ChannelWorld.in, Strategic insights for solution providers

Exceeding Customer Expectations

Since the lead was generated through Websense, ACPL Systems, as a reliable DLP partner, had to succeed and keep the principal trust alive. NIIT’s expectation was to ensure that company confidential data shouldn’t leak or go to unauthorized persons though any data flow channel like email, web, printing, external storage devices, etc, which was successfully achieved during the POC. ACPL Systems put DLP solution in place at the NIIT datacenter in Noida. “In monitoring mode, DLP solution does not interrupt anything, but monitors the entire network. The POC did highlight few security breaches and NIIT was confident that the solution was powerful,” informs Sandhu.

ACPL Systems had the core group meeting to discuss the customer expectations, what all resources would be required, what kind of documentation requirements would be there and other aspects. “We had a customer who is very aware and highly sophisticated in its need, we had to ensure we can deliver our best to them,” he adds.

The datacenter was an integrated common mail server and common internal gateway. The entire traffic in NIIT domain was monitored including attachments and capturing of incidents. Websense Data Security Suite - Data Loss Prevention Solution comprises of lot of default templates including compliances like SOX, ISO for different departments like HR, sales, finance and others. The templates were enabled with discussion and as per customer needs.

NOT EASY BY ANY MEANS

Integration was done with the email system and web proxy system, which was already in place in NIIT’s infrastructure. The main challenge was mapping of the business processes to polices, identification of broken business processes, data classification and incident management process, says Sandhu.

“NIIT's advanced understanding of IT and IT processes required us to be extra vigilant to ensure there are no hick ups,” says Sandhu. On the other hand it did not cause problems in data classification as they had understanding where the data belonged and how much important it was. Only thing which was difficult in case of NIIT was the software code policies for which some special signatures had to be written. “Rest all the business process was same as that of other companies where we had done the deployment,” says Sandhu.

Bindra at ACPL Systems adds, “The main problem is to secure the various source code of customer used for software applications as it is an ongoing process. Classification of data (important and non-important) is a time consuming factor but that is a typical DLP solution. ACPL Systems had to develop newer templates in accordance with Websense as per customer requirements.”

The Fine Tuning

Though there were no challenges business wise, implementation wise, there was lot of fine tuning needed with respect to alerts of senior employees and their attributes, says Chaudhary at NIIT Technologies. “Understanding domain of clients was a major issue for the ACPL team. If a project of our client gets closed, then client domain still has to be live for any other project in future,” he points out.

Every vertical has its set of confidential data. Each department has their own restrictions of certain information to be viewed or attached by certain set of people including keywords, attachments. All these crucial business information was mapped onto the technology side of DLP solution. Workflow is the key in DLP which alerts the incident manager whether it is genuine need or not. To make each process owner understand the entire DLP cycle of monitor, alert, restrict, protect took some time says Sandhu.

“As database of alerts become huge, it will be difficult to manage this huge number. Classification and monitoring of datalogs need to be reviewed regularly with respect to aspects like what duration, in accordance with regulations,” says Chaudhary.

NIIT Technologies is implementing the DLP solution phase wise. Chaudhary reasons, “Such solutions have resistance to change from employees as there are lot of alerts in place and related security checks. But, the solution is seeping well into our system.” “Though Websense gave us a deadline of 3 months (which is over), we are taking it slow and steady to ensure proper acceptance of DLP in our system,” he adds. The project should be completed by year end. “ACPL team is responding well in past three months for the project and we are seeing benefits of the project,” says Chaudhary.

ACPL Systems put their 2 senior most people in DLP for this project looking at complexity of project. “There was never a moment when we felt that the project would fail as all the aspects of implementation and integration were well documented before the project initiation and during the POC,” says Sandhu.

THE ROAD AHEAD

The benefits of DLP are multifold for NIIT as Chaudhary says, “Productivity is enhanced as the surveillance keeps employees more on the office job. Blocking restricted sties has helped the software development company to save bandwidth. DLP gives regulatory benefit as banning of restricted sites means there is no violation of IT Act. Restricting uploads to unwanted sites and stealing data gives alerts are other key advantages.”

The cost reduction associated with data protection and process improvement will free operating capital for investment in the company’s growth opportunities. Once sensitive data leaves the company, its value can be decimated—along with the competitive advantage it offered, says Sandhu. ROI of DLP is purely based on incidents and not necessarily monetary benefits like other IT deployments, he adds.

When our customers conduct audit, endpoints are protected with DLP apart from gateway protection at NIIT, it gives them assurance that their service provider has a robust security department in place, adds Chaudhary. Secure networks do instill more confidence in our customer database, he admits.