Why data-loss prevention tools scare the hell out of some

MacLean said one drawback Barclays has noticed in its DLP installation is that it's "CPU-intensive" and might impact some real-time communications. But she also noted DLP's broader capabilities are only beginning to be explored as a tool to monitor how business partners, such as outsourcing firms or call centers, treat sensitive data that's shared. "You have to be able to put in your own castle walls with your business partners," she said.

Symantec Vontu isn't the only DLP in town. The range of host- and network-based content-monitoring products (also sometimes called "data-leak prevention" or "data-loss protection") is growing, including those from McAfee, Proofpoint, Reconnex,Verdasys, Vericept and Websense, plus EMC, which last year acquired Tablus and is now partnering with Cisco on DLP.

MedStar Health, which operates hospitals in the Washington, D.C., area, two years ago almost deployed the Reconnex gear in its Maryland data center area to make sure that no patient healthcare data covered under the US federal Health Insurance Portability and Accountability Act would leak.

But according to Ron Baklarz, the former director of information systems there (and now Amtrak's chief information systems officer), DLP turned out to be a general education tool about what people were doing. Sometimes that meant finding out that employees were doing things online that had to be stopped, such as downloading pornography.

Getting the attention of legal staff or others on the business side wasn't always easy in terms of DLP, says Baklarz, but probably the best approach he found was to set them up with a log-in to the Reconnex console so they could see what was going on.

"You need to partner with them on compliance," says Baklarz, noting the business people need to be active participants in data monitoring, not leaving it to the IT department.

"People once used to think what you don't know won't hurt you, but what you don't know will hurt you,' says Baklarz, adding he found DLP so important, he plans to bring it into Amtrak for use there, too.