Adding to the complexity of DLP solutions is the fact that TDLP solutions require integrations with existing network components. Often times these integrations are not communicated ahead of time by the DLP vendor and can cause serious problems if not planned for ahead of time. Some of these integrations are not mandatory, but if not employed severely limit the DLP solution's ability to actually prevent data loss.
1. Database. Each DLP solution needs a database to store incident details. Some vendors require Oracle and some Microsoft SQL. One vendor does not require a separate database but instead includes the database as part of the software.
2. Email Integration. In order to actually block (or quarantine) an email that violates policy, the DLP solution must be able to collect and hold an email while scanning for sensitive data. In most cases, this requires the DLP solution be put inline with the mail flow.
3. Web Proxy Integration. As with email, in order to actually block web traffic, the DLP solution must collect the request and hold it for inspection. This is done with a web proxy, which receives the web request and hands it off to the DLP solution for inspection via the ICAP protocol. The DLP solution can then tell the proxy whether to block or allow the request. Most commercial and open source proxies support the ICAP protocol, but many other web security tools do not. Without the ICAP proxy, a company will be unable to block web traffic containing sensitive data.
4. SSL Integration. In order to gain visibility into SSL traffic for inspection, a DLP solution must integrate with a network device capable of acting as a man-in-the-middle and communicating with the DLP solution via ICAP. Generally speaking, this means a web proxy.
Don't Have a Web Proxy
If your organization is like many today, proxy infrastructure has been supplanted by new web security technologies. If this is the case, you have two options: 1) opt for a DLP approach that does not require a proxy (an endpoint only solution) or 2) deploy a proxy.