Data Leak v Data Loss: What’s The Difference?

What You Need To Know About Data Loss, Data Leaks, and Data Breaches

Ransomware. It’s a word that I’m almost as tired of hearing as “…due to the pandemic…” and “new normal”. But it’s also a word that finally brought the importance of cybersecurity into sharp focus for many school districts. It’s a word that caused many non-tech district administrators to actually feel the loss of data loss.

But when it comes to protecting privacy, identity, and money, data loss isn’t the only culprit. Nor is ransomware the only menace. In fact, far more sensitive data is exposed via data leak than data loss—ransomware-caused or otherwise.

What is data leak v data loss? Are they related, and should you be concerned about leaks? Let’s take a look at the differences between data leaks and data losses, and what you can do to prevent both.

Data Leak v Data Loss

The terms data leak and data loss are often used interchangeably. They are closely related, but are used to describe different types of data exposure, how they happen, and the impacts that they have.

The main thing that connects them is that they’re both bad for security and privacy, and you definitely want to prevent them to protect your district!

What is a data leak?

Data leaks are usually caused when members of your staff (and sometimes students) expose data in a way that is unauthorized and inappropriate in terms of compliance with data privacy laws. These data privacy laws include regulations like FERPA and HIPAA, and may also include state student data privacy laws that you’re required to follow and in many cases report inappropriate data exposure.

The risk of data leaks in your system is commonly referred to as insider DLP risk. The risk of data leaks v data loss is actually much higher. It most often occurs when a staff member sets the sharing permissions to global sharing on a document or spreadsheet, which allows anyone on the internet to find it.

We’ve also seen examples of staff members attaching files containing sensitive information to an email, and then accidentally emailing it to people who shouldn’t have access to that data. This is another fairly common example of data leaks in schools.

Data leaks are almost always the result of accidents or simple ignorance that sharing settings have consequences.

What is a data loss?

Data loss, on the other hand, refers to when data is somehow removed from your system completely and cannot be recovered or has left your controlled environment through unauthorized access and malicious intent.

Data loss doesn’t just refer to cybersecurity attacks. It can also occur by corruption, deletion (either accidentally or intentionally), or physical damage to the storage device. An example might be if you have data stored on a local server and there is a flood in the server room that damages the devices beyond repair.

But data loss can also occur by intentional, malicious actions. For example, the data loss problem that’s on top of everyone’s minds right now is school ransomware attacks.

What about data breaches?

Data breaches are closely related to data leaks and data loss but are a separate problem.

A data breach is typically going to be the result of an intentional, persistent attack by a cybercriminal on your data system. It refers to an attacker’s ability to breach or infiltrate, your system. It refers to the act of getting into your data system, versus data leaving your system.

It’s important to understand that a data leak can lead to a data breach, which can then result in data loss.

Preventing Data Leaks and Loss in the Cloud

According to our recent survey of K-12 edtech decision-makers, over 94% of school districts are now using cloud applications like Google Workspace, Microsoft 365, Canvas, Zoom, and many more. 41% of survey respondents reported that they use both Google and Microsoft 365 in their districts.

69% of districts are either currently using or are planning on moving to cloud-based human resources systems, 64% for managing financial information, 73% for student information systems, and 86% for learning management.

Because schools are using cloud applications for so many areas of their operations, cloud application security is critically important to preventing both data leaks, loss, and breaches.

7-Step Data Loss Prevention Framework

Protecting your district’s sensitive data from loss and leaks can feel daunting, particularly if you’re a small technology department with limited resources. But, it’s important to understand that data leak/loss prevention is a regulatory requirement—even for school districts.

This data loss prevention checklist will help you start to plan and tackle your own DLP strategy:

1. Inventory: analyze & categorize: Determine what types of information you have in your district’s information systems and categorize them by their level of sensitivity (and need for protection).
2. Regulatory compliance: Understand and determine what laws your district needs to comply with when it comes to securing and protecting student, staff, and financial information. These can include federal and state laws, depending on where you’re located.
3. District business information: Data loss/leak prevention isn’t just about student data privacy! Don’t forget to properly secure district business information, such as financial information, vendors and contractors, and HR information
4. Internal processes & vendor selection: Document your internal processes and policies for handling and sharing data. Then, if applicable, select a data loss prevention software vendor to help monitor and automate them.
5. Building automated dlp rules & policies: Build your documented rules and policies into your data loss prevention platform.
6. Educating your team: Share data loss prevention rules and policies with district staff and faculty. Educate them on why data security and DLP are important for your community.
7. Monitor & strengthen: Continually monitor your DLP rules, policies, and remediation automation to make sure your platform is working well for you.

Next week, we’re going to look at how to prevent data loss and leaks in your district’s cloud apps, like Google Workspace and Microsoft 365. In the meantime, you can download this free Cloud App Security Checklist to get a head-start on making sure your data loss/leak prevention settings are properly configured.