R77.30 DLP using large Data Dictionary ~3Million Identities.

[coldstone]

I would like to hear from those using Check Point DLP and processing traffic against a large Data Type dictionary.

1. How did you load the dictionary, CP DLP documentation isn't really clear on formats supported.

• Are CSV Files Supported or did you write custom CPCode?
• Can the CSV files have multiple columns per row (fname, lname, ssn, mrn, etc)?
• Match against multiple data value (example fname + ssn = match)

2. Anyone running large data dictionaries approximately 3 Million identities with associated data?

3. Gotchas to keep in mind would be nice. Planning on an integrated deployment model, FW, App, IPS, AV and DLP. on large appliances.

Sorry, I can't be more specific due to NDA restrictions.

Regards.

[ShadowPeak.com]

DLP received a substantial overhaul in R80 and subsequent gateway releases. It will be called "Data Awareness".

[varera]

DLP received a substantial overhaul in R80 and subsequent gateway releases. It will be called "Data Awareness".

And we know why it is awareness and not control anymore :-)

[dangel42]

DLP received a substantial overhaul in R80 and subsequent gateway releases. It will be called "Data Awareness".

Little clarification on this. DLP is pretty much the same in R80.x land. What is new is the addition of what they are calling the Content Awareness blade and it is DLP-lite and not nearly as resource intensive. It will be managed within the Access Control policy as a separate column if it is enabled on that particular layer.