“If you look at how you can stop 80% of data breach incidents involving an insider, it's a zip file going into a personal Gmail account. If you can detect and block that, and lock the user's account, you have just stopped 80% of incidents. These very basic primitives, like blocking a large zip file into a personal Gmail, that's one of your big rocks right there. You can fill most of the jar with big rocks, and there aren't too many of them.”
sputnikintelligence.com
Patrick Gray and Push Security's CEO were discussing data loss prevention done in the browser rather than on the network. The 80% figure is Gray's own, unsourced claim; this is a sponsored Soap Box episode and Gray says he advises Push.
sticks out in the browser, right? Like it's so on the PFDF
…Google ad, which went redirected through like a sites.google.com or like Microsoft Dynamics or whatever it might be, and then landed on this place, which injected something into the clipboard. That context just gives you much, much higher fidelity detections. You can't get off of the wire.
No, no, 100%. And I think, look, DLP is the same, right? Let's bring it back to the DLP conversation because I think like if you look at like how you want to stop, how you can stop like 80% of data breach incidents involving an insider, it's zip file going into a personal Gmail account. If you can detect, block that, lock the user's account, you have just stopped 80% of incidents. Like it is really crazy. Like, you know, we always talk about the, well, I always, I can't even remember who gave me this metaphor to begin with, but the, you know, the rocks in the jar. So you start by filling up the jar with big rocks and you can only squeeze so many in. So then you start putting in some smaller stones and then some pebbles and eventually sand. You know, these very basic primitives here, like blocking a large zip file into a personal Gmail, that's one of your rocks right there. And you can fill up most of the jar with these big rocks and it's not too many of them.
Yeah, for sure. And like, honestly, a lot of the stuff you can do as well, just through access control. Like if you imagine someone's default state with AI usage, they're sitting there with their hair on fire, border tournament. You need to adopt AI as quickly as possible. But yeah, I also don't…
This is what I was going to say, right? Like you look at the way CASB, CASB, like the reason I never talk about that, the reason I've never had a CASB sponsor is because that stuff is just mega jank.
Yeah, it's hated, man.