Powered By InformationWeek Business Technology Network
 
Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

What You Really Need To Know About Data Loss Prevention

A short explanation of what DLP is -- and what it isn't

Feb 06, 2009 | 04:53 PM

By Tim Wilson
DarkReading

First in a series of 500-word primers on security for readers with short attention spans -- and the IT people who need to get through to them

The first thing you should know about data loss prevention (DLP) technology is that it doesn't actually prevent data losses. The presence of DLP in your organization will not stop a determined employee from photocopying your customer lists or taking a picture of your secret product plans. However, if you're worried about sensitive data leaving your corporate networks or computer systems, DLP can help.

In a nutshell, DLP is a type of software that is designed to seek out sensitive data -- either traversing the network or sitting idle on your computer systems -- and enforce policies for handling it. If a user attempts to send out sensitive data via email, post it to a Website, or copy it to a USB storage drive, DLP technology can identify that activity and record it.

More important, most DLP applications are also designed to prevent the user from executing tasks that might compromise the data or cause it to leak out to unauthorized sources. The DLP software might turn off the "write" capability that would allow a PC to copy certain data to an external storage device, or it might disallow an email user from sending the data to another user.

In addition, most DLP systems will also notify the appropriate parties about activity surrounding sensitive data. It may inform the user that his attempted actions are illegal, and it may inform management or IT security personnel that the action occurred so that the user can be corrected or smacked upside the head.

Most DLP technology works via "deep content inspection," which means it can read data to identify specific words, terms, or characteristics that indicate sensitivity. For example, most DLP tools can recognize Social Security numbers, phone numbers, or other data formats that might suggest the presence of private information that shouldn't be shared. Even better, DLP tools can be "taught" to recognize words, phrases, and data formats that might indicate the presence of company-specific information, such as customer numbers, manufacturing designs, or even words and phrases that might relate to intellectual property or business plans.

Some DLP products analyze data only while it is in motion -- usually as it travels across the network -- while others focus more on discovering data at rest, sitting on servers or clients. Some can only prevent specific types of transmission, such as email, while others have a broader range of capabilities. However, most experts agree that the most important element of a DLP tool is its ability to do discovery of sensitive data. If it finds too many false positives -- data that is identified as sensitive but isn't -- or false negatives, a DLP tool won't be very effective in preventing data loss.

If your organization hasn't implemented DLP yet, not to worry; you're not behind. Most reports indicate that fewer than half of large enterprises have DLP in place, and some say that figure is not even 25 percent. However, most reports also say that a majority of companies, including some 68 percent of companies in the U.S., plan to have DLP technology implementations in place by the end of 2009.

For more information, read:

  • "Data Loss Prevention: Where Do We Go From Here?
  • "Why Your Organization Needs To Implement DLP."

    Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message


    • Subscribe to RSS



    Insider Threat Reports

    report Inside Out: Protecting Your Partnerships -- and Your Data
    Today's businesses depend on e-commerce among partners, but allowing third parties to access internal networks may endanger your data. How can IT security pros ensure that contractors, supplies and others get the access they need -- without becoming threats? This report offers some answers.

    report Rotten Apples: How To Detect And Stop Malicious Insiders In Your Organization
    Most data leaks are unintentional - but in every enterprise, there are a few hard cases that defy this truism and threaten the very heart of your data.What can you do to stop these rotten apples from using their intimate knowledge of your organization - and its data access methods - to wreak havoc? This report offers a detailed look at how malicious insiders might attack your data, how they’re motivated, and what you can do to stop them.

    report Understanding The Insider Threat
    Think you know your trusted users? Think again. The availability of new Internet technologies and the pressures of a spiraling economy are changing the nature of the data breach, and your employees may have their fingers on the trigger. This report offers a look at the full spectrum of insider threats, and the risks associated with each.

    Other reports from the Insider Threat Tech Center:

    Related Content

    Anatomy of Insider Risk: Why You Could Be Your Worst Enemy
    Organizations are typically aware of the problems they face from inside the firewall, but so many leaders focus on the risk of thieves and disgruntled employees that they leave too much room for error from the much more common insider threat: well-meaning, but negligent, insiders. Learn four steps to minimizing the risk.

    Three Ways to Prevent USB Insecurity in Your Enterprise
    As the advances in USB devices have made them invaluable to most business users’ workday processes, they have also exposed their organizations to three enormous risks: data loss, data theft and malware propagation. Learn how removable device policy enforcement can mitigate these risks while enabling managed use of these necessary productivity tools.

    Medical Records on the Run: Protecting Patient Data with Device Control and Encryption
    The convenience of putting medical records online enables healthcare professionals to provide more collaborative and knowledgeable care, but the more pervasive electronic health information becomes, the more of a risk it poses. Learn how to take advantage of the benefits of putting medical records online while effectively managing the risk.

    The Great Balancing Act: Using USB Flash Drives in Government Environments
    USB flash drives are a valuable tool in a government staffer’s virtual toolkit, but if left unmonitored they potentially introduce dangerous malware. Learn strategies for implementing a policy for secure USB use that will help prevent potential data loss, data theft, malware propagation and hacking.