AWS CloudTrail vs. Cisco TrustSec vs. Symantec Data Loss Prevention

It is necessary to enable [AWS] Cloudtrail when using AWS in a production environment, otherwise you will not have any idea what is happening within your accounts. Third party monitoring applications will all require [AWS] CloudTrail to be enabled as well. I would not recommend it solely as a monitoring tool, to get the most out of it you must send the logs elsewhere. Either to Cloudwatch logs or a third party product.

Incentivized

• Control access to critical enterprise resources by business role, device type, and location, so policy changes can be made without redesigning the network.
• Easily manage access control and segmentation while maintaining compliance.
• Create and manage policies in an easy-to-use matrix.
• Reduce the need for costly network re-architecture by automating firewall rules and access control list (ACL) administration.

Incentivized

Email, web browser, and data storage areas will fulfill the security of mobile devices very well. It provides multiple methods of data filtering and classification to ensure important data can be well protected. Unfortunately, it does not support you to make regex-based definitions. for this reason, you need to work on the rules a lot. Another disadvantage is that it cannot monitor Linux systems.

Incentivized

• API Log
• User activity tracking
• Real-time alerts

Incentivized

• Reduce operational expenses by simplifying network segmentation and defining security groups based on business roles, not IP addresses.
• Limit the impact of a data breach by quickly isolating and containing threats using technology already in your network.

Incentivized

• Protection against Data Leakage via the USB channel on endpoints.
• Protection against Data Leakage via email channel on endpoints
• Protection against Data Leakage over the Web channel on endpoints.
• Flexible and configurable for various types of content inspection.

Incentivized

• [In my experience] Cost can easily get out of control with multiple trails on full logging
• Logs can be difficult to decipher

Incentivized

• Help and solutions if needed, support

Incentivized

• Policy tweaking and customizations can be very complex and take a lot of effort and time.
• API integration is difficult and requires specialized support. Finding an experienced professional can be difficult.

Incentivized

Symantec DLP works good for our very simple and low complexity use cases and I would highly recommend it for them. However, I can't speak to highly complex or advanced use cases that might arise in certain industries like finance. I would recommend that if you are seeking an Enterprise DLP solution that you absolutely must explore this product as one of the leaders in the space - not doing so would be negligent in my opinion.

Incentivized

I think in the end, CloudTrail has more features and you can dive deeper inside the logs so it depends on your usage and what you expect in the end to make the right choice, I would say that both tools are really useful and bring a lot of benefits to I.T. companies.

Incentivized

Symantec DLP is the best. Put it in a head to head competition and it will win. However it can be a bit more expensive than other products so don't compare on price, compare on quality of product.

• Allows us to investigate any strange api actions
• Increases security
• Audit trail of changes made in AWS

Incentivized

• Reduction in IT operational costs

Incentivized

• Found data that should have been protected or moved to a different location
• Helped us understand what type of data is leaving the environment