Protecting sensitive data: classification, DLP and encryption

Most organisations invest in firewalls and endpoint tools long before they can answer a basic question: where is our sensitive data, who can reach it, and how is it protected? Customer records, payment data, staff files, contracts and government correspondence spread across file servers, databases, email, laptops and cloud storage. Buying a DLP or encryption product before answering that question usually produces noise, gaps and a false sense of control. The order of work matters.

Discover and classify first

Start with a data inventory. Identify the business processes that handle sensitive information, the systems that store and move it, and the owners accountable for each. Supplement interviews with automated discovery scans of databases, file shares and cloud storage, because shadow copies in spreadsheets and exports are common.

Then define a classification scheme that people can actually use. Three or four levels are usually enough, for example public, internal, confidential and restricted. For each level, write down the handling rules: who may access it, where it may be stored, whether it must be encrypted, how it may be shared and how it is destroyed. A scheme that needs a manual to apply will be ignored. ISO/IEC 27001 (Annex A controls on information classification and labelling) and NIST SP 800-53 give a recognised basis for this work, and PCI DSS v4.0.1 adds specific requirements wherever cardholder data is involved.

Encryption and key management done right

Encryption is only as strong as the way its keys are managed. Think in three states:

• At rest: full-disk encryption on endpoints and servers, plus database or application-level encryption for the most sensitive fields.
• In transit: current TLS for all external and internal connections, and secure channels for administration and backups.
• In use: reduce exposure while data is processed by limiting who can query it, masking fields in non-production and test environments, and considering confidential-computing options for the highest-risk workloads.

For key management, follow a few firm rules:

• Keep keys separate from the data they protect, in a KMS or a hardware security module (HSM) for the most critical keys.
• Separate duties so that no single administrator can both use and export a key.
• Define rotation and revocation schedules, and test that rotation works before you need it in an emergency.
• Log all key operations and review the logs.
• Protect backups of keys and document recovery, because losing a key can be as damaging as losing the data.

Tokenisation, masking and DLP

Where a system does not need the real value, do not give it the real value. Tokenisation replaces sensitive fields, such as card or national identity numbers, with surrogate tokens, so that most applications, reports and analytics never touch the original. Combined with masking in development and testing, it shrinks the scope of systems that must be hardened and audited.

Data loss prevention then enforces your rules at the points where data leaves: email, web uploads, removable media, cloud applications and endpoints. Successful DLP programmes share three habits:

• They start in monitor-only mode to learn real data flows and tune policies before blocking anything.
• They focus first on a small number of high-value data types rather than trying to catch everything.
• They define a clear process for user exceptions and for investigating alerts, so that DLP does not become either a blocker of legitimate work or a console nobody reads.

Finally, remember the human and supplier side. Train staff on the classification labels they will see every day, and extend handling requirements to vendors and cloud providers through contracts and security assessments.

How Wethaq ICT helps

Wethaq ICT helps government bodies, companies and financial institutions build this capability in a sensible order. We run data discovery and classification workshops, design the handling policy against ISO/IEC 27001 and sector requirements, review encryption and key-management architecture, and support DLP deployment and tuning, so that protection follows the data rather than the other way round.