As for technical solutions, move to a system of least priviledge and need to know, which will mean managment overhead, but no user would have read rights unless specifically granted the right to the file. These are extreme, and costly, and still will not fully prevent the loss of information, if the person really wants to exfiltrate information.Ī simple solution is to make sure it covers those areas, and persue them to the fullest extent of the law.

The work computers do not have internet access, and if you need to access say 'Google' you are walking somewhere else to access google, and the information has to be either printed there, or written down on paper. Such as government agencies that may deal with this, will often not allow any electronic device within the building, no cell phones, no USB keys, not even radios, some now even use body scanners. Organizations that do prevent it, the sites are super locked down, not just on the network, but also physically.

There's are programs that can do this, but they don't fully prevent it.

Code42 data loss prevention