Symantec Data Loss Prevention Reviews

Symantec Data Loss Prevention is an enterprise-level solution and we utilize it for its customization, and flexibility across the platform as well as the excellent support and feature levels compared to other similar solutions.

There is still potential for improvement when it comes to data discovery over a network. How successful the process is depends largely on the network configuration and connectivity to the destination. Utilizing a detection server or network discovery can help facilitate the data discovery process. Recently, I discovered around 15,000 to 20,000 shareholders for Symantec using DLP for data discovery. Agent Discovery is also highly effective, with no performance issues showing up when performing endpoint discovery for the Symantec database.

I have not had much experience working with Macs, but they come with an in-built security feature. This can be challenging to work with, as not all features are supported in comparison to Windows. However, the solution recently became compatible with the Linux operating system, allowing us to deploy agents on this system as well.

Symantec Data Loss Prevention is a globally accepted product that provides an enterprise-level view of an organization. Although some of the features the solution offers are being utilized, there is still more potential to be explored if the organization puts more focus on using them to their fullest potential. Recently, the ICD or ID features, which cover all increase points and every other technology, were introduced. The solution provides features that correlate all events and generate top results. In DLP, the role bit and success management are present, allowing us to escalate incidents. We can also define an escalation process, allowing data owners to view incidents and escalate them as necessary. This functionality is provided by the solution. The primary goal of the DLP is to monitor and control the organization's data usage, as well as to facilitate audibility and accountability. Symantec Data Loss Prevention is well-suited to fulfill these needs.

The solution helps us find sensitive data and apply policies based on user risk. We can use indexing for highly confidential documents that are not to be published or shared with more than two to five people outside of the organization, such as the board of directors. Indexed Document Matching is a useful feature that can help ensure that the document remains secure. We can create remote detection over the product and map the UNC part. The data owner will put the file of a particular document, which will be converted into IDX format. We can then apply the policy remotely so that the data will not come to the DLP admin or any other person and will remain protected.

The solution offers a range of pre-defined data identifiers to meet all regulatory requirements, such as those mandated by the GDPR, PHI, PCI, and USUN. These data identifiers can be used to identify and protect personal data globally.

The solution helped reduce the time our DLP administrator spends on data loss protection. Spending time monitoring the data is essential. We have to stay up to date and investigate any issues that arise in order to improve health monitoring by fine-tuning incidents and reducing false positives because automation is not available. 

The solution offers a one-click view from a single console, with detailed incident investigation capabilities that capture activity from end users, the web, and email. Symantec Data Loss Prevention provides comprehensive information conveniently and efficiently while also conforming to good architectural standards.

Compared to Forcepoint DLP, we can see that the email is not available. In Symantec, we are dependent on other products, such as DashMagiq, to release quarantined emails. This is because DashMagiq is able to do this through its API integration with the Office 365 email box. Unlike Forcepoint DLP, we don't have the option to release quarantined emails ourselves.

The detection capabilities are comprehensive. The solution covers all channels and supports cloud scanning. Additionally, the cloud-based solutions provided by CASB offer additional functionalities and now include AdvExt.

Symantec Data Loss Prevention has good detection accuracy. In some instances, the solution can produce a false positive. The solution's Application Monitoring feature allows us to monitor data that should be uploaded through an application; however, it can trigger an incident when the application is opened. The features provided by Broadcom are generally practical, but some of the less-used features may not be as accurate.

Before the release of version 16.0, some features were missing. Location-based detection and USB print blocking are still not available. This means we cannot configure the blocking of a USB printer, and we also cannot identify whether a system is on the network or off the network in a large environment. Additionally, the feature that is currently available is not fully operational. The domain-based resolution can sometimes take time to determine whether the system is accessible over the network or not.

From a management perspective, it takes a lot of time to manage the infrastructure. It seems that having cloud options available would reduce the overhead of managing infrastructure. Depending on the organization, we can choose to have the solution on-premises or on the cloud. If we choose the cloud, we can focus more on data loss prevention instead of managing the infrastructure.

I have been using the solution for seven years.

Both the free and paid technical support from Symantec are good.

Positive

I give the solution a nine out of ten.

The use cases depend on the industry. The use cases for the telecommunication industry and manufacturing industry are different. Typically, the tool is used for data loss prevention.

The product is mature. It has a simplified GUI. We do not have to navigate and hop to different places or UIs to make things work. Everything is in one console. We have a unified platform to do everything. Symantec has one of the best incident management capabilities. It can also be integrated with ServiceNow. We do not have to just use incident management on the Symantec Data Loss Prevention console. We can use ServiceNow, too.

Symantec Data Loss Prevention is a one-stop solution for DLP. Reporting for incidents is a USP of the solution. We get all the details we need. If I detect something but my incident response is weak and does not give me accurate or required details, then it's useless. Any detection will not help me if I do not take prompt action.

