Heightened Data-Loss Prevention Needs Fuel Arms Race Between Vendors
Data-loss prevention is rapidly becoming the next big battlefield in IT security.
Symantec acknowledges that's the case but prefers not to discuss that, and instead points toward the security firm's own future plans for Symantec DLP, based on its Vontu acquisition.
What was once Vontu is now called Symantec DLP Discover, Monitor, Prevent and Management with about 300 corporate and government customers using it, says Rob Greer, Symantec’s senior director product management for data-loss prevention products.
Symantec has integrated DLP into its BrightMail e-mail security gateway. There’s also been integration with the Symantec Altiris management software. Altiris v. 7 can be used to deploy and troubleshoot endpoint DLP Prevent and Discover agents.
“Today with the workflow capabilities of Altiris, we can communicate between an endpoint DLP agent and Symantec Endpoint Protection agent,” says Greer.
This capability can be used to solve problems, he notes.
“Say an end user on a laptop is about to check out for the day and copy the crown jewels of the business,” Greer says. “We could today identify that action is occurring, block it with the endpoint DLP, the incident gets recorded in the DLP system, and a message sent to Altiris to lock down that USB drive and doesn’t let anything leave that laptop until the issue is resolved.”
Although today Symantec isn’t at liberty to discuss specific future plans, Greer said work to integrate DLP into Symantec storage systems can be expected. Symantec DLP Discover, for example, has already been integrated into Backup Exec System Recovery. And Symantec intends to introduce some open APIs for DLP.
Arch-rival McAfee is also out on the DLP battlefield, having acquired start-up Reconnex at the end of last year and now has about 500 DLP corporate customers, according to Mike Siegel, McAfee’s senior director of product management.
McAfee’s Host Data Loss Prevention and Network DLP Prevent and Monitor all work with McAfee’s flagship ePolicy orchestrator console, and the host DLP is integrated with McAfee's SafeBoot encryption software to invoke encryption of sensitive data.
McAfee’s host DLP software can be used alone or as an add-on to the flagship endpoint anti-malware security software that's part of McAfee's Total Protection for Data Endpoint suite. But there's still much more to be done, Siegel says.
McAfee is looking at taking the DLP engine and adding it to its Web gateway, e-mail gateway, firewall and intrusion-protection gear, something likely to occur next year, Siegel says.
The DLP battle for the enterprise is under way.
RSA, which has its own Data Loss Prevention Suite based on the Tablus acquisition but has also chosen to strategically partner with Microsoft and Cisco in a DLP technology-sharing arrangement, says DLP is going to end up as the “eyes and ears in many places,” says Tom Corn, vice president of product strategy at RSA.
Security



