A robust Data Loss Prevention system provides the most directly relevant technical control for preventing and detecting unauthorized transfer of sensitive research information. ECIH ' s insider-threat coverage includes monitoring user activities, identifying anomalous behavior, protecting sensitive information, and implementing controls that reduce opportunities for malicious insiders to remove organizational data. DLP technologies can monitor data at rest, in use, and in transit; enforce policies governing sensitive information; and alert or block suspicious copying, uploading, emailing, or other exfiltration attempts. HR meetings and anonymous feedback mechanisms may help identify workplace dissatisfaction, but they cannot reliably prevent deliberate data theft. Completely restricting all employees from research information is operationally unrealistic and fails to apply access according to legitimate business requirements. DLP therefore provides the strongest targeted control against the type of insider-driven data exfiltration described.

================