Myth No. 5
Information leak prevention technology is complicated and expensive; it's not worth it to install.
Every organization is different and the potential cost of a leak varies. However, much research has been done, analyzing the experiences of such victims as TJX, which recently set aside $118 million to address its breach. Forrester Research quantifies the cost of losing customer information between $90 and $305 per record, depending on the type of information lost and the business. However, customer information represents only a portion of what most of us see leaked daily. Confidential information, such as M&A plans, earning reports and intellectual property can have a far greater impact on the business if leaked. It's up to each company to conduct a risk management assessment to quantify the expected cost of a breach. From there, companies can determine whether implementing information controls such as information leak prevention technology are justified—in most cases they find that it is.

Myth No. 6
My employees understand what they can and can't send out of the company.
Most employees don't intentionally leak information and, given the right training and education combined with information leak prevention technology, the risk of data leaks diminishes significantly. However, the majority of employees don't know their company's policies. Employees often don't understand why sending work home through Web mail is risky or why password protection is important. In an increasingly mobile work environment, employee training is even more important.

Best practices for employee education begin with communication. Employees should be given training during their new hire orientation, followed up with annual refresher courses that teach them what information can be accessed and how it can be used. The second step is to use technology to provide continued education and policy reinforcement in an automated capacity. For example, with an information leak prevention solution, managers can have an automated message sent to employees who have violated a policy. The message lets them know why the communication was in violation of a policy and encourages them to act differently in the future.

Myth No. 7
Information leak prevention technology will hinder my business operations.
Contrary to what many CIOs think when they hear the words "information leak prevention," the right solution can actually improve business processes. If you implement a product that has the context of what the data is, who is sending it and its intended destination, information owners can be notified when a violation is triggered, without IT's involvement, reducing administrative overhead while reinforcing the principle that the problem of information leakage can and must be addressed within the business units themselves.