As its name implies, data leak prevention (DLP) is the attempt to keep confidential information -- including Social Security numbers, intellectual property and credit card information -- safely behind a company's firewall. Driven by federal data protection requirements, as well as the desire to avoid lawsuits and public relations nightmares, companies are turning to service providers to help them implement bulletproof data leakage prevention strategies. A Gartner report released in May 2007 estimated that a $50 million data leak prevention market in 2006 would grow to $150 million by the end of 2007. In this interview with SearchSecurityChannel.com, Charlotte Dunlap, senior analyst for enterprise security at Current Analysis, discusses why data leak protection is important, how the marketplace is changing and what service providers can do to keep their clients ahead of the security curve.
Are most companies aware of the importance of data leak prevention?
Dunlap: I think companies are becoming increasingly aware of the importance of data leakage prevention. It wasn't always that way. A couple of years ago, I wrote some initial reports on it and even hinted that this market was really going to take off, and I got some flak from some people saying it wouldn't take off for years.
In my opinion, data leakage prevention [has] turned into one of the hottest technologies in the past 18 months or so. Most agree it's technology that's here to stay. It remains to be seen how quickly midsized and large enterprises will allocate their IT budget resources if they're not among those that are in the highest regulated industries. [It's] no surprise financial companies are the early adopters of it. Another thing that triggered interest are laws requiring companies to divulge any data leakage exposures. That's prompting many enterprises to look into the technology.
Helping to drive this technology is the fear of losin
To continue reading for free, register below or login
To read more you must become a member of SearchSecurityChannel.com
g intellectual property and sensitive information which can ruin a company's brand name. Channel sources have told me that once breaches occur, their clients scramble to get DLP solutions in place. This was 18 months ago, and attention has really heightened.
What are some trends in the data leak prevention business that the channel should be aware of?
Dunlap: No big surprise: consolidation. It remains the No. 1 trend in the threat protection market. We're going to continue to see more consolidation. What we're seeing are pure-play data leak prevention providers being acquired at record speed so that the technology can be integrated into more of the traditional network, endpoint and storage technologies.
It goes back to the argument between best-of-breed or integrated solutions and which one's best. VARs are going to have some opinions on that themselves, based on their clients' needs and the size of the market segment they support. [Clients are] not going to put up with having a best-of-breed data leakage prevention type of technology beyond a couple of years. They're going to want [it] integrated into secure messaging or IPS and other solutions versus having to go out and set it up, and configure and manage it separately.
Are vendors working with their channel partners to address data leak prevention, or are they going the direct route?
Dunlap: I was concerned about that about a year ago, and I still have some concerns where I'm seeing some of the bigger names in data leak prevention wanting to take the technology direct. I'll pick on Symantec -- they're a good example with their leading secure messaging product, SMS. They enhanced the product very nicely a year ago by adding data leakage prevention and email archiving add-ons, but those are technologies they tend to hand to their direct sales guys versus the channel.
The reason is that [data leak prevention is a] new, complex technology. But I think, more and more, these vendors are realizing that they need to bring it to the channel if they want to get broader support and get it out there to the industry. Further, vendors are going to need to overcome the complexity of [data leak prevention] so that they can hand it to their channel partners.
Should channel partners target small, medium-sized or enterprise customers with DLP offerings?
Dunlap: It's a mixed bag. I recall a briefing with a large data leak prevention provider in the earlier days that had broken [its sales] down to 20% [channel] and 80% direct. For an emerging technology, that's not a big surprise, because there's a lot of hand holding that goes along with new technology. VARs don't typically have access to the big customer accounts unless they are very security-savvy. As the technology continues to be adopted and integrated into traditional technologies, more channel partners will gain access to it.
The midsized customer space will eventually end up being the sweet spot for [the channel]. In the meantime, larger DLP providers are going to retain compliance-types of add-on opportunities for their direct sales. Data leak prevention is an excellent add-on service. The midsized and some smaller companies are slowly recognizing the need for it. For example, a credit union that might have a couple hundred employees still has a lot of sensitive data to protect.
What service opportunities does DLP offer the channel?
Dunlap: VARs experienced in advanced security technologies, such as content filtering, encryption, policy creation, quarantining and archiving will do well moving into this new space. As with many emerging technologies, VARs can provide the support needed to simplify the configuration and management of the technology for those DLP providers wise enough to tap their channel resources.