The product must provide data encryption. It is integrated with Microsoft MIP to import the labels. It can be used to apply RMS to the files. However, the product must also enable data encryption other than RMS. Elastica must be more flexible and user-friendly. The documentation on the cloud CASB must be more mature. Symantec must reconsider how it is sold to the end user.

I have been using the solution for eight to nine years.

I have never seen Symantec Data Loss Prevention crash or stop working.

I rate the product’s stability a ten out of ten.

Since the solution is deployed on-premise, the scalability depends on us and how much we want based on the resources available. However, the product is very scalable. We just have to get the server installed and connected, and it starts working.

The support people don’t just email us to say they have taken our case. One of the best things is that they give us details and ask about our problems. They prefer getting on calls, which support people from other vendors do not do. Other support teams usually email us and ask us questions. The conversation is only through emails.

Symantec’s support team asks for details initially and tries to get on a call to understand the problem well. They do not wait for five to six days to respond. The response is quick. The engineers at L1 and L2 also know how the product works. It would be one of the best things when the L1 engineer resolves a critical issue caused by bugs. If the issue is due to other environment-related issues, the L2 engineers get on a call and help us.

Positive

The price is a bit high. I do not know Symantec’s sales model, but the pricing is high. Currently, Symantec is providing solutions to certain big customers. I do not think it is good. It deprives other organizations of a very good product.

The solution is more mature than Purview. Symantec Data Loss Prevention is an enterprise product. It is very mature and has different modules. Symantec’s technical team and the end users know the product well. If Microsoft updates something in the backend, the product functionality changes the next day, and we are unaware of it. It is not good when we work in security.

We are partners. I rate the CASB product five out of ten.

Overall, I rate the solution a ten out of ten.

Symantec DMP is for preventing the loss of data from any part of the network, for example, from the network to the core of the data. It has many props, or as it's called in Symantec DLP, "detection servers." There are many detection servers, such as prevention servers and discover servers. Although they can be installed on one server, they can also be deployed on many servers, and they will prevent data leakage in a powerful manner.

Symantec DLP has many servers, and the solution is very powerful because you can use it in ports, endpoints, networks, and email servers to prevent the leakage of emails. DLP can be integrated with Symantec encryption. It's very important because you can integrate these products, and they will protect against the leakage or loss of data. For example, when someone loses flash memory, you can run the automatic response in DLP and encryption, and the flash memory will be encrypted. In the case of the loss of flash memory, it could be easily protected with automatic rules.

Symantec DLP could be better. Symantec DLP is very scalable, but while some other products have been improved in years, Symantec DLP is using core steel, and Symantec could be better with infrastructure.

I've used Symantec DLP for about nine or even ten years.

Symantec DLP is a stable product, and I give its stability a ten out of ten. I have had the solution break down, but it was a user interruption.

I give Symantec DLP's scalability a nine out of ten.

The initial setup is difficult. You need knowledge to use it. Symantec uses Oracle for the database, and not everybody can work with Oracle.

The solution takes one day, but only for server installation. But that is because it has a template. When you deploy the template on an Oracle database, it will take about 30 minutes to deploy the template.

I think that it's an expensive product, even as an enterprise-suite product.

I rate Symantec DLP a nine out of ten. Because of ransomware attacks, you must use a DLP in your environment in today's world.

We have some sectors that have sensitive data, and for that reason we use  Symantec Data Loss Prevention. We have some policies on those sectors so that if somebody uses an ID number or some other sensitive number, we record it in our system.

The benefit is that users can't copy or send sensitive data to another user outside our organization.

It has also helped save so much time. For me, as an administrator of the agents, who installs and puts group policies and rights in place, it saves me 20 or 30 percent of my time.

We can see everything about the users, meaning what kinds of data they use on their computers. When you install the Symantec agent on users' PCs, you define a role for the users and set the policy. We have set rights such that users can't copy sensitive data or send it via email or to USB. After, you can search monthly or yearly and see what kind of data they have used or shared and where they shared the data.

We also like the analytics and reports. We can get yearly reports, six-month reports, and monthly reports for analytics that we can export.

And for administrators and system engineers, it's easy to use, install, maintain, and upgrade. It's also easy for end-users.

For detection, it has a great algorithm. It can recognize ID numbers and everything that you put in a policy for the end-users. That is really great for us as an institution where we have sensitive data. It recognizes all the sensitive data when someone tries to transfer it or put in other data. When that happens it sends me a notification that somebody needs to use an ID or sensitive data. Its accuracy of detection is high.

Another positive aspect is that the speed of discovery is very high. We are very satisfied.

I would like to see changes to the analytics. 

