Choosing Endpoint DLP Agents

Monday, June 07, 2010

Danny Lieberman

There is a lot to be said for preventing data loss at the point of use but if you are considering endpoint DLP (data loss prevention), I recommend against buying and deploying an integrated DLP/Anti-virus end-point security agent.  This is for 4 reasons:
  • Bloatware/system resource consumption – if you’re concerned with anti-virus system resource usage, imagine layering another 100MB of software, another 20MB of data security rules and loads of network traffic for management just for the luxury of getting a good deal from Symantec on a piece of integrated software that IT doesn’t know how to manage anyhow.
  • Software vulnerabilities – if you have issues with the anti-virus – you don’t want them affecting your data flows via the DLP agent. Imagine a user uninstalling  the anti-virus and impacting the DLP agent.
  • Diversity – the strong anti-virus products have weak DLP agents – which means that the advantage of a single management platform is spurious. Having strong anti-virus software on your Windows PCs from a vendor like McAfee complements having strong data loss prevention from a company like Verdasys.
  • Not a good fit for the organization – IT manage the Anti-virus,   Security manage the data security and never the twain shall meet.
DLP Psychology or DLP Technology?

Thoughts of change in the way IT and security will operate -

In many corners of the corporate HQ, in fact, there are plenty of execs who, from time to time, would probably take pleasure in watching IT fail, a la Lehman Brothers. …Why the new normal could kill IT..from my colleague - Michel Godet

I believe that there are 3 root causes for why many organizations worldwide do not take a leadership position in enterprise information protection.

  1. Preventing information security events is an admission of weakness. Who wants to spend money on something when the first step is admitting that you’re vulnerable and that your existing security systems, policies and procedures do not meet business requirements?
  2. We live in an age of instant gratification. Need music -go to Deezer. Need security – get a UTM from Checkpoint.  Click on a set of canned DLP policies for PCI DSS 1.2 compliance – never mind that you design and manufacture motorcycles.
  3. The need to walk on the safe side, not on the wild side. Who wants to spend 6-7 figures on an EIP (enterprise information protection) system that requires data discovery from someone who isn’t your accountant, a complex policy implementation by people who need to learn your business, integration with internal procedures and processes with employees who could care less, and buy in from a CEO who is scrappling for survival with the board during the biggest financial crisis in 80 years?
Possibly Related Articles:
Enterprise Security
Data Loss Prevention
Post Rating I Like this!
Ray Tan The top 3 difficulties for people to implement security policy is:

I do not think our security should be relied on an all in one platform, generally speaking, the more software you are installed on your computer, the bigger chance you will be compromised by known or unknown weakness of them.
chris nickerson As a qick test/trial.... use the free stuff. You can get some decent value and try out what it will be like. After that, you can build/test/buy the more glossy and enterprise class solutions.

Check out
The views expressed in this post are the opinions of the Infosec Island member that posted this content. Infosec Island is not responsible for the content or messaging of this post.

Unauthorized reproduction of this article (in part or in whole) is prohibited without the express written permission of Infosec Island and the Infosec Island member that posted this content--this includes using our RSS feed for any purpose other than personal use.