# On Data Leakage Prevention Maturity: Adapting the C2M2 Framework
## 2 Materials and Methods
### Input Knowledge
#### 2.2.3 Persistent Challenges in DLP  
Theoretical perspectives position DLP as a crucial component of a comprehensive cybersecurity risk mitigation strategy. In practice, however, the implementation of DLP systems is associated with substantial costs, not only in initial deployment but also in continuous configuration and maintenance ([30], p. 218). Although the primary focus of this article is on the technical aspects of DLP, it is imperative to acknowledge that DLP encompasses a broader spectrum of issues. These additional considerations, vital for a holistic approach to DLP, have been extensively explored in the literature [31, 32]. Thismultifaceted nature of DLP underscores the need for an integrated strategy that extends beyond mere technical solutions to include organizational, procedural, and human factors. At first, identifying accurate true positive events for DLP alarms is a complex and non-trivial task. It demands a comprehensive understanding of the organization's unique context, including its various departments and operations. This process often requires an experienced DLP analyst to meticulously define a range of exceptional cases, which can be extensive and intricate. Their expertise is crucial in finely tuning DLP systems to effectively distinguish between legitimate and malicious data transactions, thereby ensuring both security and efficiency. Secondly, the task of establishing effective thresholds to minimize false positives in DLP systems presents a significant challenge, arguably more complex than defining true positives. Security teams are often caught in a difficult balancing act: on one hand, they can set less sophisticated filters, which, while reducing the number of false positives, run the risk of missing genuine threats (a high-risk appetite). On the other hand, they face the Base-Rate Fallacy [33], a well-documented phenomenon in intrusion detection systems that is equally relevant to DLP. This fallacy highlights the difficulty in accurately detecting rare events in a sea of non-events, leading to a high volume of false positives. Configuring an efficient DLP rule set for identifying both true and false positive events is a complex and nuanced process, especially in varied email-based scenarios. For instance, consider the case where employees send sensitive documents to personal email addresses. While this might initially appear as a straightforward true positive, the reality can be more complex. Many organizations, aiming to save on postal costs, routinely send encrypted emails to employees' personal addresses or have documents sent to business emails which are then forwarded or printed out. Further complicating matters, specific sectors like banking might regularly send sensitive, encrypted data to clients, such as wealthy private customers requesting encrypted Excel files. Additionally, human resources departments frequently exchange sensitive information with a large and diverse pool of applicants. While technological solutions exist for these scenarios--like exact data matching for identifying large volumes of sensitive data, OCR for text recognition in scanned documents, allow-lists for different departments, and encryption gateways and deep packet inspection for analyzing encrypted traffic--the maintenance and continuous adjustment of a DLP rule set to accurately differentiate between legitimate and illegitimate data transfers is immensely challenging. The effort required to effectively manage, investigate, and handle both true and false positives in such dynamic environments can be substantial, reflecting the intricate balance between robust data protection and operational practicality. In current practice, managing the complexities of DLP policies typically requires considerable effort, with most organizations facing a trade-off. Either they accept a higher risk of false negatives or adopt a conservative approach that leads to numerous false positives, necessitating significant investment in DLP.