I was talking to yet another contact today who reinforced that almost no one is sniffing SSL traffic when they deploy DLP.
That means…
- No monitoring of most major webmail providers.
- No monitoring of many social networks.
- No monitoring of Dropbox or other cloud storage services.
- No monitoring of connections to any site that requires a login.
Don’t waste your money. If you aren’t going to use DLP to monitor SSL/TLS encrypted web traffic you might as well stick to email, endpoint, or other channels. I’m sure no one will siphon off sensitive stuff to Gmail. Nope, never happens. Especially not after you block USB drives.
Reader interactions
7 Replies to “The Black Hole of DLP”
Another hole ….
when a DLP is not able to detect something encrypted has been sent …
I do not care to be able to read in clear but al least the DLP system shoulb be allowed to trig an alarm because it is suspicious so based on the frequency, the size, the job function, etc … we can know if something “wrong” happen !
Vincent
Until recently, I was the sales engineer for a major DLP vendor in Australia.
The majority of my major customers absolutely DID perform SSL inspection, usually using Bluecoat.
Chris,
I didn’t say “buy DLP”, I said, “if you are going to monitor the network with DLP, look inside the SSL traffic”.
Big difference. If you care about it, do it right. Also, DLP is used for more than breaches.
Oliver,
That’s fine if you can get away with it, but fewer and fewer organizations are taking that approach.
http://www.verizonenterprise.com/DBIR/2013/
“I’m sure no one will siphon off sensitive stuff to Gmail. Nope, never happens. Especially not after you block USB drives.”
While ‘never’ wouldn’t be the accurate term, ‘negligible’ would appear to be proper here. Does somebody have a DIM or egress monitoring agenda? Hmmm..
Many of our customers have blocked web-mail, social networks and cloud storage due to regulatory requirements anyway. So inspecting SSL traffic with DLP would be in this case a waste of effort.
It’s unfortunate that Chrome permits user-installed CAs to override public key pins.