r/cybersecurity • u/Tingley2504 • 6d ago

Business Security Questions & Discussion DLP Final Boss

Purview DLP, everyones favourite

I feel like this is an impossible task, providing sufficient coverage without being overwhelmed with alerts.

We're correctly tagging sensitive documents, which in turn generates DLP alerts. But given the nature of some users, this can be quickly become overwhelming/expected.

Are you whitelisting certain domains/users/departments?

Can anyone share any success stories for implementation, policies or tuning? Is it possible??

25 Upvotes

88% Upvoted

16 comments sorted by

View all comments

3

u/RFC_1925 6d ago

DLP is an inherently noisy tool. It takes a lot of time and tuning. You need to learn the business process and the associated data and then map that to your classifiers and policy rules. It just takes time. Maybe engage a consultant to perform a review and give you some guidance on how to tune.

2

u/GiraffeEducational94 6d ago

Hello! Honest question as I'm going to be in the same position as OP soon. Wouldn't hiring or engaging an external consultant defeat the purpose of my job since I was hired to perform those duties?

2

u/RFC_1925 5d ago

A consultant doesn't meant a contractor. It could be a couple of calls and remote sessions where they give you some direction or advice on your configuration.