DSPM Deep Dive: Debunking Data Security Myths

DSPM is the leading acronym in cybersecurity. However, the recent buzz has cluttered the meaning of data security posture management. Let's demystify it.
Kilian Englert
7 min read
Last updated June 19, 2024
DSPM dashboard

There are plenty of technology acronyms in the alphabet soup of the cybersecurity industry, but DSPM is the latest one leading the charge; its recent buzz has brought scrutiny to various security concepts that have cluttered the meaning behind data security posture management. 

DSPM provides visibility into where sensitive data is located, who has access to it, how it's being used, and how the security controls and permissions are configured on the data stores or applications hosting the data. For anybody familiar with Varonis, this should ring a bell. 

If we think about all these layers before the data — the firewalls, the endpoints, the gateways, etc. — this is where traditional security efforts have been focused. The firewalls, endpoints, and gateways are an obstacle for attackers to overcome and pass through, on the way to the real target — the data living in traditional data stores, and in SaaS applications. 

To maintain a strong data security posture, you must protect the data where it lives. That way, if there is a failure or gap at one of those other layers, security is maintained because the core data is locked down. 

So now that we’ve covered what DSPM is, let’s demystify the myths surrounding it.  

Do you prefer listening to reading? Hear Mike Thompson, Security Architect Manager at Varonis, and me give the full breakdown of what DSPM is and the myths surrounding it in this recording 

Myth #1: DSPM is a completely new concept.  

Truth: The concept of DSPM has been around for years.  

Although DSPM is a new term, discovering and protecting sensitive data is not a new concept. However, having a name to define the methodology is helpful. 

In the past, most organizations were not used to thinking with a data-first approach. DSPM, as a term, has opened new ways of thinking about security for people who maybe haven't used this approach previously. 

Many DSPM vendors can show you where you have sensitive data and whether it’s at risk, but they can’t fix that data exposure. 

At Varonis, discovering where sensitive data lives, mapping out the access and permissions, auditing who’s accessing the data, and then taking steps to remediate it and lock it down, has been a part of our mission from the very start.  

Even if DSPM is a new term for old concepts, it helps frame the conversation and gets everyone working toward the same goal: securing valuable data. 

Myth #2 DSPM is all about cloud infrastructure and DevOps.  

Truth: DSPM is about data, and data is everywhere.  

When looking at the current DSPM market, much of the focus is on the data that is attached to infrastructure platforms such as Azure Blob, S3, data lakes, and databases — the core back end where people build different products and solutions. 

But DSPM is more than that. Certainly, the infrastructure and development are part of the methodology, but if we think about where data lives, it doesn't just live in infrastructure platforms. Some of the most critical data lives in SaaS, where users are in control, and SaaS also has a wide attack surface. 

Salesforce, for example, is the back end of many different applications, from finance to healthcare and everything in between, and it’s not just used for sales. A lot of sensitive data can end up here. Users can export that data and upload it to Box, then share it with others, and this cycle continuously repeats itself. 

On the traditional data storage side, think about Google Workspace, Box, or Microsoft 365. These are collaborative platforms where data ends up. But DSPM is not just about the application that data comes into, it’s also about your data’s lifecycle. 

If we think about this from the DevOps side, where teams are building applications that live on this infrastructure, where does that code potentially live? The source code could live in something like GitHub, and that would be another layer needing protection in your data security posture management strategy. 

While much of DSPM focuses on the cloud, it's also important to remember that on-prem is not going anywhere. We can't discount this in terms of your overall posture management. 

The same challenges exist for on-prem, but on a different scale. The data on-prem is still massive and the permissions can potentially be complex, even if we've been living with NTFS permissions for years.  

Myth #3: DSPM is all about discovery.  

Truth: Discovery is only the first stage.  

Discovery is at the top of everyone's mind, and rightfully so. It’s crucial to understand where your data is stored, what type of data is being stored, and how your users are interacting with it.  However, that is just the first stage.  

Companies have enormous amounts of data that grow larger each day. Sorting through one file at a time is not effective or realistic. Automated data discovery gives you additional context to make more informed decisions about what your security policy should look like and how you will execute it.  

Without discovery, organizations can’t make decisions based on the reality of their environment. However, data discovery alone is not the goal — it is just one step and one component in the process to identify and reduce risk. 

What truly matters is how you take those findings and translate them into actual risk reduction and an improved security posture. By formulating policies that your organization can execute — which won’t just live on paper — you’ll be able to keep your data under control.   

To effectively choose where to focus your efforts, prioritizing the sensitivity, permissions, and activity of your data is essential. Ask questions like, “Who can access sensitive data and what can they do with it? Who’s not accessing this data? And who in the company is sharing this information outside of the company to perform their job?" 

Myth #4: Coverage is king. 

Truth: Having deep visibility helps reduce risks.  

This myth is the sibling to myth #3 on discovery we covered above. Performing discovery and finding data on every conceivable platform only gets an organization so far.  

While it is important to think critically about where your data lives, if you don’t have deeper visibility into the platforms and SaaS apps hosting the data, it will be difficult, if not impossible, to measure and reduce the risks around it. You don’t want to check off a box that you’re technically covering everything, when there is not any context given to help reduce risks. 

There's a balance to be had between having visibility in a lot of different areas, and having deep visibility that's actually going to make you have effective security controls.

