3 ms·

How does this compare to Google’s Data Loss Prevention?

stedev 9y ago
Google's Data Loss Prevention is provided on G Suite and Google Cloud Platform (GCP). Both products use the same unified classifier codebase. G Suite DLP allows admins to enforce policy on Gmail and Drive files. On GCP, the Data Loss Prevention API allows developers to classify and redact sensitive data in virtually any data source in real-time or at-rest (e.g. Google Cloud Storage, BigQuery, AWS Redshift, AWS S3, Salesforce, Slack, on-prem, custom apps, etc.). DLP API scans are not limited to 20MB and can scale up to virtually any size. API results can be used for programmatic automation of alerts, IAM/ACL settings, or other remediation and can be sent automatically into BigQuery for detailed analysis or reporting. In addition to classification, Google’s DLP API provides data masking tools for structured and unstructured data including format-preserving encryption, bucketing, and tokenization. This helps developers reduce unnecessary PII when collecting, storing, or sharing data. (Note: I am the Product Manager for DLP API at Google Cloud)
nealmueller 9y ago
On the one hand, AWS Macie only scans S3. Google DLP API works on S3, Gmail, Drive, GCS, DynamoDB, Redshift, BigQuery, Slack, SQL, Oracle, Oracle RAC, Zendesk, Twilio, Salesforce, and everything you can point an API at. If you want to use the same engine to test all your repos then Google DLP API is the right solution for you. On the other hand, Macie has a GUI wizard. DLP API is an API. So if you can't code and just want to scan S3 then Macie might be for you, until Google DLP builds a GUI, if there's demand for that. Someone should do a comparison of how successful each engine is at picking up sensitive data. I suspect Google DLP will be tuned better, but someone should do the test on a dummy data set and release results. That would be the most interesting comparison. I work for Google.

Google's Data Loss Prevention is provided on G Suite and Google Cloud Platform (GCP). Both products use the same unified classifier codebase. G Suite DLP allows admins to enforce policy on Gmail and Drive files. On GCP, the Data Loss Prevention API allows developers to classify and redact sensitive data in virtually any data source in real-time or at-rest (e.g. Google Cloud Storage, BigQuery, AWS Redshift, AWS S3, Salesforce, Slack, on-prem, custom apps, etc.). DLP API scans are not limited to 20MB and can scale up to virtually any size. API results can be used for programmatic automation of alerts, IAM/ACL settings, or other remediation and can be sent automatically into BigQuery for detailed analysis or reporting. In addition to classification, Google’s DLP API provides data masking tools for structured and unstructured data including format-preserving encryption, bucketing, and tokenization. This helps developers reduce unnecessary PII when collecting, storing, or sharing data. (Note: I am the Product Manager for DLP API at Google Cloud)

nealmueller 9y ago

On the one hand, AWS Macie only scans S3. Google DLP API works on S3, Gmail, Drive, GCS, DynamoDB, Redshift, BigQuery, Slack, SQL, Oracle, Oracle RAC, Zendesk, Twilio, Salesforce, and everything you can point an API at. If you want to use the same engine to test all your repos then Google DLP API is the right solution for you. On the other hand, Macie has a GUI wizard. DLP API is an API. So if you can't code and just want to scan S3 then Macie might be for you, until Google DLP builds a GUI, if there's demand for that. Someone should do a comparison of how successful each engine is at picking up sensitive data. I suspect Google DLP will be tuned better, but someone should do the test on a dummy data set and release results. That would be the most interesting comparison. I work for Google.