DLP/ILP/Extrusion Prevention < CMF < CMP < SILM: A Short Evolution of Data Loss Prevention
As I mentioned just a couple days ago, there’s a bit of debate and confusion surrounding leak/loss prevention technologies and what the heck to call these things. I did some thinking on the problem and here’s one way of looking at things. This is just a bit of brainstorming in public and I’m sure it will change over time. Today we have Data Leak/Loss Prevention (DLP)/Information Leak/Loss Prevention (ILP)/Extrusion Prevention all describing essentially the same technology. I used to call this CMF: Content Monitoring and Filtering, but I realized that’s probably a better description for stage two of these products. Data Loss Prevention (DLP) product are predominantly network based, or at least have their roots as network products, although a few endpoint products have appeared lately. They monitor communications traffic for policy violations and generate alerts or (in some cases) block inappropriate use of content. Detection techniques are content-aware; meaning the actual content is scanned using a variety of techniques such as rules-based (regex for credit card numbers) or partial document matching. DLP can easily be a feature of other products, as Hoff constantly likes to emphasize. The key to DLP is this content awareness and some sort of central policies. Content Monitoring and Filtering (CMF) is where the leading products are today, and where the rest are headed. It includes what I described as DLP but goes further. CMF products include data at rest features, like content discovery, and may include an endpoint agent. You have to have full network capabilities to be a CMF product. Endpoint only products aren’t able to protect both managed and unmanaged systems, since you can’t guarantee that everyone has the agent. CMF integrates with email for filtering/quarantine/encryption/etc., and at a minimum can block email and web/FTP traffic, while monitoring all communications channels. There is a dedicated policy management and workflow interface; it can’t just be an extra widget on a UTM box or endpoint suite. Content Monitoring and Protection (CMP), which I shamelessly stole from Hoff, is where leading products should be within 1-2 years, 3 on the outside. It’s the full expression of where this is headed- in the middle sits a dedicated policy, management, and workflow server with agents or some other integration to fully protect data in motion, at rest, and in use. All components are fully content aware using advanced techniques that are more than just regular expressions or basic cyclical hashing (for partial document matching). The CMP product doesn’t need to “own” any of the monitoring and enforcement points; it’s the central management for protecting content and we should expect to see a lot of partnership and maybe even an open standard or two that will get ignored. Endpoint agents are integrated with Enterprise Digital Rights Management (EDRM), finally helping that boondoggle of a technology actually work in the real world. It also bridges some of the protections applied from structured to unstructured data. There’s a lot more to say on this, but for space’s sake we’ll save it for another day. Secure Information Lifecycle Management (SILM) is probably nothing more than a fantasy. It would be the ultimate integration of CMP with ILM; bridging security and information management seamlessly. It’s a security plane layered with ILM. The level of complexity to pull this off is astounding, and while it might happen in the distant future I’m not holding my breath. I just don’t see the security guys and the data management folks getting together tightly enough to present a unified buying center, thus no unified product. These are just some thoughts I’m playing with, but I see this as a way of distinguishing DLP “features” from dedicated solutions, while showing how the technology will evolve. It’s the content awareness that’s really key, and if that can’t keep up with our needs none of this will go anywhere. Share:
