Founded in 2011, CrowdStrike is one of the most widely known providers in the security industry. Its core product, CrowdStrike Falcon is a cloud-based cybersecurity solution that monitors activity on endpoints to provide a wide range of features that form a category which has become known as XDR or extended detection and response. CrowdStrike’s platform is seen as robust, yet modular given the scope of its coverage as well as the ability for customers to add functionality through the CrowdStrike Store. As a result of this, and a 2021 acquisition of data security company SecureCircle, the question of whether CrowdStrike specializes in data loss prevention or DLP often comes up. To answer this question, we’ll cover the core functionality of the CrowdStrike Platform as well as its data protection capabilities.

What is CrowdStrike?

CrowdStrike is among the endpoint protection platforms that pioneered the XDR model, which entails bringing together different types of endpoint protection features together with telemetry and analytics from across the organization. These features include:

• Advanced threat protection (ATP) via next-gen anti-virus/anti-malware detection.
• Threat intelligence to address sophisticated and specific threats like ransomware or cyber-attack campaigns from known hackers and hacktivists to aid the security operations center (SOC).
• Traditional endpoint detection and response (EDR) capabilities to bolster ATP functionality and assist in incident investigations.
• Traditional access controls like firewalls to help manage the movement and security of data between devices and over the network.

Crowdstrike’s XDR functionality is a part of a broader framework that the company’s offerings are organized under. ClowdStrike provides threat hunting, identity threat protection and cloud workload security products as well. Via its Falcon Fusion module, security teams can unify and automate workflows across all these different products to enhance threat detection, incident response, and remediation across the org.

What is a data loss prevention solution?

Data loss prevention or DLP solutions refer to a class of platforms that identify and prevent data leakage resulting from the sharing, transfer, or use of sensitive data. Legacy DLP solutions rely on the ability to look at files and classify the contents inside with content classification. Alternatively, some DLP solutions use user-defined tags to associate specific criteria to files individually.

However, as indicated by Gartner, data loss prevention as a category is changing, with many of the traditional ways of DLP falling out of favor. Modern DLP solutions are increasingly offering insider risk management features, like the ability to understand user behavior, identify exfiltration risks, and address insider threats in real-time. Modern DLP also leverages higher accuracy signals like data lineage which allows security teams to identify data exposure incidents and data breach risk with high accuracy and understand the context leading up to the incident.

Data loss prevention’s growing importance

With the rise of hybrid environments, where data flows from endpoints to SaaS and on-premise environments, the ability to cohesively understand data movement and know where sensitive data is at a given moment is becoming an important feature of building an information security program. As such, more organizations are demanding robust DLP solutions, if not by name or by function. As such, DLP-like functionality is becoming an increasingly important part of both endpoint security and cloud security, which is why a CrowdStrike DLP solution is of interest to some security practitioners.

{{ promo }}

Does CrowdStrike offer DLP?

Formally CrowdStrike does not specialize or offer DLP directly. However, through the CrowdStrike Store, users can integrate other solutions like DTEX to monitor these platform’s findings from CrowdStrike’s user interface and to augment investigations carried out through CrowdStrike. The vendor seems to have indicated that it would solely roll out DLP features directly on the platform at an undetermined time. However, given the platform’s focus on XDR capabilities, it’s not clear how extensive these features will be.

DLP as an add-on vs DLP as core functionality

The question of whether DLP should be an add-on or a core functionality is becoming increasingly relevant in today’s security landscape. For platforms like CrowdStrike, which primarily focus on extended detection and response (XDR), DLP will mostly take the form of add-on functionality. However, the growing importance of DLP in information security—especially in hybrid environments—suggests a shift towards making DLP a core functionality. As organizations demand more robust solutions to track and secure data across multiple touchpoints, having a DLP solution that is optimized to track the lifecycle of data created on-premise, in the cloud, and on endpoints will be critical to accelerate investigations and increase the meaningfulness of security alerts and findings. This means going beyond regex, data classification, or even machine learning to show the contents of sensitive data, and being able to provide meaningful analysis of the actions taken against data. This can typically only be enabled through platforms built from the ground up to do so, rather than through best-in-class solutions that bring together very distinct types of functionality under one platform making the question of whether CrowdStrike will be able to specialize in DLP difficult to answer.