I have been using Symantec since 2018, making it about five years.

It has constantly worked fine for me all these years. I haven't had any problems with it. It's highly stable.

It's also highly scalable.

The support could be more knowledgeable.

However, the firm we bought it from supports me very well. I would rate that firm a 10 out of 10.

Positive

We have only used Symantec File Share Encryption and Data Loss Prevention.

We have it installed on-premises on virtual services.

Deploying it to the end-users was not complex. It was very easy for me. I installed it on about 40 computers, each used by two users, who are all in one location. It took two or three weeks in total.

In terms of maintenance, I maintain the agents and all the servers where Symantec is installed.

I would highly recommend Symantec DLP. This is the best algorithm that I have seen compared to other products.

We use DLP to monitor network traffic and prevent sensitive data from being exfiltrated outside of the company. Symantec also helps us discover data at rest in an environment that may be sensitive. The solution covers more than 10,000 users across various business units and layers, including endpoints, networks, and storage.

DLP is a control instrument for ensuring that an organization complies with regulatory requirements. For example, banks have requirements for storing credit card data, GLBA regulations, etc. DLP can help a bank avoid fines and protect it from civil liabilities.

Companies are audited annually, and DLP improves their risk posture. It ensures business operations won't get shut down because we don't know what we don't know. There are also internal threats, such as people leaving with privileged information on a USB. For instance, an earnings report could be stolen by a disgruntled worker and leaked to competitors. Symantec provides good definitions in the rule set. It can be customized to scan inside documents and pattern-match any unstructured data to comply with what the company needs.

The data-at-rest features are the most valuable because they let us identify data infected with ransomware and prevent employees from being exploited through phishing attacks. If an employee is compromised, the attacker can access servers and deposit ransomware. This enables the attacker to exfiltrate data remotely using employees' credentials. It might be valuable data that could cause a business reputational and financial damage if stolen and publicized. It could also be credit card data or personal health information stored on critical servers.

The false positive rate is excellent. It's about 90 percent accurate and gets better as we fine-tune the rule sets. When we have new incidents, we can work to lower the overall risk based on user behavior on the endpoint, the kinds of data we out on SharePoint, and the type of web or FDP traffic generated internally. I assess the effectiveness of a policy based on the number of false positives generated. We need to tune the rule set if it's greater than 20 percent. 

The solution's data recovery is fast. It depends on the size of your storage, but I have no complaints about the speed of data recovery because there are several detection servers with the necessary horsepower to handle the amount of data that needs to be discovered. It could be remotely scanning a SharePoint server or a file server. The local agents can process data in the expected timeframe.

The upgrade process is convoluted. The server and database software must run in line with third-party providers like the Oracle database. If an Oracle database reaches the end of its life, then servers must be decommissioned, and you need to bring new servers online.

When the maintenance packages are deployed to the management server, they don't get pushed to the detection servers. Each detection server must be manually installed rather than automatically made from a single server. If it's a large enterprise, you need to manually install it or use a GPO or some other technology, which I never use. 

The vendors should also give a heads-up long before updates are released so internal teams can meet their change management lead times. Some vendors don't provide enough notice. They often announce a new version or a vulnerability that needs patching a week before it comes out. It should be a month before. 

The upgrade packages should have better documentation on the upgrade procedure instead of prerequisites spread throughout multiple documents. The wording should be more precise.

I have used the solution for ten years.

Symantec DLP is highly stable. I've operated on Linux and Windows. Linux is stable and doesn't require much patching, but Windows requires more patching, and the service sometimes needs to be restarted. 

Symantec DLP has unlimited scalability if you buy enough licenses. Symantec has servers in the USA, Canada, Asia, and Europe that manage policies differently. For example, Europe has its own compliance rules for GDPR. Incident response can be managed well and segmented away from the rest of the world. You can implement Europe-specific policies. 

I rate Symantec technical support a seven out of ten. 

Neutral

I previously used an appliance called Websense to analyze traffic for data loss. I used other Broadcom tools before Broadcom bought Symantec called Broadcom Proxy and CloudSOC Gateway. I didn't switch from Websense to Broadcom. It was just something I tried, so it wasn't a full deployment. Symantec DLP is head and shoulders above the competing on-prem DLP solutions.

There are a few tricky parts when setting up Symantec DLP, but it's straightforward overall. We used an integrator for the deployment and didn't experience any hiccups after they were finished. About ten people from my company were involved. 

We have two or three people doing maintenance on the solution, like weekly health checks to ensure services are running and traffic flows through the console dashboard. We need to check the incidents generated from the detection servers and verify that everyone can log in. The main part of maintenance is periodic system updates and vulnerability patches.

