Deep Packet Inspection vs Browser Extensions: A Case Study on Entertainment Organizations

In 2018, the Motion Picture Association of America launched a content security initiative known as Trusted Partner Network (TPN) that was meant to elevate the security standards adopted by organizations in the film and television industry.

Among best practices, vendors have requirements and recommendations around internal training, third-party security audits, cryptography in use, building lists of trusted devices, and implementing email and web filtering. These practices are designed to ensure security at all levels of the organization, including around data in transit.

Over the past few years, Endpoint Protector by CoSoSys has become a trusted partner to organizations in the industry. Thanks to a wide spectrum of functionalities, the Endpoint Protector Data Loss Prevention (DLP) solution has been facilitating their path towards becoming a TPN member. But, while its functionalities can address various needs, today, we are going to focus on one in particular, web filtering, as transfers of data between vendors and studios typically happen via unique websites.

One of the purposes of web filtering within a DLP solution is to allow the upload of sensitive content to approved web repositories while blocking every other action taken at the browser level. There are two ways of accomplishing this: Deep Packet Inspection or Browser Extensions.

So let’s take a look at the way these technologies operate.

Deep Packet Inspection

Deep Packet Inspection (DPI) typically operates at the network level, inspecting the content of data packets and making decisions about whether to allow or block specific traffic. By inspecting packet content, it can identify websites or applications and enforce whitelisting or blacklisting policies, enabling a more comprehensive analysis of web traffic, including encrypted connections.

Through real-time monitoring of network traffic, DPI enables rapid response to potential data loss incidents and takes automated actions based on predefined policies set across an entire network.

Browser Extensions

In contrast, browser extensions add functionalities to web browsers, including features related to whitelisting or blacklisting websites. Those focused on whitelisting and blacklisting often provide users with direct control, enabling them to add or remove websites from these lists. They may also provide functionalities like blocking the uploads of specific file types, restricting clipboard actions, or scanning web content for sensitive data. Nevertheless, these extensions operate within a specific browser without having a network-wide impact.

Choosing the Right Approach

Both of these technologies can contribute to DLP solutions. However, when looking at implementing DLP in your environment to create this kind of exception, it is important to make an informed decision by considering the key differences between the two:

1. DPI offers network-wide coverage allowing it to monitor and analyze data packets across the entire network infrastructure, addressing data loss risks not only from web browsers but also from other applications such as Slack or Microsoft Teams. On the other hand, browser extensions are limited to the web browser’s environment.
2. DPI often offers centralized management which enables administrators to set and enforce DLP policies across the entire network and simplifies policy deployment, monitoring, and updates. Browser extensions often rely on user-initiated actions or decisions. If users overlook warnings or choose to ignore prompts, there’s a risk of unintentional data loss.
3. DPI provides consistent protection across different browsers and applications, ensuring a uniform security posture regardless of the user’s choice of tools. Browser extensions need to be compatible with different browsers and their versions. Changes in browser updates or conflicts with other extensions can affect the proper functioning of a DLP solution.
4. DPI can perform deep content analysis, examining the actual content of data packets. This enables more accurate identification of sensitive information, even if it is embedded within files or encrypted communications. On the other hand, identifying subtle or sophisticated data loss techniques can be challenging for browser extensions. Advanced threats may find ways to bypass or evade the detection mechanisms, leading to potential gaps in DLP coverage.

Endpoint Protector uses a comprehensive DPI technology that allows real-time monitoring of network traffic for immediate detection and response to potential data loss incidents. As described above, the functionality extends beyond URL whitelisting and blacklisting. It allows the recording of destinations in the logs, the scanning of the email body or the information typed in applications like Slack, and the application of email domain whitelisting. To learn more, schedule your demo here.