The key point here is that any security is only as strong as its weakest link.
Be clear from the start whether you are protecting against:
- inadverent leaks by clueless or forgetful users or
- against intentional leaks by motivated adversaries
The former are easier to protect against. But to design an effective & practical solution against the latter is a very challenging job. Don't let the colorful whitepapers from the Vendor's Sales guys fool you.
I'll illustrate using examples: I've seen organizations spend a lot on network based filtering and flagging solutions only to find after an incident that the guilty party used encryption (making even deep packet inspection moot). In another case encryption was stymied using end point protection running on the client PC's only to discover how this hampers encryption of data that ought to have been legitimately encrypted by the users.
One Firm decided to incorporate a complex hierarchy of role based security where access to many sensitive documents had to be authorized by a second person who was higher up in the hierarchy. In practice, this caused so many operational difficulties that a lot of sensitive documents ended up giving blanket clearances to dozens of guys thereby obviating any usefulness of the system.
In one case all the network and end point solutions seemed in place but mobile devices were not very closely controlled so any motivated adversary could just use those to leak out sensitive data. Even if you are mandating only company issued mobile devices have you disabled USB ports and Bluetooth and even cameras on them?
In some third world leaks I've seen reports where the modus operendi was quite low tech and involved printing lists of clients and other sensitive data and sneaking out actual printouts over an extended duration. Ironically the site actually had security frisking but sadly they were watching for USB keys, cellphones, hard disks and such. Paper printouts were never checked by the security guys.
The point is that a lot of these loopholes can indeed be blocked with some effort but one has to realize that most effective protection strategies will involve the downside of making legitimate use more inconvenient.
There's this convenience versus security trade-off and every organization must decide at what point of this trade-off curve does it want to live at. Even better, your chosen solution should have the granularity to set the right trade-off at site or even department or person level and not some blanket organization wide policy. The latter rarely work out well in practice.
PS. Every vendor will show case the wizardry of its own product but it is important to have a holistic view and the right question often is: Can the very medium this expensive security software is dedicated to protecting be entirely bypassed by an adversary? e.g. Network based protection is of very little use if USB sticks are being allowed