Security Analyst to DLP Vendors: Watch Your Language

It seems most security vendors sell DLP products these days. But look under the hood and you'll find the technology doesn't exactly perform as advertised, former Gartner analyst and Securosis founder Rich Mogull warns.

By , Senior Editor

June 02, 2009 — CSO —

Data Loss Prevention (DLP) is all the rage in this era of data security breaches [see our data breach timeline] and increasingly clever malware attacks. Naturally, every vendor in the security market wants a piece of the action.

But in the vendor stampede for market share, something disturbing is happening: Companies are buying technology that, once installed, doesn't offer all the ingredients of true DLP, according to Rich Mogull, former Gartner analyst and founder of security consultancy Securosis.

"The term DLP has essentially become meaningless because of a variety of vendors who wanted to say they were offering it," said Mogull, a respected voice in the industry [see Rich Mogull: 7 Infosec Trends for 2009].


Also read The 2011 Executive Guide to DLP, a 4pp PDF that clearly spells out the foundations of data loss prevention [CSO Insider registration required]


The true definition of DLP has always been somewhat muddy. Mogull described the acronym as a buzzword created for marketing purposes. But it used to be easier to tell when a company was truly offering it. Mogull's definition of DLP goes something like this: "products that as a minimum identify, monitor and protect data in motion, at rest and in use through deep content analysis." The tool identifies the content, monitors its usage and builds defenses around it.

There are a ton of vendors who perform some of these functions. But unless they tackle everything in the above definition, Mogull said it's not truly DLP.

"Encryption and endpoint control vendors call what they do DLP," he said. "A firewall does some of what the concept entails. All of these tools are helpful in different areas of security, but they are not DLP."

Of course, when a vendor doesn't offer technology that purely tackles what everyone is clamoring for, a common solution is to buy up a vendor who has what they need and bake it into the product line.

Symantec muscled its way into the DLP space by acquiring Vontu, a company Mogull sees as an early leader of true DLP technology. Meanwhile, RSA snatched up Tablus (now part of the RSA Data Loss Prevention Suite) and McAfee bought Reconnex (see Data Security Tools to Not Overlook). Then there was the Websense acquisition of PortAuthority Technologies and CA's acquisition of Orchestria.

There are still a few independent DLP vendors out there, Mogull said, including Vericept and Code Green Networks.

Then there are the vendors who offer important pieces of the DLP puzzle but don't do everything necessary (under Mogull's definition, at least) to call themselves DLP providers.

RESOURCE CENTER