In the last few years, more and more often I hear this buzz word. So what is DLP? DLP stands for Data Loss Prevention. Various vendors also refer it as Information Leak Protection or Content Monitor and Filtering (CMF) agent.
Essentially, it is a product that can be deployed either in a host or network to prevent sensitive data being sent outside organisation.
When I was at school, I spent a year doing research in anomalous payload based network intrustion detection but the principal is the same as the Data leakeage prevention system. After all, NIDS inspect inflow traffic to the organisation, where DLP agents inspect outflow traffic to the outside organisation. Both are quite similar.
Being anomalous (smart agent), it detects intrustion if the attack pattern deviates from the normal behaviour. As a result, tuning the IDS system is to the right setting is still a challenge. After all, we don’t want to spend much time in monitoring false alerts generated by the IDS. The same as DLP Agents, if would find there will be a lot of false alerts generated by the DLP.
Another issue with the Anomalous payload based NIDS is the NIDS only works if the data is sent in a clear text. If the data is encrypted, the agent would not able to inspect the traffic. Similarly with the DLP Agent, for the DLP agent to work it assumes that the data sent is not encrypted, hence it only effectively works against unintentionally leakage, it wouldn’t work if someone ’smart’ intentially send the data outside the organisation becuase he/she would encrypt the data first before being sent outside by either email or USB.
I still believe that DLP product is a long way to mature, at least for now. I believe that an organisation should consider broader strategy in their Data Leakage Programme, at least at a minimum the organisation should consider the following:
- Grant ‘outbound’ email access to the need to have basis. Yes, not all employees in your organisation should have access to send email outside.
- Disable USB port.
- Deploy Hard Drive Encryption for mobile computing.
