• The question "who guards the guards" has the potential, like any recursive algorithm, of becoming an infinite loop.

    Let's say you run a full-on trace on every database, in order to do security audits. You, of course, have to safeguard the files from the trace, or they become a means of breaking security. But how do you audit access to those files? Do you set up an audit on the hard drives to see who access what files? Where does that audit data go? How is it secured? Who has access to that? And so on.

    Eventually, it always comes back to a person or group of people, who have to keep security under personal control. And those people have to be trusted (they may or may not be worthy of trust, but you reach a point where you have no choice but to trust someone, or do everything yourself - and then who's trusting you?).

    And, always, security reduces usability, just by its very nature. The whole point of security is to make access more difficult.

    I don't know enough about DLP products to make any real assertions, but I'm sure, in the end, security will still come down to personal responsibility for a small number of people who you just plain have to trust.

    - Gus "GSquared", RSVP, OODA, MAP, NMVP, FAQ, SAT, SQL, DNA, RNA, UOI, IOU, AM, PM, AD, BC, BCE, USA, UN, CF, ROFL, LOL, ETC
    Property of The Thread

    "Nobody knows the age of the human race, but everyone agrees it's old enough to know better." - Anon