DLP (Data Loss Prevention) is a failed industry and if you disagree you're almost certainly selling it.
So what is DLP?
Generally it's an appliance, software, etc. that makes sure that your employees don't copy sensitive data out of your environment.
Sounds good in theory, right?
Generally it's an appliance, software, etc. that makes sure that your employees don't copy sensitive data out of your environment.
Sounds good in theory, right?
In practice it's crap.
It has to MitM secure connections, so that's awesome. (A one stop breach!)
It has to recognize what the sensitive data is in the first place. (Is that a SSN or just a nine digit number?)
It has to work everywhere your sensitive data lives.
It has to MitM secure connections, so that's awesome. (A one stop breach!)
It has to recognize what the sensitive data is in the first place. (Is that a SSN or just a nine digit number?)
It has to work everywhere your sensitive data lives.
You've gotta worry about people plugging in USB drives, disabling Airdrop, sniffing email, preventing access to S3 and random web servers, etc. etc. etc.
Meanwhile people have cell phone cameras in most workplaces.
Meanwhile people have cell phone cameras in most workplaces.
So it’s noisy as hell every time it misfires, people feel the lack of trust, it can be evaded by nefarious folks, and it mostly serves to get in the way of getting work done.
But at least it’s very expensive.
But at least it’s very expensive.
"So how do you intend to protect your data instead?"
Restrict the sensitive stuff to as small an environment as possible, audit the living hell out of accesses to the secure thing, and hire trustworthy people.
Restrict the sensitive stuff to as small an environment as possible, audit the living hell out of accesses to the secure thing, and hire trustworthy people.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
