Blog

Quick Wins with DLP Light: Technologies and Architectures

By Rich

DLP Light tools cover a wide range of technologies, architectures, and integration points. We can’t highlight them all, so here are the core features and common architectures. We have organized them by key features and deployment location (network, endpoint, etc.):

Content Analysis and Workflow

Content analysis support is the single defining element for Data Loss Prevention – “Light” or otherwise. Without content analysis we don’t consider a tool or feature DLP, even if it helps to “prevent data loss”.

Most DLP Light tools start with some form of rule/pattern matching – usually regular expressions, often with some additional contextual analysis. This base feature covers everything from keywords to credit card numbers. Most customers don’t want to build their own rules, so the tools come with pre-built policies, which are sometimes updated as part of a maintenance contract or license renewal. The most common policies identify credit card data for PCI compliance, because that drives a large portion of the market. We also see plenty of PII detection, followed by healthcare/HIPAA data discovery – both to meet clear compliance requirements.

DLP Light tools and features may or may not have their own workflow engine and user interface for managing incidents. Most don’t provide dedicated workflow for DLP, instead integrating policy alerts into whatever existing console and workflow the tool uses for its primary function. This isn’t necessarily better or worse – it depends on your requirements.

Network Features and Integration

DLP features are increasingly integrated into existing network security tools, especially email security gateways. The most common examples are:

  • Email Security Gateways: These were the first non-DLP tools to include content analysis, and tend to offer the broadest policy/category coverage. Many of you already deploy some level of content-based email filtering. Email gateways are also one of the main integration points with full DLP solutions: all the policies and workflow are managed on the DLP side, but analysis and enforcement are integrated with the gateway directly rather than requiring a separate mail hop. Depending on your specific tool, internal email may or may not be covered.
  • Web Security Gateways: Some web gateways now directly enforce DLP policies on the content they proxy, for example preventing files with credit card numbers from being uploaded to webmail and social networking services. Web proxies are the second most common integration point for DLP solutions because, as we described in the Technical Architecture section, they proxy web and FTP traffic and make a perfect filtering and enforcement point. These are also the tools you will use to reverse proxy SSL connections to monitor those encrypted communications, which is a necessity for scanning and blocking inbound malicious content.
  • Unified Threat Management: UTMs provide broad network security coverage, including at least firewall and IPS capabilities, but also usually web filtering, an email security gateway, remote access, and web content filtering (antivirus). These provide a natural location for adding network DLP coverage.
  • Intrusion Detection and Prevention Systems: IDS/IPS tools already perform content inspection, and so are a natural location for additional DLP analysis. This is usually basic analysis integrated into existing policy sets, rather than a new full content analysis engine.
  • SIEM and Log Management: All major SIEM tools can accept alerts from DLP solutions, and many can correlate them with other collected activity. Some SIEM tools also offer DLP features, depending on what kinds of activity they can collect for content analysis. We have placed this in the network section because that’s what they most commonly integrate with, but they can also work with other DLP deployment locations. Log management tools tend to be more passive, but increasingly include some basic DLP-like features for analyzing data.

Endpoint Features and Integration

DLP features have appeared in various endpoint tools aside from dedicated DLP products since practically before there was a DLP market. This presence continues to expand, especially as interest grows in controlling USB usage without unacceptable business impact.

  • Endpoint Protection Platforms: EPP is the term for comprehensive endpoint suites that start with anti-virus, and may also include portable device control, intrusion prevention, anti-spam, remote access, Network Admission Control, application whitelisting, etc. Many EPP vendors have added basic DLP features – most often for monitoring local files or storage transfers of sensitive information, and some with support for network monitoring and enforcement.
  • USB/Portable Device Control: Some of these tools offer basic DLP capabilities, and we are seeing others evolve to offer somewhat extensive endpoint DLP coverage – with multiple detection techniques, multivariate policies, and even dedicated workflow. When evaluating this option, keep in mind that some tools position themselves as offering DLP capabilities but lack any content analysis – instead relying on metadata or other context.
  • ‘Non-Antivirus’ EPP: Some endpoint security platforms are dedicated to more than just portable device control, but are not designed around antivirus like other EPP tools. This category covers a range of tools, but the features offered are generally comparable to other offerings.

