4 ms·

Thank you for your reply. Your point about requirements is spot on. I guess that is the problem, requirements change pretty quickly for us, within few months an

• mdaniel 3y ago
  I mean, surely your business requirements change but not the threat model against your business leaking data, right? If you're using cloud storage, and it was misconfigured to be open to the public, on a scale of "annoying" to "company ending event," which end of the spectrum is it? If you're processing PII in documents, and someone shares the document with too wide of an audience, or exfiltrates all the customer records to their home Gmail address, is that annoying, or company ending? Further, do you currently have any incident response processes in place? Because for a non-trivial portion of the DLP space, including Google's offering, they're most likely just going to alert you about it. If you don't already have the organizational muscle memory to ingest and prioritize alerts, adding a DLP product is just going to fill up someone's inbox, or worse: Jira dashboard I'm not being critical or "you must be this tall to ride this ride" type thing, as much as trying to help you think through what a vendor's requirement list should look like for the kinds of risks you're driving down. In my job, finding the right set of questions is much harder than answering them once we know what we're trying to know. I would guess it's similar in a lot of situations, about the unknown unknowns etc