37. Which of the following is the best technical method to protect sensitive data at an organizational level?
Answer: D
Implement a DLP for all egress and ingress of sensitive information on the network.
Implementing a Data Loss Prevention (DLP) system is the most effective technical method to protect sensitive data at an organizational level. A DLP solution actively monitors and controls data transfer across the network, ensuring that sensitive information is not inadvertently shared or leaked.
A) Deny all traffic on port 8080 with sensitive information on the VLAN.
While denying all traffic on a specific port can prevent unauthorized access to that port, it does not provide comprehensive protection for sensitive data. This approach is limited in scope and may inadvertently block legitimate traffic, potentially disrupting business operations without addressing broader data protection needs.
B) Develop a Python script to review email traffic for PII.
Creating a Python script to review email traffic for Personally Identifiable Information (PII) may help identify sensitive data in emails, but it lacks the automation and comprehensive coverage of a DLP solution. This method is also reactive rather than proactive, meaning it will only address issues after they arise, rather than preventing data loss in real-time.
C) Employ a restrictive policy for the use and distribution of sensitive information.
Implementing a restrictive policy is essential for data governance, but on its own, it does not provide the technical enforcement needed to effectively protect sensitive data. Policies require adherence and oversight, and without technical controls like DLP, there is a higher risk that sensitive data could still be mishandled or improperly shared.
D) Implement a DLP for all egress and ingress of sensitive information on the network.
DLP systems provide a robust framework for monitoring, detecting, and preventing the unauthorized transfer of sensitive data. They enforce data protection policies automatically, making them the best technical method for safeguarding sensitive information at an organizational level.
Conclusion
The implementation of a DLP system is superior because it combines technical capabilities with policy enforcement, addressing both the detection and prevention of data breaches. Other options, while they may contribute to data protection, lack the comprehensive, proactive measures that a DLP provides, thus failing to offer the same level of security for sensitive data.