![](bg3.png)
key word search which includes a dictionary search,
McAfee recommends using whole phrase matching or
statistically improbable phrases (SIPs). Digital finger-
prints are used to create data and file signatures. Fur-
thermore, “McAfee DLP Discover” classifies content
by document property definitions which are based on
predefined metadata values and filename extensions.
User actions on client endpoints are addressed by the
“McAfee DLP Endpoint” which monitors data usage
and prevents, for example, copying data to removable
media, printing files, and taking screenshots. In fur-
ther consequence, rights management and role based
access control are supported. Similar to the EMC
solution, the McAfee solution is specialized in Mi-
crosoft products and does not offer sustainable sup-
port for Linux based operating systems and cloud in-
frastructures. MDM is offered separately for mobile
devices such as Apple iPhones, Apple iPads, Android
devices, and Windows Phones. However, McAfee is
aware of some limitations and known issues. For ex-
ample, Windows does not load the host DLP plugin
in safe mode, and as a result the web host protection
rules do not work and e-mail protection rules are by-
passed in some cases (McAfee, Inc., 2013).
2.3 Symantec
Consisting of multiple parts, “Symantec Data Loss
Prevention 12” (Symantec Corporation, 2013) can be
installed on Red Hat Enterprise Linux operating sys-
tems as well as on Microsoft Windows Server operat-
ing systems. However, the endpoint agents are limited
to Microsoft Windows operating systems. Syman-
tecs DLP solution for DIM is software-based and
consists of three products: the “Symantec Data Loss
Prevention Network Monitor”, the “Symantec Data
Loss Prevention Network Prevent for Email”, and
the “Symantec Data Loss Prevention Network Pre-
vent for Web”. Monitoring and prevention only ef-
fect protocols which are enabled in the system, such
as the HTTP and transport layer security (TLS) proto-
cols. DLP for e-mail involves smartphones as well as
tablets running Google Android, Apple iOS, Black-
Berry, and Windows Mobile. The support for web
services, social media, and cloud infrastructures is
limited to specific providers. Symantecs DLP solu-
tion for DAR is composed of “Symantec Data Loss
Prevention Network Discover”, “Symantec Data Loss
Prevention Network Protect”, and “Symantec Data
Loss Prevention Data Insight Enterprise”. “Syman-
tec Data Loss Prevention Endpoint Discover”, and the
“Symantec Data Loss Prevention Endpoint” are re-
sponsible for DIU and available for Windows clients
endpoints. In contrast to EMC and McAfee, Syman-
tec not only makes use of key word and regular ex-
pression search as well as digital fingerprints, but
also deploys vector machine learning techniques for
building statistical models based on positive and neg-
ative example documents. In addition to detect DAR
by scanning data repositories including file servers,
databases, and web sites, Symantec also tracks the file
usage which can be used to enforce access rules and to
understand leakage incidents. However, the DLP so-
lution is limited to certain file types, data formats, net-
work protocols, storage systems, service providers,
and software vendors.
2.4 Verdasys
Verdasys DLP solution “Digital Guardian (DG) ver-
sion 6” with “DLP 3.0” (Verdasys, 2013) special-
izes in unstructured data and extended operating sys-
tem support to have an advantage over its competi-
tors. Verdasys defines the DG as an enterprise infor-
mation protection (EIP) solution which implements a
data-centric approach. The “Digital Guardian Man-
agement Server” is the command center for operat-
ing several agents and various add-on modules. The
agents are used for context-based data monitoring,
classification, and control, and to enforce data poli-
cies on Windows, Linux, Mac OS, VMware, Citrix,
Hyper-V, BlackBerry Enterprise Server, Exchange
ActiveSync, and iOS platforms. Verdasys offers dif-
ferent network agents, such as “DG XPS DIRECT”,
“DG XPS MAIL”, “DG XPS WEB”, and “DG NET-
COM”, which include an agreement with Fidelis Se-
curity Systems for using the “Fidelis Extrusion Pre-
vention System (XPS)”. These network agents are
deployed as out-of-band sniffers or inline layer 2
bridges. Basically, they try to detect unauthorized
DIM based on content, application, and/or protocol
across all 65,535 ports. Hence, data detection and
classification are shifted to the endpoints and the
storage systems. In general, the data classification
is based on content, context, and user classification
(UC) all of which are complementary and can be com-
bined. The content inspection makes use of key word
and regular expression search as well as document
similarity based on key words and Bayesian analy-
ses. The context, for example, involves the applica-
tion, data type, user identity, e-mail properties, and
network properties. The classification is stored along
with policy rules in meta-tags which allows inheri-
tance and reclassification. Unstructured data is iden-
tified and classified according to context parameters
by considering user, application, and activity, such as
the creation, access, revision, or transmission. Con-
tinuous logging and auditing can be extended by key
DataLeakagePrevention-APositiontoState-of-the-ArtCapabilitiesandRemainingRisk
363