I work in a Software Company. Currently, we don't have any security software to secure our data in an employee laptop. Now we want to make a policy where any data stored or created on the company laptop and server must not get outside of the internal network. This includes securing these scenarios:
- Any data from the company laptop not allowed to be copied to USB / External Hard Disk for later copied into their own device.
- Any data cannot be uploaded to the external server through the internet.
- Even if the laptop hard disk is taken off and put on another laptop, it should be unreadable.
On top of these limitations, for any job to be done, we should allow for:
Data can be a copy or moved inside the company internal network
Some document (pdf, word, excel, etc, not source code) can be send through an Email
The employee still can access the internet (maybe limited to some work-related website like StackOverflow, Linkedin, etc)
The employee can be work from home
For this, I listed the following to-do list:
- Installing hard disk encryption software on every laptop and blocking the USB port
- Block any third party software installation
- Prepare a VPN network so the employee can access company internal network through the internet
I still cannot figure out how to prevent employee uploading data to cloud storage like google drive, etc. Is my current solution is correct? or there are other approaches to implement this kind of policy?