DLP: Data In Motion vs. Data At Rest (DIM vs. DAR)

The Debate column (P15) of the November, 2010 Issue of SC Magazine covers a very interesting topic– For or Against:  “DLP for data in motion is more effective than DLP that secures data at rest”. Two top executives, each from a security solution provider, are invited to comment “For” or “Against” this statement.

Joe Leonard from Global Velocity is “For” this statement. He convincingly argues that “ultimately, a solid, well planned ‘data in motion’ approach can gain 80 percent of the bang for 20 percent of the buck, while providing additional operational benefits.” In other words, he thinks Data In Motion (DIM) is a better approach than Data At Rest (DAR) for DLP.

Todd Feinman from Identity Finder is “Against” this statement. His key argument is that “Data-at-rest DLP searches files and emails with deeper analysis to determine the context of sensitive information, while eliminating false positives”.  In other words, he believes Data At Rest (DAR) is a better approach than Data In Motion (DIM) for DLP.

Both have good arguments. However, adding 1+1, it is very obvious that Mr. Feinman provides a good specification to the underspecified term “solid” in Mr. Leonard’s statement, defining a “solid” DIM approach as one that can perform deeper analysis with no false positives.

Why do experts, such as Mr. Feinman, not believe that DIM can do deeper analysis with no false positive? The answer is rooted in the conventional technologies used for the data in motion approach. These technologies scan packet streams and look for offending patterns. The problem is that most sensitive information can only be comprehended at the content level, not at the packet level. Scanning packets cannot detect information that span many packets and, very often, that are packed in an archive. It is analogous to inspecting atoms and molecules to detect if an object is a tiger or a rabbit. To implement the requirement of deeper-analysis-with-no-false-positive, the industry needs Deep Content Inspection for Data In Motion, i.e. DCI For DIM.