Overall, most people deploying DLP features on an endpoint (without a dedicated DLP solution) are focused on scanning the local hard drive and/or monitoring/filtering file transfers to portable storage. But as we described earlier you might also see anything from network filtering to application control integrated into endpoint tools.

Storage Features and Integration

We don’t see nearly as much DLP Light in storage as in networking and endpoints – in large part because there aren’t as many clear security integration points. Fewer organizations have any sort of storage security monitoring, whereas nearly every organization performs network and endpoint monitoring of some sort. But while we see less DLP Light, as we have already discussed, we see extensive integration on the DLP side for different types of storage repositories.

  • Database Activity Monitoring and Vulnerability Assessment: DAM products, many of which now include or integrate with Database Vulnerability Assessment tools, now sometimes include content analysis capabilities.
  • Vulnerability Assessment: Some vulnerability assessment tools can scan for basic DLP policy violations if they include the ability to passively monitor network traffic or scan storage.
  • Content Classification, Forensics, and Electronic Discovery: These tools aren’t dedicated to DLP, but we sometimes see them positioned as offering DLP features. They do offer content analysis, but usually not advanced techniques like partial document matching and database fingerprinting/matching.

DLP Light Software as a Service (SaaS)

Although currently no completely SaaS-based DLP services are available – due to the extreme internal integration requirements for coverage of networks, endpoints, and storage – some early SaaS offerings are available for limited DLP deployments. Due to the ongoing interest in the cloud and SaaS in general, we expect to see new options appear on a regular basis.

Current DLP SaaS offerings fall into the following categories:

  • DLP for email: Many organizations are opting for SaaS-based email security rather than installing internal gateways (or combining the two). This is clearly a valuable and straightforward integration point for monitoring outbound email and performing DLP.
  • Content Discovery: While still fairly new to the market, it’s possible to install an endpoint (or server, at least on Windows) agent that scans locally and reports to a cloud-based DLP service. These target smaller to mid-size organizations which don’t want the overhead of a full DLP solution, and don’t have particularly deep requirements.
  • DLP for Web Filtering: As with email, we see organizations adopt cloud-based web content filtering to block web-based attacks before they hit the local network, and to better support remote users and locations. All the content is already being scanned, so this is a nice fit for DLP SaaS.

There are even more options on the market, including the occasional free or open source tool, but most fall within these major areas.

No Related Posts
Comments

Many organizations also want to control private information in internal systems like email and SharePoint either for compliance or risk management.

For email, mistakes happen - the wrong attachment is sent or the wrong distribution list is selected. The result can disclosure of personal information as in the case. An example is a Richmond school district which had to shutdown their email system and then provide identity theft protection to employees after someone accidently sent the wrong document containing 100 SSN’s to all employees.

The challenge with SharePoint is that users generate all of the content and administrators have little knowledge or control on what is posted. An example is the Mississippi National Guard which disclosed 3000 SSN’s on SharePoint for over a month.

By Chris Taylor


Email Security Gateway: Not all DLP-light solutions require that the policies and workflow are managed on the DLP side. This would necessitate two separate consoles. The approach customers are now demanding is to tightly integrate DLP-light and encryption capabilities, on-box, centrally managed via the email security management console.

Web Security Gateway: This description provided is accurate, but sounds like a description of full suite network DLP integrating to a web security gateway proxy. This is different than DLP-light controls integrated into the Web Gateway solution itself. Under this DLP-light use case, not proxy integration would be needed.

Storage Features and Integration: We are seeing strong demand for DLP-light capabilities integrated into communication and collaboration tools. Things like SharePoint and Microsoft Exchange have data protection needs wrt data in transit.

By Mark Bloom


If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account.