How Can You Implement a Data Loss Prevention Strategy in a Hybrid Work Environment?
Archive note: This article was first published on 15 May 2021. Its password, MFA and VPN guidance has been revised using official guidance checked on 10 September 2026. The original references to recent research, numerical claims and cost comparisons lack verifiable citations and are retained as 2021 archival wording, not current statistics or a validated ranking of risks.
During the pandemic, everyone has been spending more time working from home, and this change is not a passing one! As people have grown used to the convenience of using technology to work remotely, this way of working will only grow, even after the pandemic! For business management, however, this way of working means not only that traditional management models have to change, but also that ensuring data is not lost in remote working environments is a real challenge.
When we think about cybersecurity threats, we often think of external threats and external attacks. That is perfectly normal: after all, when such incidents occur, they easily make the headlines. However, recent research clearly shows that external bad actors are not the most serious risk. A company’s employees often pose a more serious cybersecurity threat. A single small personal mistake by an employee can cause serious damage to the brand. Employees often unintentionally share data on, or store it in, insecure platforms, and the reason they do so is very simple: because that way is more “convenient”, they store their files on the media concerned.
Such improper use, born of a lack of risk awareness, can directly lead to the leakage of confidential company data and, in the long run, may cause the brand financial and reputational damage.
Deploy a comprehensive DLP strategy
To prevent data leaks effectively, implementing an all-round DLP strategy is a workable approach. There are now many different DLP solutions on the market. They mainly learn through big data: when a user performs an action that might lead to a data leak, the solution automatically issues a prompt so that the user can stop and think straight away whether the action in progress would amount to a data leak. In the long run, this changes users’ habits and improves risky user behaviour, so it could be said to reduce the risk of data leaks at source.
Use strong passwords and change them immediately if they are leaked
The 2021 original stated that “more than a third” of employees had not updated their passwords and that “billions” of account credentials had been misused, but gave no verifiable research source; these figures are not presented as current statistics. Under current NIST guidance, passwords should not be forced to change merely because a fixed period has expired; if there is evidence that a password has been leaked or compromised, it should be changed immediately. Companies should help employees use sufficiently long, hard-to-guess passwords and avoid known-leaked or common passwords, and should support password managers and limit failed login attempts. See the NIST password guidance.
Use a VPN where needed and enable multi-factor authentication (MFA)
Depending on their remote-access needs, companies should choose a company-approved and managed VPN or another suitably protected remote-access solution; employees should not use unapproved personal VPNs on their own initiative to handle confidential company data. A VPN only protects the traffic that passes through its tunnel, so endpoint devices still have to be maintained, and VPN clients and servers must be updated promptly. See the NCSC VPN guidance.
In addition, VPN and other remote-access accounts should have multi-factor authentication (MFA) enabled, so that identity is confirmed with two or more different types of authentication factor, reducing the risk of someone logging in with a stolen password alone. Where feasible, phishing-resistant authentication methods should be preferred, such as properly configured FIDO2/WebAuthn solutions that include user verification. Different MFA methods offer different levels of protection, and none can be regarded as a guarantee that phishing or account compromise is completely ruled out. See the NIST guidance on multi-factor authentication and phishing resistance.
Strengthen staff security awareness
In fact, however advanced your tools are, a single “weak link” on the team can quickly bring down the defences you have deployed. Educating employees and raising their security awareness is therefore the most important thing, arguably more important than a defence solution costing millions of dollars! As long as everyone’s security awareness is greatly raised, the risk of data loss will fall accordingly.