We see an ROI. During testing, I found it captures and blocks immediately. DLP is able to perform the necessary alerts. We can work with the business and get them on board to see what kind of data they use. We can assign the right roles and manage each business to assess its performance in terms of data loss. Symantec enables us to generate reports to show if their security posture or data loss is changing over time. It's a valuable tool that does what it claims. 

The price of Symantec DLP is fair. I don't recall the cost of the license, but it wasn't outrageous enough that it was an obstacle to approval. I'm not concerned with how much per seat or server, but I know they charge a lot. 

If you're thinking about going for a cheaper solution, I suggest a close comparative analysis of the strengths and weaknesses of each solution by researching online and reading the vendor's documentation. You have to define your security requirements and look at factors like false positive ratios and whether it meets your compliance needs. Some companies only need to meet the minimum regulatory requirements, so a cheap solution that ticks all the right boxes might work. However, if security is the primary goal, you should compare the strengths and weaknesses of that cheap vendor against two or three other DLP vendors.

I didn't evaluate other solutions before choosing Symantec DLP this time, but I evaluated other DLPs for different projects. However, those were cloud-based DLPs, so it's not an apples-to-apples comparison. 

I rate Symantec Data Loss Prevention an eight out of ten.

We use the solution to prevent it from data leakage.

Symantec DLP covers almost all the main trajectory of confidential data, including storage, endpoints, networks, and the cloud. We use it for discovery, prevention and network monitoring on the network side. In the cloud, we use cloud services such as email, detection services, and discovery.

Symantec Data Loss Prevention can both monitor and block data at the endpoint level. It can prevent copying and encoding of HTTP data to various sites like Google, and Webex. It can also prevent data leakage by capturing and blocking various forms of data, including images, videos, and audio. Even if an end user attempts to send an image file or screenshot, it will undergo scanning. Symantec Data Loss Prevention will extract fingerprints from the image and prevent the data from being transmitted.

Data Masking could be improved.

I have been using Symantec Data Loss Prevention as a reseller since 2005.

The product is stable.

I rate the solution’s stability an 8 out of 10.

I rate the solution’s scalability a 7 out of 10.

The initial setup is moderate. It'll take a day or 2, depending on troubleshooting needs and database integration. It only supports Oracle databases.

The product is expensive.

I rate the product’s pricing a 3 out of 10, where 1 is expensive and 10 is cheap.

We do have many built-in components on the policy tab. So, if you're in the UK or anywhere else, we have some pre-built policies, making it easy for users to configure. These policies cover SSN, driver's license information, and other sensitive conversations. Additionally, we have some import policies, making the process even easier.

We have almost 65 components, and we are the ones handling the stack for Broadcom. We are responsible for both level one and level two support for Broadcom.

Overall, I rate the solution an 8 out of 10.

The tool's most valuable feature revolves around the area of IDM.

Creating any new Microsoft policy is easier compared to Symantec Data Loss Prevention. The creation of any new policy in Symantec Data Loss Prevention needs to be made easier.

I have been using Symantec Data Loss Prevention for around five years.

The solution's technical support is available at a toll-free number. We can directly connect with the tool's support team, but it takes some time. The follow-ups will be there from Symantec's end.

Positive

I switched from Symantec to Microsoft. At the time, there were a lot of, and I had an opportunity to work with, Microsoft Teams. I chose to use Microsoft because I got the opportunity to use the tool, and I want to explore this as well. Other DLPs were there in the market, but most of them were associated with Microsoft.

Microsoft's policy management features are better than Symantec's.

The product's deployment phase was easy.

The tool has impacted our cost savings and reduced incident response times. The tool helps save money and protect data.

I think it is an expensive tool.

The policy management capabilities are really effective.

The tool's policy management capabilities aid us in the area of compliance.

The tool integrates with other security tools, just like how Microsoft works.

I have not dealt with any AI capabilities in the tool.

I recommend the tool to others. The software is sufficient, especially support-wise, and it is the same as Microsoft.

I rate the overall tool an eight out of ten.

We use the product to mitigate the malicious attack and prevent data loss for specific servers.

The product helps with blocking sensitive data transmission and permission management.

The product's technical support services need improvement.

We have been using Symantec Data Loss Prevention for three years.

It is a stable product. I rate its stability a nine out of ten.

We have 20 Symantec Data Loss Prevention users in our organization. We use it daily. I rate its scalability a seven out of ten.

The technical support team replies slowly. The process needs enhancement.

Positive

The initial setup takes a few days. However, overall, it requires a month to fine-tune the components. The deployment team includes one or two vendor executives and multiple teams from our organization. One executive can easily maintain the product. I rate the process a seven out of ten.

We take help from third-party integrators for product implementation.

The platform is not very expensive. I rate its pricing an eight out of ten.

I recommend Symantec Data Loss Prevention and rate it a seven out of ten.