Five Evaluation Criteria for Data Loss Prevention Tools
Gartner's considerations for narrowing down DLP products
By Mary Brandel
October 10, 2007 — CSO — Five Evaluation Criteria for Data Loss Prevention Tools
Thoughts on Gartner's considerations for narrowing down your list:
Channels. How many protocols does the product cover, and is it capable of decoding the protocol? The market is rapidly moving toward multiple-protocol decoders, Gartner says.
Blocking. Not all products perform blocking, and some block only on certain channels, though Gartner sees the market moving toward products that will block all channels.
E-mail. Most products block e-mail first and enable quarantining, rerouting, blocking, encryption and other more complex handling rules, Gartner says. Few products today monitor internal e-mail, but some provide Microsoft Exchange or Lotus Notes integration. Users should be cautious of products that monitor e-mail passively or block SMTP traffic by resetting TCP connections, which provides no feedback to the sender and can cause performance issues, according to Gartner.
Detection techniques. Options include rule-based detection, document fingerprinting, database matching and statistical analysis. "If you're looking for things like Social Security numbers, that's not a hard thing to do, but when you start asking for other kinds of data, it gets harder," says Jon Oltsik, senior analyst at Enterprise Strategy Group. "Some products have more kinds of classifications than others—financial data, credit card data or whether people have hacking scripts on their desktop."
Data-at-rest content discovery capabilities. Some products automate the discovery of where sensitive data resides. Oltsik says, "Data travels from person to person, gets attached to e-mails, is downloaded in flat files and put in spreadsheets or databases. Understanding where your data is [is] an important first step."
Read more about data protection in CSOonline's Data Protection section.
Other stories by Mary Brandel
The challenge of true data protection spans databases, internal and external networks, physical and offsite storage, business partners and more. These resources offer expert perspective from the basics through specific key elements of data protection strategies.
Network security basics
Protection, detection, and reaction—those are the three underlying principles your security program must embody
Computer incident detection, response, forensics
Richard Bejtlich shows how to measure and improve the maturity of your incident response
A few good IT security metrics
Stop counting blocked malware attachments and measure things that can contribute to meaningful change
5 key cloud security trends
Cloud security is evolving rapidly—stay on top of it
IT risk assessment frameworks
How to do end-to-end encryption
How to compare and use enterprise antivirus
Also find sample data protection policies in CSO's tools, templates and policies library
- Introduction to VMware vCenter Site Recovery Manager 5
- Introduction to Virtualization
- Preventing Unplanned Downtime with Server Virtualization
- Secure Cloud Infrastructure and Next-Generation Data Centers - An Interactive Panel for Decision Makers
- Gartner Next Generation Network IPS Webcast
- Understand Your Data: The Future of Backup and Archiving
- Overcome Top 7 Admin Challenges of Active Directory
- Insiders Can Ruin Your Company. Take Action.
- Top Solutions and Tools to Prevent Devastating Malware
- X-Ray of the PCI Process-4 Proactive Steps
- Streamline Compliance and Increase ROI
- Beyond SFTP: Five Ways Secure Managed File Transfer Can Improve Your Business
CSO Corporate Partners
- Patch Tuesday preview, February 2012
Microsoft published its Patch Tuesday Preview for February of 2012 a few minutes ago. IT admins can expect nine bulletins to address 21 security vulnerabilities.
It looks like four bulletins will be rated critical while the rest are designated as important.
Affected Microsoft products are:
- M86 report proves water is wet
- Actor, banker, soldier, spy: Suits and Spooks Anti-Conference aims to redefine security
More Salted Hash with Bill Brenner
