Case Study: TLC Vision Takes A Risk-Based Process Approach To Data Leak Prevention

TLC Vision, a provider of eye-care tools and technologies in North America, faced a dilemma in 2005: how to protect the confidential information of more than 1 million patients and physicians. An erroneous email and regulatory pressures first drove the firm to focus its data leak prevention (DLP) efforts on email and other messaging applications. TLC Vision believes in a step-by-step approach to DLP, starting where it hurts most; thus, the company plans to next use DLP on the desktop of executive laptops to guard against leaks via removable media and to continue from there to gradually expand coverage to other high-risk areas and devices. TLC Vision considers data leaks to be broken business processes and thus doesn't want to rely on technology alone; it plans to educate users as if no technological countermeasures were in place while simultaneously using a DLP solution to plug the technological holes and enforce policy.