Data Leakage: VARs Can't Just Be Plumbers

The Services Opportunity
All DLP products hinge on defining and implementing policy controls. Although it's easy to create policies, developing effective ones requires a level of expertise, and that's where the channel comes into play. The size and scope of DLP implementations spells opportunity for VARs, and CRN spoke with several who have had six-figure DLP engagements consisting of software and services. For large enterprises, DLP can easily add up to projects of several hundred thousand dollars.

"These are big deals with long sales cycles in the range of six to 12 months, and deployments ranging from a few days to a few months," said Sreekanth Ravi, chairman and CEO of Code Green Networks, a Santa Clara, Calif.-based startup targeting the SMB market with a DLP product.

DLP-related services include data classification and protection, project management, hardware and software installation, and deployment and testing of the technology. "DLP is a complete project management flow, as opposed to just putting in a box and turning it on," Dannemiller said. He estimated Business Security Solutions receives $3 in consulting services for every dollar spent on hardware.

Organizations are looking to solution providers for help in creating and managing policies governing access to data as well as its movement within the network, which could include outlining how information lives in a database. "There is a lot of work that needs to be done on the front end in terms of understanding what data needs to be secured and in classifying data throughout an organization," Bjerke said.

Security integrators with the skills to effectively classify data as critical and noncritical and fingerprint data so it can be tracked and harder to hide are seeing no shortage of opportunities, Dannemiller said."A lot of vendors' products will catch fingerprinted data in outgoing e-mails," he said. "But there are tricks and techniques to get around this, like hiding data in ZIP files, pasting confidential data from Microsoft Word into Powerpoint, and changing file names."

New Skill Sets Required
While conventional security skills are sufficient for inbound threats, the outbound protection on which DLP depends requires information management skills that are not so readily available. When DLP technology first began to emerge, solution providers would focus mainly on figuring out where sensitive data resided on the network and how to protect it. Since then, the scope of DLP has expanded to account not just for data in motion, but also data at rest.

As a result, DLP projects over time have evolved to include both security and storage technologies, said Paul Adamonis, director of security solutions at Forsythe, a Skokie, Ill.-based solution provider. "Data in motion still needs to be protected and kept from going out, but it's increasingly being coupled with data classification initiatives and the need to identify who's accessing what files at which point in time," he said. "DLP has become an all-encompassing policy around data classification and protection."

Ravi said solution providers also must also have deep knowledge of different types of documents and protocols. "Traditional security skills are easier to find than the information management skills required for outbound content management," he said. "That's why it's important for DLP vendors to build channel programs and recruit partners that can help you reach all parts of the market."

Ken Phelan, CTO of Gotham Technology Group, a New York-based solution provider, said the initial setup of DLP solutions is fairly simple. The bigger services opportunity is in dealing with all of the alert data that DLP solutions can generate. "You're going to get a lot of incidents in any size organization, so the challenge is to prioritize the incidents and figure out how to tighten up the processes," he said.

Embedding DLP technology into an organization's processes usually involves heavy collaboration between the client and the VAR, Phelan added. "These include PMO processes, data processes and the big question: 'What's the best place to encrypt?' " he said.

Next: Manageability Key In Vendor Selection