“With a series of high profile and expensive data breaches inflicting harm on prominent industries, companies are seeing an increasing need for tools that prevent information leaks,” said IDC Analyst Brian Burke. “The focus is no longer about keeping the ‘bad’ stuff out. We are seeing more and more organizations concerned about keeping their intellectual property and private customer data in, leading to a growing interest in information leak prevention solutions. Accuracy and low false positives will play a very important role in companies selecting and adopting solutions for blocking data leaks.”

Percept Technology Labs recently completed a series of tests, which represent the industry’s first criteria for evaluating the accuracy of Information Leak Prevention products and technologies. This comprehensive set of test cases was used to measure the effectiveness of three competitive products (and their corresponding technologies) in accurately identifying and blocking protected data, while correctly allowing non-confidential data to be distributed via e-mail. Percept ran side-by-side tests and analyzed results for PortAuthority MX, by PortAuthority™ Technologies; IronMail S-10™ by CypherTrust®; and Mail Security Gateway by Symantec™. Each of these products employs a unique mix of technologies to accurately identify the presence of confidential data and properly enforce the correct policy for distribution. Keyword content filtering, regular expression content filtering and PreciseID™ fingerprinting technologies were analyzed during the course of testing. Each product was submitted to nine different test sections:

• Testing for False Positives - Testing for the recognition of legitimate e-mails that should not be blocked by the leak prevention products.
• Records Management - Testing for the protection of structured information such as customer data, which includes names, account numbers, Social Security numbers, driver license numbers, and medical insurance identification numbers.
• Partial Data Recognition - Testing for the protection of small percentages of the original protected document.
• Data Flooding - Testing for the protection of data taken from an original source and inserted into a much larger file in an attempt to disguise an information leak.
• File Type Manipulation - Testing for the protection of data "saved as" a different file name/format.
• Information Contained in e-mail body - Testing for the protection of data copied from a protected document and pasted into the e-mail body.
• File format manipulation - Testing for the protection of data altered in its original format. (e.g., font, font size, spacing, order of text, partial deletion of text, letter changes etc.).
• Specialized Malicious testing: Print Screen - testing the products’ abilities to block confidential data that has been converted into a bitmap, jpeg, or gif file. This is a malicious attempt to sneak data past a security device.
• Specialized Malicious Testing: Hidden Data - Testing for the protection of data that has been hidden within a document. For example, adding a picture to cover text.

Bottom line results showed that PortAuthority’s PreciseID fingerprinting technology demonstrated a significant performance advantage in preventing the three types of data leaks tested – unintentional, intentional and malicious.

1. The PortAuthority product detected 100% of all unintentional and intentional leaks without a single ‘false positive’ or ‘false negative’ event.
2. The PortAuthority product also identified and prevented 66% of the malicious leaks attempted (4 of 6 were prevented), while the other two products demonstrated less than a 1% detection rate.
3. Overall, the PortAuthority product performed more reliably across the tested scenarios than other technologies tested.

According to Percept CEO Brian Cleveland, “Information Leak Prevention is an extremely important issue for today’s companies. The news is full of stories about breaches of confidential information in a variety of industry sectors including governmental agencies, financial institutions, and technology firms. In order for companies to choose the optimal system for their enterprise, they need to have reliable, unbiased data assessing the performance of information leak prevention products and technologies. The recent test results are available on the Percept web site (www.percept.com), and can help companies make the right choice.”

One of the core competencies at Percept is independent comparative analysis testing. Percept’s testing team uses proven methodologies and rigorous test plans to completely and accurately evaluate a wide variety of products and technologies across a matrix of key performance criteria. The test results provide clear and unbiased data used by clients to substantiate marketing claims as well as identify areas for improvement within their product lines. This is a powerful tool for firms looking to establish a competitive edge.

About Percept Technology Labs

Percept Technology Labs is an established, independent product test and consulting company with a proven track record of helping customers test and improve their products since 1996. Specializing in data storage, ITE and consumer electronics products, Percept does more than simply test products in its 5,000 square foot real world and environmentally controlled lab spaces. With years of specialized technology testing experience and absolute commitment to customer care, the Percept team manages the entire product testing, improvement and certification process from start to finish. Percept provides everything clients need to launch and deliver their products around the world – on time and within budget. Customers include leading information technology equipment (ITE), data storage, consumer electronics, scientific instrumentation, and telecommunications firms. To learn about Percept’s full line of testing and consulting services, visit www.percept.com or call 303-444-7480.

# # #