3.3Data Leak Prevention and Physical Security Controls (DLP, Encryption, Clear Desk, Access Control)

Information leaks arise not only from external cyberattacks but also from insider exfiltration and simple physical theft or shoulder-surfing. No matter how tightly a network is secured, it is undermined if avenues remain such as a screen being viewed while the user is away, confidential data being carried out on a USB drive, or data being recovered from discarded documents or disks. This section organizes data-leak prevention around two complementary pillars: technical controls that protect the data itself, and physical controls that manage people and places.

3.3.1DLP, encryption, and data-exfiltration control

• A DLP (Data Loss Prevention) system detects confidential information (patterns matching personal ID numbers, files tagged with confidentiality labels, etc.) based on content, and detects or restricts its transmission, copying, or printing externally. Its distinguishing feature versus plain access control is that it monitors across multiple channels — email, web uploads, USB copies, and so on — focusing on "characteristics of the data itself."
• Encryption protects data at rest (stored data) and data in transit (communications), so that even if a device is stolen or data is exfiltrated, its content cannot be read. It is the cornerstone of loss/theft countermeasures for laptops and USB drives: even though it cannot prevent the theft itself, it prevents the actual harm — the content being read.
• Data-exfiltration control (device control) restricts or prohibits connecting external storage media such as USB drives, and restricts using personal devices for work (shadow IT). This also includes centrally managing work devices via MDM (Mobile Device Management) (remote wipe, app restrictions, etc.). By making data harder to carry out in the first place, it complements DLP and encryption.

3.3.2Clear desk, physical access control, locks/surveillance, and tamper resistance

• A clear desk policy requires that confidential documents and laptops not be left on a desk when a person steps away or leaves for the day, and instead be locked away in secure storage. A clear screen policy requires locking the PC screen when stepping away, to prevent shoulder-surfing or unauthorized use. These operational rules compensate for what technical controls cannot address — human carelessness at the moment someone walks away.
• Physical access control identifies and logs entry/exit to a server room or office on a per-individual basis via IC cards, biometrics, etc., admitting only authorized people. Keeping an entry log also contributes to after-the-fact traceability (accountability). Countermeasures against piggybacking (an unauthorized person entering right behind an authorized one) include operational practices such as anti-passback, which requires each person to authenticate individually on every entry.
• Locks and surveillance cameras provide locking controls for server rooms and important document storage, plus camera placement to deter unauthorized entry and preserve evidence after the fact. For media disposal, simple deletion can leave data recoverable, so secure wiping with dedicated software, or physical shredding/drilling, is required. Tamper resistance is a hardware design property — used in IC cards, hardware security modules (HSMs), etc. — where attempting to physically extract an internal secret key (by disassembly or analysis) is detected and triggers self-destruction or data erasure, resisting physical analysis.

Trace a company's review of its data-leak controls to see how technical and physical measures complement each other. An audit revealed that an employee had been uploading files containing customer personal data to a personal cloud storage account. Investigating the cause, the company found it had no mechanism (a DLP) monitoring across multiple channels — email, web uploads, etc. — to detect confidential data leaving the organization, so this exfiltration had gone undetected for a long time. As a remedy, the company deployed a DLP that detects patterns of personal data in file content and automatically blocks outbound transmission, and also implemented device control that, in principle, prohibits connecting USB drives to work devices. Separately, a sales rep's laptop was stolen from a cafe while out on business — but because the entire disk was encrypted (encryption at rest), the thief could not read its contents. This is a good example of how encryption prevented the actual harm of a leak, even though it could not prevent the physical theft itself. Inside the office, there had also been an incident where a visitor happened to glimpse an unlocked screen left unattended, so the company enforced a clear-screen policy and also technically enforced automatic screen locking on stepping away. For the server room, there had previously been a risk of piggybacking, where an unauthorized person could enter right behind a badge-holding employee; the company switched to an anti-passback system requiring each individual to authenticate before the gate opens, improving traceability together with entry/exit logs. Finally, for storage media in servers being returned at lease-end, simple deletion can leave data recoverable, so the company performed secure wiping with dedicated software as well as physical shredding. As this shows, technical controls (DLP, encryption, device control) and physical controls (clear screen, physical access control, media disposal) complement each other's weaknesses.

3.3.3Section summary

• Technical controls: DLP (content-based, cross-channel), encryption (unreadable even after theft), device control (blocks the exfiltration channel)
• Physical controls: clear desk/clear screen (operational rule for stepping away), physical access control (per-individual ID, anti-piggybacking)
• Media disposal requires secure wiping or physical destruction, not simple deletion. Technical and physical controls complement each other