Of all the security techniques aimed at ensuring data security and combating data breaches, data loss prevention tools are far and away the most common. DLP tools constantly monitor and analyze data to identify potential violations of security policies and, if appropriate, stop them from continuing. DLP tools range the gamut, from those focusing on a single part of an organization, such as email services or laptops, to ones specializing in data backup, archival and restoration.
Some DLP tools encompass the entire organization — and these are the focus of this article. First let’s discuss some must-have features and capabilities. Then, take a close look at seven enterprise DLP tools for the information needed when evaluating the best product for your company’s needs.
Must-have DLP tool features and capabilities
Enterprise DLP tools contain a wide range of features and capabilities. The following are the most essential:
- The ability to automatically discover, inventory and classify sensitive data and its metadata. Data is constantly being created and changed, so a DLP tool unable to keep pace with potential data leaks will always be missing things.
- The ability to analyze data:
- in any state — in use, at rest or in transit;
- in any location, including user endpoints, on-premises servers, and networks and cloud services; and
- in any application, such as email, web, messaging platforms, social media and file sharing.
- The ability to use several types of analyses to accurately find problems. All analysis should take into consideration the context of the communication, because activity that’s completely normal in one context could be highly suspicious in another. Examples of analysis include the following:
- looking for suspicious values — e.g., “confidential”;
- doing complex pattern-matching — for example, to find credit card numbers;
- finding copies of known sensitive data;
- performing statistical analysis of data activity; and
- studying user behavior.
- The ability to act in one of several ways when the DLP software discovers a potential policy violation. For example, in one situation you might want the tool to log a possible violation and alert an administrator. In another, you might want the tool to stop a data transfer, initiate an incident report through your SIEM and immediately involve your incident response team in handling the attempted breach. Tools may also be able to proactively fix basic policy violations, such as encrypting sensitive stored data.
Now let’s look at several popular enterprise DLP tools marketed to security teams. This is just an overview of what’s offered today: Many other DLP tools are available, each with its own unique combination of features and capabilities. This pros and cons list is primarily based on publicly available reviews contributed by verified purchasers of DLP products and services.
1. Digital Guardian DLP
Product page
Key features
- SaaS DLP with automated data discovery and data classification capabilities for both known and unknown data types
- Granular policies available to protect sensitive data and restrict its movement
- APIs and integration with several major technology vendors
Pros
- Supports managed services
- Offers excellent customer support and just-in-time training features
Cons
- Configuring and managing policies can be challenging, including technical glitches
- Limited support for macOS platforms
Modules
- Analytics & Reporting Cloud
- Endpoint DLP
- Network Appliance
- Management Console
2. Forcepoint DLP
Product page
Key features
- Performs several types of analyses, including optical character recognition capabilities
- Uses a single analysis engine for all its DLP, ensuring consistency
- Provides more than 1,500 templates and policies for major security and privacy regulations around the world
Pros
- Provides broad, highly effective monitoring and analysis capabilities
- Consumes minimal resources on endpoints
Cons
- Can be challenging to customize policies, rules and reports
- Learning curve is generally a bit steep
Modules
- Endpoint, for user endpoints
- Cloud Applications, for popular SaaS applications
- Discover, for sensitive data discovery, inventory and classification
- Network, for data being sent over networks through email and web activity
- Cloud Email, for data being sent from cloud-based email services
- Cloud Web, for data being transferred through web activity
3. GTB Technologies DLP as a Service
Product page
Key features
- DLP-as-a-service offering hosted by all major cloud service providers; also available for private clouds and on-premises use
- Includes additional security features such as application allowlisting/denylisting
- Highly accurate detection capabilities (low false positive rates)
Pros
- Highly scalable and flexible
- Supports Windows, macOS and Linux platforms
Cons
- Some shortcomings in the GUI
- Limited support and documentation
Modules
- SaaS Data Discovery with Data Classification
- Cloud DLP
4. Palo Alto Networks Enterprise DLP
Product page
Key features
- Delivered through the cloud using on-premises Palo Alto hardware
- Single administration console and policy engine for all DLP components
- Offers built-in policies for compliance with numerous laws and regulations
Pros
- Designed to accommodate mobile/hybrid workforces and SaaS application usage
- Takes little effort to administer on an ongoing basis
Cons
- Assumes use of existing Palo Alto Networks systems
- Documentation isn’t sufficiently detailed
Modules
- Enterprise DLP modules for physical and virtual firewalls
- Enterprise DLP module in its Prisma Access offering
5. Symantec Data Loss Prevention by Broadcom
Product page
Key features
- Provides a single console for monitoring and managing all DLP components
- Uses a single policy mechanism for all of its detection and enforcement capabilities
- Offers a variety of enforcement capabilities, including integration with Microsoft Information Protection
Pros
- Easy-to-use, flexible UI
- Fast data discovery and strong detection of policy violations
Cons
- Considered more expensive than most other DLP tools
- Integration with other tools is often challenging and requires technical support
Modules
- DLP Core, a suite of nine on-premises components
- DLP Cloud, a bundle of seven cloud-based components
6. Trellix Total Protection for DLP (formerly McAfee)
Product page
Key features
- Offers several methods for protecting sensitive information, including on USB drives and other media
- Monitors end user behavior, such as performing screen captures and printing data
- Provides strong, flexible options for data classification
Pros
- Data protection methods are considered highly effective
- Requires less ongoing administration and maintenance effort than competitors
Cons
- Can be difficult to configure, with a steep learning curve
- Agents sometimes run slowly on endpoints or fail altogether
Modules
- Trellix DLP Discover
- Trellix DLP Prevent
- Trellix DLP Monitor
- Trellix DLP Endpoint
7. Zscaler Cloud DLP
Product page
Key features
- Part of a cloud-based security service edge suite of products and services
- Provides protection and monitoring for endpoints whether or not they’re internet-connected
- Does not need to route any user traffic through on-premises networks for monitoring or enforcement purposes
Pros
- Generally easier to configure and start using than other DLP offerings
- Requires no on-premises appliances or other hardware; highly scalable with high performance
Cons
- Occasional delays when endpoints are connecting to the service
- Detection rules aren’t as configurable or powerful as other DLP products
Modules
Click Here For The Original Source.
————————————————————————————-