How to choose a DLP - ч. 2

1. The main tasks of DLP

In addition to the immediate problem of detecting and blocking leaks DLP allows to solve many problems: early detection of disloyal employees and potentially dangerous communication channels to archive corporate email, print documents and other data. file copy protection software DLP can also be used to bring the system of internal control in accordance with the requirements of 152-FZ "On personal data", the Central Bank, PCI DSS, SOX and other industry standards and regulations, and increase the attractiveness of the organization in the eyes of customers, partners, investors and the media . Like any IT solutions, all DLP has its pluses and minuses, so proper prioritization of tasks - an important step to choosing the right product.

Usb flash security software

2. Volume and structure of the data being protected

The amount of data and the choice of DLP and scenarios. Differences network, mixed and host DLP will be discussed in detail in chapter scalability, and the scenarios we would like to elaborate. Usually when implementing DLP question of choice between active and passive mode. In the first case, DLP is placed "in the gap" of passing through the edge of the network data and actively blocks unauthorized transmission of information, in the second system is strictly a notification regime, ie, does not block the transfer, but only to report suspicious incidents, recording all the information on Each event log.

There is also a mixed mode where DLP is placed "in the gap", but the policies are configured in such a way that prevents only the most obvious violations and other traffic passed without any modification. Furthermore, in the active mode, most systems have a manual check, ie, suspicious data is put in "quarantine" and expect the manual checking security officer. Implementation scenarios affect the total cost of ownership - in the long term passive mode requires more labor for traffic analysis and investigation, while in active mode DLP automatically blocks most of the leaks. In this case, the hardware requirements for all scenarios about the same - at least one powerful server, while at low load can be set directly on the DLP proxy, mail, or any other active server.