eWeekNews: Discovery Features Make DLP Smarter... really?

Lawrence Walsh's article (eWEEKNews, 2009-05-29) entitles "Discovery Features Make DLP Smarter" made me both scratch my head and chuckle a little. It's a story I've heard many times, and in fact commented on a few days ago in my blog notes entitled 'Vendor Hype'. In this case, it didn't take long to see something in the news about the one very item that I always think about when I think about vendor hype. Sorry Larry. You know I love ya!

Over the past several years (since 2004?) I've been keeping a close eye on the DLP space. This for many reasons. First if they can ever figure out how to go beyond SSNs, credit card numbers, and a few other key pieces of PII without the high false positive rate, this solution would be an absolute win. I'm not saying PII isn't important, but PII can be found using MANY tools, not just the expensive solutions offered by Vontu, Reconnix, and a half dozen others out there. There's something good that comes with these solutions (don't get me wrong!) but it is very simply this --they can find simple strings in moving data that they can flag on to tell you when something is leaving the enterprise that probably shouldn't.

I chuckle because one vendor in particular took a host based approach --Verdasys --to finding data and watching it move, while the rest seemed to believe they could do a better job of flagging it in motion. Now it appears they're heading in the same direction. The network based tools want to do host based detection/protection, while the host based providers want to start moving in the direction of the network.

That said, I polled several reference customers of a couple of DLP vendors. Not one of them reported their DLP vendor having done great jobs in the areas not considered their sweet spot. The network providers don't do host based work well.

Hunting critical information to effect its protection? This is a task not easily performed. Here's why... even in a small environment, data doesn't always sit where you think it should. While shares and repositories are likely places you'd want to find source code, work product, finished proposals, PII, or anything else you might consider important they almost always sit on the users computers and in many cases, private backup disks and other removeable media. Another critical issue --I've worked in LARGE enterprise (100,000+ users) for the last several years. One thing that troubles me in large enterprise is that most times the owners of those environments have no idea, nor any accounting, for where critical information resides. This is especially true of any company who's growth came from the heavy acquisition strategy used in the '90s!

OK, it's easy to be negative. Here's what I'd like to see to solve the problem:

1. DLP vendors need to consider integrating spiders into their applications that can do pattern matching in an attempt to flag data in a data classification schema. Once this is performed, do a bucket analysis of each of the different flags and let a human review the schema to ensure it's accuracy, and how the data should be protected. Use company policy (if it exists) to enforce as needed.

2. Performing hash value calculations on anything in a database and then watching them leave the enterprise isn't an effective solution. First, as I mentioned above, it's rare to know where everything resides. Second, documents have lives of their own. Hash values will change every time the document changes. It's impractical.

3. Consider integrating with digital rights management solutions. DRM DOES tagging, as well as offers access credentials. By integrating DRM solutions into DLP, you get the best of both worlds without having to build another solution.

DLP vendors need to think about partnering to offset some of their gaps. One does host based protection well. Others do network based protection well. Stop trying to be something you're not and pair up!

As always, feedback welcome! Mine is only one opinion :)
Jeff