerating Global Knowledge Sharing.
More information about the publisher can be found in the IISTE’s homepage:
http://www.iiste.org
CALL FOR JOURNAL PAPERS
The IISTE is currently hosting more than 30 peer-reviewed academic journals and
collaborating with academic institutions around the world. There’s no deadline for
submission. Prospective authors of IISTE journals can find the submission
instruction on the following page: http://www.iiste.org/journals/
The IISTE
editorial team promises to the review and publish all the qualified submissions in a
fast manner. All the journals articles are available online to the readers all over the
world without financial, legal, or technical barriers other than those inseparable from
gaining access to the internet itself. Printed version of the journals is also available
upon request of readers and authors.
MORE RESOURCES
Book publication information: http://www.iiste.org/book/
Recent conferences: http://www.iiste.org/conference/
IISTE Knowledge Sharing Partners
EBSCO, Index Copernicus, Ulrich's Periodicals Directory, JournalTOCS, PKP Open
Archives Harvester, Bielefeld Academic Search Engine, Elektronische
Zeitschriftenbibliothek EZB, Open J-Gate, OCLC WorldCat, Universe Digtial
Library , NewJour, Google Scholar