Data-loss prevention is rapidly becoming the next big battlefield in IT security.
Innovative start-ups in DLP, such as Reconnex, Orchestria, Vontu, Provilla and Tablus have been swallowed up by McAfee, CA, Symantec, Trend Micro and RSA (the security division of EMC), respectively, though independents such as Fidelis Security Systems remain, in addition to open source. With acquired strength in DLP, the established security vendors are now determined to use DLP in new ways, by integrating it into storage systems, desktop anti-malware suites and more.
Though deploying commercial DLP still is expensive -- a $US100,000 price tag and up is not unusual -- the process of filtering content to spot leaks of data, intentional or otherwise, shows signs of starting to become commoditized.
"There's a lot of duct tape and glue right now to make this work the way you really want," says Gartner analyst Eric Ouellet of the sophisticated DLP systems on the market today that can watch for sensitive content and block it, or hand it off for encryption before transmission.
Though fairly new, DLP can work remarkably well in detecting sensitive data and issuing warnings or blocking it. But there's still often a lot of manual labor in registering content and defining policies. Businesses shouldn't be jumping into it thinking they can instantly "boil the ocean," Ouellet cautions. Rather, he says they should focus on four or five big categories of data they want to subject to DLP rules. "You have to train the system until you get comfortable with it."
But what may be a somewhat arduous and expensive process today could give way to much more commoditization and ease of use within the next two years, Ouellet adds. That's because security vendors see demand for DLP not just in large organizations, such as the financial institutions and insurance companies where DLP first caught on, often driven by regulatory-compliance concerns, but in any type of business that wants to protect sensitive data.
While Microsoft and Cisco haven't bought DLP start-ups, they're partnering with RSA to use RSA's DLP classification technology. The first fruit of the RSA DLP alliance has been Cisco's just-announced integration of DLP into Cisco IronPort.
"We've been an early adopter of a number of RSA technologies," says Erik Heidt, assistant vice president and manager of information technology at Cincinnati-based Fifth Third Bank, which uses IronPort for gateway e-mail security filtering.
Heidt plans to make use of the DLP capability in IronPort as part of an enterprise-wide DLP strategy, though he acknowledges "it could be time-consuming to get data policies written for this."
Wes Wright, chief technology officer at Seattle Children's Hospital, sees DLP as the next step to augment the encryption, which is based on GuardianEdge, that the healthcare organization recently deployed for endpoint protection. It seems likely the hospital will make the investment in DLP because management is getting behind it.
"You want to be able to set policies on what's allowed, and you want to block," says Wright. The hospital knows where patient health information is stored but having DLP controls on what happens to it after authorized personnel access it would be a big plus.
"I'd do both gateway and endpoint DLP," says Wright, noting he's focusing DLP evaluation efforts mainly on vendor products that can do both.
Despite the challenges of DLP today, it seems likely the enthusiasm for it is going to project DLP way beyond its first-generation existence on the gateway and desktop.
In fact, Ouellet even predicts the future will eventually usher in "the content-aware enterprise" where DLP is seamlessly linked into digital rights management and identity and access management. And DLP could provide the foundation for more efficient e-discovery of electronic records.
That's the vision anyway, and a number of security vendors are eager to embrace it, with pledges of integration with other products frequently heard these days.
"At the end of the day, it's about information control," says Gijo Mathew, vice president of security management at CA. "Once you've analyzed the information accurately, you can do a lot more than just block it. You can tag it for retention and encryption. There's management of that information, and it could be the foundation for e-discovery systems in litigation."