A good advice from the article "business people need to be active participants in data monitoring, not leaving it to the IT department"

Why to be scared? Knowing what happens in business has been and always will be a good thing. It is not technically difficult, EXCEPT if the are no plans, designs, etc. And knowing what happens can be used to enhance just not security but for other business benefits, assuming it is designed that way.

The problem is (partly) the DLP vendors and current trend in corporations thinking that technology solves problems without any planning and design. I can understand vendors, they are selling point solutions, some good, some not so good, but a company which trusts technical tools and toys solving business problems will have problems and will pay later on when the requirements change - as they do every day in very dynamic business (and technology) field.

If the systems are planned for it and designed for it, authorizing, tracking, auditing, alerting and managing those functions come "simple". Even data and usage mining for business purposes will be much easier. This should be a selling point inside the company, nothing to be scared! But is has to be common to all systems and that is where (most?) tools fail if not adapted to environment.

Why environment? A DLP solution which doesn't work with every part in corporate where the information can be lost may (in worst) case be more a problem than a solution - it may lead to a long and failing search what and who really happened. For example even if persons don't have computer access to some information, they may have a physical access to same information, backup tapes, spare disk storage, and so on. If they can not be connected to data leak, it can be a long and difficult day for a company in case of data loss. Or, maybe a person or an external hired resource doesn't have any access to any computer environment but an access to artifacts, as printings, lists, reports, mailing lists, etc - same thing, the information can be "lost". With a "small" planning and design this can be avoided but, again, there is no technical tool to do that.

Click to read the article this is in response to.