DLP

Description

You get a defined boundary — 'this kind of data doesn't leave this way' — and a record of attempts. Depending on policy it either blocks, or warns and logs. So you can see who tried to move what, and when.

The reality is that DLP is worth as much as its rules and its map of what's sensitive. Without a clear picture of what you're protecting and where it lives, DLP either blocks everything (and people route around it) or blocks nothing.

What people often say

• 'DLP stops all leaks' — determined exfiltration (photo of screen, personal phone) routes around it
• 'Turn it on and you're compliant' — without classification and tuning it's just noise

Covers / does not cover

Covers

• Detecting and blocking movement of marked or pattern-matched sensitive data across mail, web, endpoint, and cloud
• Visibility into exfiltration attempts

Does not cover

• It doesn't classify data for you (it must know what's sensitive)
• It struggles with encrypted, obfuscated, or photo-of-screen exfiltration
• It doesn't stop an attacker who already has admin rights and disables it
• It's no substitute for access control — for who can reach the data in the first place

Notes

• A DLP nobody taught what's sensitive either blocks everything and gets bypassed, or blocks nothing. First the data map, then the rules.