Generally speaking, DLP enforcement technologies are complex. Solutions cross departmental bounds requiring input from many technology functions: security, networking, infrastructure, email, web, endpoint, storage, databases, etc. As solutions combatting the business problem of data loss, DLP technologies also often directly impact and require input from many non-IT groups, including risk management, compliance, legal, HR, operations, etc.
If all this were not enough, the deployment, configuration and management of DLP solutions (and resulting incidents) is often very complex in its own right. DLP and TDLP solutions are both considered complex, but for very different reasons.
TDLP solutions typically have more complex architectures, requiring multiple devices and software – appliances, virtual appliances or servers – to run the entire solution. These devices must then be integrated within an organization’s network architecture, including outbound network traffic inspection via SPAN port or network tap, email integration for email blocking, an ICAP-compatible web proxy for SSL visibility and HTTP/S blocking, Active Directory, etc. Once the integration is complete, the level of solution management complexity depends on the specific vendor. Some are more complex to support and manage than others.
ADLP solutions tend to have more simple architectures, requiring little to no network integration. However, given the large number of system activity events logged by ADLP solutions, building policy around so many different events can be challenging and require professional service support. ADLP solutions also interact with the OS at the kernel level, often requiring extended tuning to reduce conflict with the OS and existing applications.
Finally, while solutions that include both ADLP and TDLP elements may provide the best of both worlds in terms of features, they are also likely to have the highest levels of complexity.