DLP Software is a waste of money
Over the past like 7ish years and through a few jobs I have had to deal with DLP software and trying to make it work. Be it for contractual obligations, compliance regulations, or general security purposes I have had to vet, pov, poc, and pilot many solutions over the years. They are all 100% horrible products. All of which are designed for very specific types of environments and the second you shift outside that paradigm a modicum the software becomes more and more worthless.
I work in majority Mac and Linux shops, but I have always had some presence of Windows as well. So, it is in our best interest to find cross platform tools for things like this, which is normally fine most DLP solutions do "support" multiple platforms.
The first thing I do is rip the installer package apart on all of the security software I have to deploy, and oh boy do zero of these vendors know how to make an installer package. In the Windows world I will often get EXEs over MSIs, or get a MSI but the install switches do not work. Thus, I have had to wrap exe installers around in PowerShell code to make basic functionality work. PowerShell isn't really even my strongest language but here I am wrapping up shitty EXE installers in PS code to make it work. On the Mac side it is even worse. They embed base64 packages with in a package, kernel extensions, horrible postinstall scripts that do horrid things like `kill -HUP Finder` or just straight gansgta like `kill -9` which is horrible. If I am paying 100s of thousands of dollars for enterprise software, you should build a standard installer package that works. So on the macOS side I have boiler plated so many horrible agent installers with Python code.
Deploying these tools is pretty much asinine. I cannot tell you how many slide decks I have seen about using AD joined devices to manage the install. I have to interrupt these people and then subsequently remind them dozens of times we do not join anything to AD. We do not even have on prem AD at all, we are a cloud company. DLP is so behind the curve with modern tech and it really shows. Then I end up dealing with some asinine deployment method, like passing API keys in code, making REST calls to some cloud tenant, and having to write tons of code to register each user or device because we don't BIND anything to AD. Again, this shows that security devs don't know shit about systems. Not a single management tool to my knowledge does full E2EE, so that code is always gonna hit disk at some point and it will be in clear text. If you know where to look, you can easily scrape credentials from scripts run on client computers. So, the security vendors are literally practicing horrible security standards, but in the name of security. Irony at its best. Also, if they block OS updates because they can't guarantee their agents will work in new OSes day 1, the product is garbage.
The fun stuff! I also do things like run a `strings` search against their binaries, and also disassemble them to look at their guts. Woo boy, do these products shell out a ton, and I mean a ton! I have found so many undocumented horrible things, like one specific DLP I demoed last year (which we yeeted into the sun) had an undocumented string labeled `auto_uninstall`. So, you bet your ass I ran it, and guess what it did? Exactly as advertised, but with zero security measures. It bypassed tamper protection, password protection, and unloaded all kexts and deleted itself from the system. If your product has a kill switch in it, it is not a good product. Now tamper protection is a whole other subject and I got some strong opinions on it, but that is an entire thread of its own.
When I go back to these security developers and show them these huge flaws in their product they simply do not care. One CEO of a specific DLP product (when we were telling them we weren't interested) told me over the a web conference that they did not see the problem with any of my complaints. Basically, what I got out of that is that they essentially said, "We don't care about IT or operations, that is your problem, just write a bunch of scripts!"
They do horrible things! I caught one DLP product actually monitoring `stdin` for specific commands in context and would issue a `kill -9` if it was detected. This sir, is called a race condition, and you are now killing functionality that IT/Ops may want to use (guess how I found it?). Also, easily bypassed with simple shell I/O redirect which means then the product is now broken because I can easily bypass it by either writing to disk, or redirecting my I/O to something your `stdin` watchpath doesn't account for. Also the fact that I can easily embed base64 data in say a jpeg file and the DLP solution is too stupid to realize that a 500MB jpeg file is probably a risk.
We are 90% macOS, \~7% win10 and \~3% Linux. All of our user are local admin, and I don't want to change this. We are 100% cloud and have zero on prem. Most DLP vendors do not even know how to address this. I won't even get into the performance hit they have when you are doing anything that requires some compute power.
​
TL;DR DLP should stand for "Doesn't Likely Protect" Sorry if y'all have to run or support DLP software, but I get it that it may be a business requirement. They are all horrible.
/rant