Insider Risk Management

Chapter 2. DLP Versus IRM: Are Both Needed?

As the introduction showed, insider risk is growing, and traditional tools alone cannot keep up. For years, many organizations have relied on data loss prevention (DLP) as the primary safeguard against insider risks. DLP tools are effective at stopping regulated information such as credit card numbers or protected health information from leaving the enterprise, but they miss the subtle context that creates insider risk. Insider risk management fills that gap by looking at intent, and context that traditional DLP cannot see. This chapter compares where DLP and IRM fit, how they complement one another, and why most programs benefit from both.

Imagine this: an employee zips a folder of project files that contain no credit card numbers or Social Security numbers, but does include confidential strategic information, and uploads it to a personal cloud account.

At first glance, this seems like the kind of activity a DLP system should catch. But it does not. DLP is tuned to recognize what the data is, such as credit card numbers, regulated identifiers, health codes, or financial records, and then enforce rules around those patterns. If the files do not match, or if they are encrypted or zipped and unreadable, nothing is flagged. Because traditional DLP cannot interpret context, it overlooks the real warning signs: user risk levels, unusual timing, unfamiliar devices, personal cloud accounts, and behavior that is unusual for a specific role or ...