- DLP lacks visibility
- DLP rules are complex
- DLP is heavy
- DLP is unfair
- DLP misses a lot
- DLP violates privacy
- Ultimately, endpoint DLP leaves gaps
- Endpoint visibility as a replacement
Companies worldwide spend billions of dollars on endpoint data loss prevention (DLP) technology, hoping it will protect intellectual property. In theory, it’s a good idea. There’s just one problem: it doesn’t work.
Every day a member of our team meets a company that wants to rip out their DLP product in frustration after encountering troubled installations, bogged down networks, and hundreds of high-maintenance rules. And while DLP offers alerts, it’s by and large a placebo effect – it misses more than it actually detects.
So, what’s the answer? Organizations are increasingly realizing the need for endpoint visibility to capture the right data, at the right time.
They need actionable data that precedes a potential exfiltration and carries enough behavioral context to inform decision-making as it pertains to insider risk resolution. Importantly, they need a solution that is lightweight, scalable and mindful of employee privacy.
Here are seven reasons why DLP falls short and why contextual, human-centric endpoint visibility yields far more results with a lot less pain:
1. DLP Lacks Visibility
Depending on the configuration within a DLP solution, it can be nearly impossible to get responses to questions that are foundational to managing insider risk. Questions like, “What files are on the lost laptop?” or “What data did a user take when they resigned?” or “How many people try to use USB devices on a daily basis?” Without the ability to capture such information, there is no way of stopping insider risks from turning into insider threats that result in data loss.
… But for Endpoint Visibility, it’s the Name of the Game
Visibility at the endpoint is prudent to understanding how and why humans behave the way they do. Endpoint visibility provides context around the way employees interact with the tech stack, providing high value insights that can be actioned to predict and deter insider risk.
At the same time, it’s important to ensure employee privacy remains intact. Anonymization is the holy grail, alerting only on anomalies in human interaction with data and systems – not intrusive surveillance.
2. DLP rules are Complex
Endpoint DLP deployments require complex rules and policies to be effective. Setting these up is a massive time and money investment, and maintenance is just as demanding. Most organizations can’t afford the large team it takes to do this correctly. Some turn to expensive external vendors, but most simply fall back to a few basic rules, such as ‘block all USB devices’ or ‘no usage of Facebook’. Broad, overly simplified constraints like this render DLP basically useless. Even worse, they cripple employee productivity through heavy restrictions.
… But Endpoint Visibility is Simple
A good endpoint visibility solution will require very little configuration and will come with analytics based on proven human behavioral patterns. It doesn’t require hours upon hours of work to set up, and its effectiveness doesn’t hinge on constant human intervention. This means that it won’t bog down your IT personnel and will be effective even with minimal time investment.
3. DLP is Heavy
Endpoint DLP uses heavyweight agents that bog down computers and choke networks. On top of this, they require massive server installations. Lots of companies we meet tell us about ripping out DLP even after limited installations fail.
… But Endpoint Visibility is Light
The right endpoint visibility solution is a lightweight forwarder, not a heavyweight agent. You should be able to install it and start getting visibility within a couple of hours. Ideally, it will take up very little space on the endpoint and have a minimal network impact; your employees shouldn’t even be able to tell once it’s been installed because its performance impact is so miniscule.
4. DLP is Unfair
Endpoint DLP punishes everyone for the crimes of the few, and it treats innocent employees as if they’re guilty. This causes a massive drop in morale, leading to disengagement that only results in more risk. In addition, heavy restrictions can encourage good employees to find workarounds in order to get their jobs done more efficiently. Oftentimes, these workarounds end up causing even more headaches and, again, increasing risk.
… But Endpoint Visibility is Supportive, Not Punitive
General restriction is never as effective as a proactive, targeted response. Endpoint monitoring allows you to employ a ‘Trust but Verify’ management style. Instead of punishing everyone in a blind attempt to protect your organization, you can identify specifically who’s intentionally defying security or accidentally making harmful mistakes. This means that you can educate or discipline those specific employees while leaving the rest of your team to do their jobs with minimal interference.
5. DLP Misses a Lot
In nearly every risk assessment we perform, we find DLP systems that aren’t performing as they should be. DLP tells you what it catches, but there’s no way of identifying and learning from what it’s missing. Plus, DLP’s complex rules makes it very easy to miss when policies are not configured correctly or when large groups of users simply don’t have DLP installed. That’s a lot to leave up to chance.
… But Endpoint Visibility Captures Everything You Need
Some people combat this problem by relying on log files, but even log files miss basic information about what employees do on an endpoint. What if someone prints to a local printer? Or copies a file to a brand-new cloud service when they’re off the corporate network? Or renames files to cover their tracks? A good endpoint visibility solution not only gives you the information you need about user behavior, but it also identifies which security measures are working and which aren’t.
6. DLP Violates Privacy
Endpoint DLP systems read the contents of files, emails, and websites that your employees use. This means that it captures personal and confidential data that companies really don’t have any business collecting or managing.
…But Endpoint Visibility, Done Right, Puts Privacy First
Employees have a right to privacy. A privacy-compliant endpoint monitoring solution aggregates and anonymizes data, providing the best of both worlds: a system that protects the organization and the employee’s privacy.
7. Ultimately, Endpoint DLP Leaves Gaps
We’ve established that DLP is a ton of effort, eating up time and money to set up and maintain and we haven’t even reached the worst part. The final nail in the coffin: even after all that, it’s still easy for employees to take data out of the organization.
The steady rise of bring your own device (BYOD) policies and cloud services have made organizations more porous, not more secure, and rigid endpoint DLP technologies just can’t keep up. Plus, it only takes small configuration mistake to create gaping security holes. For most of the organizations we’ve spoken to, this tips them over the edge. They couldn’t justify the massive sacrifices in manpower, endpoint speed, and employee morale all for something that didn’t work anyway.
Endpoint DLP does have a place. It’s okay to use in small, high-risk areas of a business, on a targeted basis, to manage known risks. However, as a whole, the industry is trying to use endpoint DLP as a pervasive, blanket control against insider threats, and it’s just not up to the task.
Endpoint Visibility as a Replacement
More and more, enterprises are accepting that endpoint DLP is never going to be the solution that they want it to be. Ultimately, the immense time, effort and money put into managing it becomes more than most organizations can bear.
It’s becoming increasingly accepted that an endpoint visibility solution accomplishes everything endpoint DLP solutions claim to – but more effectively. It’s the next generation of data loss prevention, more elegant, less intrusive and easier to manage.
With visibility and the right behavioral analytics, organizations can pinpoint suspicious behavior without ever having a need to do company-wide lockdowns. Insider risk teams can make more informed decisions and provide employees with a much better and more productive working experience. It may be different, but it’s forward-thinking. The future is in knowledge and analytics, not rules and restrictions.
Ready to drop your endpoint DLP in favor of the more elegant solution?
Contact us today to learn how you can achieve endpoint visibility to proactively mitigate risk, prevent data loss and maintain employee privacy.