Author:
Barbara Hauer
Affiliation:
Johannes Kepler University Linz, Austria
Keyword(s):
Security, DLP, Data Leakage Prevention, ILP, Information Leakage Prevention, Information Exposure.
Related
Ontology
Subjects/Areas/Topics:
Communication and Software Technologies and Architectures
;
Computer-Supported Education
;
Databases and Information Systems Integration
;
e-Business
;
Energy and Economy
;
Enterprise Application Integration
;
Enterprise Information Systems
;
Information Technologies Supporting Learning
;
Mobile and Pervasive Computing
;
Security and Privacy
;
Sustainable Computing and Communications
;
Telecommunications
Abstract:
Organizations from all around the world are facing a continuous increase of information exposure over the past
decades. In order to overcome this thread, out of the box data leakage prevention (DLP) solutions are applied
which are used to monitor and to control data access and usage on storage systems, on client endpoints, and in
networks.
In recent years products from market leaders, such as McAfee, Symantec, Verdasys, and Websense, evolved to
enterprise content-aware DLP solutions. However, this paper argues that current out of the box solutions are
not able to reliably protect information assets. It is only possible to reduce the probability of various incidents
if organizational and technical requirements are accomplished before implementing a DLP solution. To be
efficient, DLP should be a concept of information security within the information leakage prevention (ILP)
pyramid which is presented in this paper. Furthermore, data must not be equalized with information which
requires different strategies for protection. Especially in case of misusing privileges by exploiting an unlocked
system or by shoulder surfing, the remaining risk must not to be underestimated after all.
(More)