Data loss prevention products

Data Loss Prevention (DLP) is a computer security term referring to systems designed to detect and prevent the unauthorized transmission of information from the computer systems of an organization to outsiders. It is also referred to by various vendors as Data Leak Prevention, Information Leak Detection and Prevention (ILDP), Information Leak Prevention (ILP), Content Monitoring and Filtering (CMF) or Extrusion Prevention System by analogy to Intrusion-prevention system.

Background

Organizations process information that can be often classified as sensitive, either from a business or legal point of view. In addition to risk of intrusion and gaining access to sensitive information by unauthorized persons, there's also risk of intentional or spontaneous transmission of the information to the outside of organization.

; Regulatory compliance: Many large companies now fall under oversight of government of commercial regulations that mandate controls over information, including HIPAA in health and benefits, GLBA and BASEL II in finance, and Payment Card Industry DSS standards. Some of these regulations stipulate a regular information technology audit, or commonly known as IT audit, which organizations can fail if they lack suitable IT security controls and due-care (processes) standards. Companies with enterprise resource planning erp software (e.g., SAP and Oracle Corporation find compliance especially challenging (see erm or enterprise risk management. Others mandate significant penalties in the event of a breach.; New costs arising from breaches: Loss of large volumes of protected information has become a regular headline event, forcing companies to re-issue cards, notify customers, and mitigate loss of goodwill from negative publicity.

Government and industry regulations are arguably the biggest influencers. Besides HIPAA, GLBA, and Sarbanes-Oxley, more than 25 states have passed data privacy or breach notification laws that require organizations to notify consumers when their information may have been exposed. One high-profile example is California SB 1386. The state of Tennessee has also passed the "Credit Security Act of 2007," which will result in a Class B misdemeanor for any use of a person's SSN in "direct mailings" or over the Internet.

Types of DLP systems

Network DLP

Also referred to as gateway-based systems. These are usually dedicated hardware/software platforms, typically installed on the organization's internet network connection, that analyze network traffic to search for unauthorized information transmissions. They have the advantage that they are simple to install, and provide a relatively low cost of ownership. Because decoding network traffic at high speed is extremely complex and difficult (transmitted objects are broken into small parts, often encoded, and then mixed with other traffic), Network based systems typically integrate with or include technologies to discover information 'at rest' while it is stored in file systems and databases. Discovering sensitive data at rest is far simpler and less time critical, thereby allowing greater levels of accuracy. Taking 'signatures' of data identified at rest, and then looking for such signatures as data passes over the network boundary, is a technique favored by virtually all Network system vendors to improve accuracy, and to identify sensitive data that would otherwise be missed. [ [http://secude.com/htm/823/en/White_Paper%3A_Secure_Single_Sign-on_for_SAP.htm Digital Signature Using SAP NetWeaver] ]

Host-based DLP systems

Such systems run on end-user workstations or servers in the organization. Like network-based systems, host-based can address internal as well as external communications, and can therefore be used to control information flow between groups or types of users (eg 'Chinese walls'). They can also control email and Instant Messaging communications before they are stored in the corporate archive, such that a blocked communication (ie one which was never sent, and therefore not subject to retention rules) will not be identifed in a subsequent legal discovery situation.

Host systems have the advantage that they can monitor and control access to physical devices (such as mobile devices with data storage capabilities) and in some cases can access information before it has been encrypted. Some host based systems can also provide application controls to block attempted transmissions of confidential information, and provide immediate feedback to the user. They have the disadvantage that they need to be installed on every workstation in the network, cannot be used on mobile devices, or where they cannot be practically installed (for example on a workstation in an internet café).

Some intrusion prevention systems utilize "pattern matching" rules, while others utilize "exact copies" of sensitive data and/or text in order to determine when a potential breach is occurring.