If you don't have an in-depth layer of visibility and ways to make security actionable, you're missing the posture management side of DSPM. It’s not just about discovery. Proper security must be focused further down and taking the next step to secure your data beyond the surface level.

Reduce your risk without taking any.
Our free Data Risk Assessment takes minutes to set up and delivers immediate value. In less than 24 hours, you'll have a clear, risk-based view of the data that matters most and a clear path to automated remediation.

Myth #5: Workflows equal fixing problems.  

Truth: Workflows often fix surface level problems, not the root cause.  

The fact that a help desk ticket is opened and closed does not mean a problem was truly solved. Workflows and plans are important, but the execution is what matters.  

Workflows leave room for human error, whether it be misjudging the scenario or only fixing the symptom, not the root cause. It’s important to figure out what your process looks like, and stress test the outcomes of workflows implemented.  

As your data grows, you’ll want to ensure your workflows take the scalability of your data into account. SaaS platforms are built for high levels of collaboration, in which your data lives and is shared.  

Automation can help combat threats to your data and make judgment calls when humans can’t, like shutting down access to specific files on the spot if a user’s activity is suspicious.  

Varonis’ approach to DSPM 

At Varonis, we’ve always been all about the data.  

With sensitive information stored in numerous places and the constant uptick in collaboration amongst organizations, your blast radius is only growing. The damage a particular user could do if they were compromised or made a simple mistake keeps growing larger and larger.  

Data is like water, and if you have any cracks, it will leak out. Even if you had a security team of 1,000-plus people, trouble would still be present due to human errors. Security teams need a platform dedicated to all aspects of cybersecurity, including a reliable DSPM solution. 

Varonis protects your data wherever it lives, whether it is in your SaaS repositories, on-prem, private cloud repositories, infrastructure as a service, and/or structured databases. We want to make sure that you have holistic visibility across all areas because data is going to end up in all these places. 

Varonis’ customizable DSPM dashboard allows organizations to easily assess their data security posture with an intuitive and customizable interface. Easily spot risks such as sensitive data exposure, misconfigurations, policy violations, suspicious data activity, stale and risky user identities, and more.  

DSPM Dashboard_DebunkingBlog

Our DSPM dashboards give you and your auditors a real-time, prioritized view of data risk and how it’s changing over time.

Our Data Security Platform not only gives you a high-level view of your risks, but our automation also fixes what it discovers. Our solution has ready-to-go remediation policies built-in and uses least privilege automation so you can discover risks in your environment on day one that will send public and org-wide data exposure packing. Fix misconfigurations with the click of a button thanks to automated posture management. 

Today’s cloud platforms have their own unique security posture challenges, including separate user identities. Varonis allows you to monitor the identities of your users in all the areas your data lives so you can spot malicious activity instantly and understand the typical behaviors in your environment.  

Our Proactive Incident Response team watches your data from day one, so you can put your focus elsewhere and avoid redundant alert emails and notifications. Our analysts leverage our collective security experience and raise not just alerts, but incidents that may require investigation.  

LeastPrivilegeAutomation_DebunkingBlog

Varonis comes with ready-made remediation policies that you can personalize for your organization. You define the rules, and our robots will do the rest.

During a recent webinar, Varonis’ Mike Thompson and I outlined the exact data security strategy we’ve used with 7,000-plus CISOs and how our Data Security Platform is the top choice for organizations looking to prioritize deep data visibility, classification capabilities, and automated remediation for data success. 

Watch the full session to learn more insights around DSPM and how the right solution can help improve your organization's security posture. 

Ready to take action? We recommend getting started with our world-famous Data Risk Assessment to see where your environment is most at risk and increase the protection of your security posture.

What should I do now?

Below are three ways you can continue your journey to reduce data risk at your company:

1

Schedule a demo with us to see Varonis in action. We'll personalize the session to your org's data security needs and answer any questions.

2

See a sample of our Data Risk Assessment and learn the risks that could be lingering in your environment. Varonis' DRA is completely free and offers a clear path to automated remediation.

3

Follow us on LinkedIn, YouTube, and X (Twitter) for bite-sized insights on all things data security, including DSPM, threat detection, AI security, and more.

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.

Keep reading

Varonis tackles hundreds of use cases, making it the ultimate platform to stop data breaches and ensure compliance.

varonis-leads-dspm-market-on-gartner-peer-insights
Varonis Leads DSPM Market on Gartner Peer Insights
As a leader in data security, Varonis is proud to be rated No. 1 in Gartner’s Data Security Posture Management category.
cloud-security-essentials:-the-case-for-automated-dspm
Cloud Security Essentials: The Case for Automated DSPM
Data security posture management (DSPM) has emerged as a standard for securing sensitive data in the cloud and other environments. However, without automation, DSPM doesn’t stand a chance. Automation is crucial to overcoming the challenges of securing data in the cloud.
data-lifecycle-management-(dlm):-everything-you-need-to-know
Data Lifecycle Management (DLM): Everything You Need to Know
Data lifecycle management (DLM) is the process of managing data from creation to deletion. In this article, we’ll cover how DLM works and why you need it.
what-is-data-security-posture-management-(dspm)?
What is Data Security Posture Management (DSPM)?
Learn what data security posture management (DSPM) is and isn't, why it’s important, how it works, and how to evaluate DSPM solutions.