Data-loss prevention is rapidly becoming the next big battlefield in IT security.
Innovative start-ups in DLP, such as Reconnex, Orchestria, Vontu, Provilla and Tablus have been swallowed up by McAfee, CA, Symantec, Trend Micro and RSA (the security division of EMC), respectively, though independents such as Fidelis Security Systems remain, in addition to open source. With acquired strength in DLP, the established security vendors are now determined to use DLP in new ways, by integrating it into storage systems, desktop anti-malware suites and more.
Though deploying commercial DLP still is expensive — a $100,000 price tag and up is not unusual — the process of filtering content to spot leaks of data, intentional or otherwise, shows signs of starting to become commoditized.
“There’s a lot of duct tape and glue right now to make this work the way you really want,” says Gartner analyst Eric Ouellet of the sophisticated DLP systems on the market today that can watch for sensitive content and block it, or hand it off for encryption before transmission.
Though fairly new, DLP can work remarkably well in detecting sensitive data and issuing warnings or blocking it. But there’s still often a lot of manual labor in registering content and defining policies. Businesses shouldn’t be jumping into it thinking they can instantly “boil the ocean,” Ouellet cautions. Rather, he says they should focus on four or five big categories of data they want to subject to DLP rules. “You have to train the system until you get comfortable with it.”
But what may be a somewhat arduous and expensive process today could give way to much more commoditization and ease of use within the next two years, Ouellet adds. That’s because security vendors see demand for DLP not just in large organizations, such as the financial institutions and insurance companies where DLP first caught on, often driven by regulatory-compliance concerns, but in any type of business that wants to protect sensitive data.
While Microsoft and Cisco haven’t bought DLP start-ups, they’re partnering with RSA to use RSA’s DLP classification technology. The first fruit of the RSA DLP alliance has been Cisco's just-announced integration of DLP into Cisco IronPort.
“We’ve been an early adopter of a number of RSA technologies,” says Erik Heidt, assistant vice president and manager of information technology at Cincinnati-based Fifth Third Bank, which uses IronPort for gateway e-mail security filtering.
Heidt plans to make use of the DLP capability in IronPort as part of an enterprise-wide DLP strategy, though he acknowledges “it could be time-consuming to get data policies written for this.”
Wes Wright, chief technology officer at Seattle Children’s Hospital, sees DLP as the next step to augment the encryption, which is based on GuardianEdge, that the healthcare organization recently deployed for endpoint protection. It seems likely the hospital will make the investment in DLP because management is getting behind it.
“You want to be able to set policies on what’s allowed, and you want to block,” says Wright. The hospital knows where patient health information is stored but having DLP controls on what happens to it after authorized personnel access it would be a big plus.
“I'd do both gateway and endpoint DLP,” says Wright, noting he’s focusing DLP evaluation efforts mainly on vendor products that can do both.
Despite the challenges of DLP today, it seems likely the enthusiasm for it is going to project DLP way beyond its first-generation existence on the gateway and desktop.
In fact, Ouellet even predicts the future will eventually usher in “the content-aware enterprise” where DLP is seamlessly linked into digital rights management and identity and access management. And DLP could provide the foundation for more efficient e-discovery of electronic records.
That’s the vision anyway, and a number of security vendors are eager to embrace it, with pledges of integration with other products frequently heard these days.
“At the end of the day, it’s about information control,” says Gijo Mathew, vice president of security management at CA. “Once you’ve analyzed the information accurately, you can do a lot more than just block it. You can tag it for retention and encryption. There's management of that information, and it could be the foundation for e-discovery systems in litigation.”
In January, CA acquired start-up Orchestria and has renamed the gateway and desktop monitoring product CA DLP. CA DLP is integrated with encryption products from Voltage, PGP and BitArmor so data tagged as sensitive can be automatically handed off to be scrambled before transmission, if it’s not blocked.
“CA is very big in identity and access management,” says Mathew, noting DLP can be tied to CA's identity management product or anything LDAP enable such as Microsoft Active Directory to set DLP policy. If there's a weak point in DLP today, says Mathew, it's that DLP can’t read encrypted documents. “If it can’t read it, it can’t analyze it to block it.”
Hundreds of customers use CA DLP, including Bloomberg, which includes it with their terminals, says Matthew, and even competitor Symantec in the past OEMed Orchestria for content-filtering in Symantec Enterprise Vault.
Symantec acknowledges that's the case but prefers not to discuss that, and instead points toward the security firm's own future plans for Symantec DLP, based on its Vontu acquisition.
What was once Vontu is now called Symantec DLP Discover, Monitor, Prevent and Management with about 300 corporate and government customers using it, says Rob Greer, Symantec’s senior director product management for data-loss prevention products.
Symantec has integrated DLP into its BrightMail e-mail security gateway. There’s also been integration with the Symantec Altiris management software. Altiris v. 7 can be used to deploy and troubleshoot endpoint DLP Prevent and Discover agents.
“Today with the workflow capabilities of Altiris, we can communicate between an endpoint DLP agent and Symantec Endpoint Protection agent,” says Greer.
This capability can be used to solve problems, he notes.
“Say an end user on a laptop is about to check out for the day and copy the crown jewels of the business,” Greer says. “We could today identify that action is occurring, block it with the endpoint DLP, the incident gets recorded in the DLP system, and a message sent to Altiris to lock down that USB drive and doesn’t let anything leave that laptop until the issue is resolved.”
Although today Symantec isn’t at liberty to discuss specific future plans, Greer said work to integrate DLP into Symantec storage systems can be expected. Symantec DLP Discover, for example, has already been integrated into Backup Exec System Recovery. And Symantec intends to introduce some open APIs for DLP.
Arch-rival McAfee is also out on the DLP battlefield, having acquired start-up Reconnex at the end of last year and now has about 500 DLP corporate customers, according to Mike Siegel, McAfee’s senior director of product management.
McAfee’s Host Data Loss Prevention and Network DLP Prevent and Monitor all work with McAfee’s flagship ePolicy orchestrator console, and the host DLP is integrated with McAfee's SafeBoot encryption software to invoke encryption of sensitive data.
