Data Leakage: VARs Can't Just Be Plumbers

"Having a management console telling you what's going on is the key to avoiding false positives, which is a big issue with DLP," Dannemiller said. "The management console allows companies to go in and decipher what happened and is especially good at answering questions like: 'Did we block it? Is it encrypted?' "

Vendors such as 8e6 Technologies, Orange, Calif., Finjan, San Jose, Calif., and Clearswift, Redwood City, Calif., offer DLP as part of a more comprehensive content security solution such as content filtering or antimalware. Those products tend to have advanced management interfaces and a tighter coupling to the network. That can simplify ongoing management and better integrate DLP into an overall security solution. Finjan and Code Green have also approached DLP from the bigger picture of compliance and have incorporated compliance reporting and auditing tools into their products.

Dannemiller said the management console should generate an all-important audit trail that shows whether the risky behavior associated with one user also has been going on with other users. When a leak incident occurs, "you build one story, and it lets you know what to block, determine the severity of the breach and stop the same thing from happening again," he said.

Each vendor's DLP offering has components that focus on monitoring data at different parts of the network. Some products cover data at rest, using a software agent installed on desktops, while others watch for leaks at the network gateway.

The iGuard appliance from Reconnex, Mountain View, Calif., for example, sits at the network edge and passively monitors all traffic via an Ethernet tap, taking action when a policy is violated. The benefit to that design is minimal impact on network performance and elimination of software agents.

Vontu, San Francisco, has a product line that combines monitoring data at rest and data in motion to cover all the bases. Vontu takes the approach that if all information access is cataloged, it becomes much easier to control who accesses the data and where that data is going.

Another consideration is the vendor's channel orientation. Websense, which bought PortAuthority last December, and McAfee, which acquired Israel-based DLP startup Onigma in October, are two of the largest early movers that sell DLP solutions through channel partners. Symantec provides a subscription-based DLP service through an OEM agreement with Vontu.

Vontu has taken a more direct route to market, with less than a third of its revenue going through channel partners, said Steven Roop, vice president of products and marketing. However, Vontu works with 18 channel partners in North America that provide services around its DLP products, Roop said.

At this early stage, solution providers need to be aware that many vendors are startups and some have chosen a direct route to market. In order to survive, smaller players are going to take deals however they can get them, including direct, Code Green's Ravi said. But despite the direct-sales orientation of some vendors, Ravi insists that DLP is a channel-friendly technology. "This was the case with the firewall until the appliance came along and removed much of the complexity," Ravi said. "But the DLP market hasn't reached that stage yet."

Completing The Puzzle
DLP vendors initially focused on network-based protection, but the ability to prevent data leaks from desktops and notebooks is fast becoming a must-have for companies with large numbers of mobile workers. "In the mobile world, where people aren't well connected to the corporate network, it kind of drives you to the host-based approach, to make sure data is protected everywhere," Bjerke said.

While some vendors offer host- and network-based protection, there still isn't a single solution that protects both data at rest and data in motion, Adamonis said. "Our customers seem to be focusing on one over the other because there is no real complete DLP solution right now," he said.

As the market consolidates, Adamonis expects to see acquisitions aimed at filling the gap and yielding a comprehensive solution. In the meantime, the good news for the channel is that DLP technology is still developing and is a long way from becoming commoditized, which means there's still time for early movers to grab a piece of the market. As Dannemiller put it: "You won't see CDW selling this stuff."