A copy of a highly confidential salary report was recently found on a printer in the IT department. The human resources department does not have this specific printer mapped to its devices, and it…

While a Data Loss Prevention (DLP) solution can identify and prevent unauthorized data exfiltration, implementing and configuring it to classify the report and restrict access might not be the most immediate or direct technical control to prevent initial unauthorized access to the share itself.

Restricting access to the file share where the report resides to only authorized human resources employees and managers directly implements the principle of least privilege. By modifying share and/or NTFS permissions, unauthorized IT personnel are immediately prevented from browsing to or accessing the confidential file, thereby stopping them from printing it.

Having IT department members review and sign policies is an administrative control focused on deterrence and accountability, not an immediate technical control that prevents unauthorized access to a file share.

Placing HR computers on a restricted VLAN and configuring ACLs primarily protects the HR network segment from unauthorized network traffic to those specific machines, but it does not prevent an IT employee from accessing a file share located on a different server from their own workstation if they have permissions.