{"id":2409,"date":"2012-12-10T06:20:47","date_gmt":"2012-12-10T00:50:47","guid":{"rendered":"https:\/\/www.qadit.com\/blog\/?p=2409"},"modified":"2012-12-10T06:20:47","modified_gmt":"2012-12-10T00:50:47","slug":"dlp-discover-first-or-monitor-first","status":"publish","type":"post","link":"https:\/\/qadit.com\/blog\/dlp-discover-first-or-monitor-first\/","title":{"rendered":"DLP: Discover First or Monitor First?"},"content":{"rendered":"

Should I DISCOVER<\/strong> where sensitive\/regulated data resides in my environment OR DETECT<\/strong> when it is being leaked? Storage DLP first or network DLP first? Data-at-rest (DAR) first or Data-in-motion (DIM) first? What is more important, knowing WHAT can be stolen and from where OR WHAT is being sent out today?<\/p>\n

Sorry, but \u201cIT DEPENDS.\u201d As many tough questions in life, this one has no single right answer. Successful data protection projects, whether for regulated data or corporate secrets, often start from a discovery sweep of an internal network. Looking for PANs, SSNs, known secret documents, customer records or whatever else allows the DLP conversation to start and the \u201clay of the data land\u201d to become more clear. At the same time, they also often start from observing sensitive and regulated data flows out of your environment via email, FTP, web uploads, etc. This helps jumpstart the DLP discourse and creates a sobering realization of \u201cWhaaaat!? This is going on RIGHT NOW!!?\u201d Both are common and reasonable.<\/p>\n

So, why discover first?<\/p>\n