Content analysis underlines DLP's strategic scope

By Khoo Boo Leong | Jun 25, 2009

0 comments

Facebook

LinkedIn

Digg

Data loss prevention or DLP as we know it today is poised to embrace a broader, more strategic scope as organizations tap content analysis capabilities to address not only security concerns but also knowledge management (KM) and information governance needs.

“DLP is the next step in identity and access management (IAM) and we’re starting to hear terms like content-aware IAM which combines IAM and DLP,” said Gijo Mathew, vice-president of Data and Resource Protection Security Strategy at CA. “Unfortunately, the global view of DLP is basic and limited because the term DLP only describes one use case but not the technology’s potential for broader prevention of data misuse and abuse.”

Up till now, DLP has been predominantly a security-driven initiative entrenched in the security professionals’ world. When defining sensitive corporate data, these professionals readily include obvious information like employee social security and ID or customer credit card numbers.

But to business managers, less tangible information like intellectual property or sales and marketing intelligence is as, if not, more important. “Such information is much harder to find and analyze,” said Mathew. “As a result, the security professionals have mainly stuck to basic DLP [on employee or customer data].”

Beyond basics

"Yet, many organizations are moving beyond this basic level or what I’d call Phase 1 DLP to look at other types of information and a broader set of risks,” he added. “When you read about the cost of a breach to an organization, most of those studies are really only done around loss of customer or credit card information.”

Since breach notification laws in the US require any breach of personal information to be made public, research groups can easily quantify the cost of a breach as well as how much the company spends on remediation of a breach.

For example, according to the 2008 Ponemon Institute’s annual study on data breach costs, the average cost of a data breach increased from US$182 in 2006 to $197 in 2007 to $202 in 2008. The average total cost per reporting company per breach has grown from $6.3 million in 2007 to more than $6.6 million in 2008. Costs come in the form of lost business, legal ramifications, and rectification measures.

0 comments

Facebook

LinkedIn

Digg