DSPM and DFPM - Friends or Foes

In this article we’ll discuss DSPM and DFPM, their similarities and differences, and the value that each one brings.

What is DSPM?

DSPM stands for Data Security Posture Management. DSPM platforms provide insight and automation to enable security teams to address data security and compliance issues and prevent their recurrence:

• Where is the data stored
• What type of data is stored
• Who or what has access to the data

There is more nuance that we will discuss later in this article.

What is DFPM?

DFPM stands for Data Flow Posture Management. DFPM platforms provide automation and centralization of the identification, classification, and remediation of security risks across code, environments, and services – allowing teams to be proactive about data flow security. DFPM sounds similar to DSPM, but the two differ in focus. DFPM enables companies to fully understand:

• What exact data is flowing to third parties 
• What data is flowing over various protocols
• What data flow governance policies are currently active, and which ones are actively being violated

How are DSPM and DFPM Different? ‍

The similarities are obvious - both provide data visibility for improved security. The difference is, DSPM platforms focus on analyzing data at rest while DFPM platforms focus on data in motion.

Understanding How DSPM and DFPM Interplay

While they may includes other capabilities, DSPM and DFPM platforms generally consists of four key components:

• Data discovery
• Data classification
• Risk assessment and prioritization
• Remediation and prevention

However, the overlap isn’t readily noticeable, as each approach implements these four components at different layers within a data ecosystem.

To give an example, think of the two like a pie. In this example, DSPM would be the center filling, while DFPM would be the crust, operating on the borders. DSPM platforms like Normalyze, Cyera,and Laminar answer important questions about the center of the data ecosystem like:

• Given an AWS account, are there S3 buckets which store PII and if so, what type of IAM policies are associated with this sensitive data? 
• What processes are accessing this data?

DFPM platforms answer questions about the entire border of the data ecosystem –where an organization’s controls are often weak. Below are a few questions that a DFPM platform would answer: 

• Which exact line of code in the codebase is responsible for sending data from inside the company to any third party? 
• Once the data is in flight, what governance controls are in place to manage the transfer of this data?

Are Both DSPM and DFPM Necessary? ‍

Absolutely yes; one can’t replace the other. They each offer different focus areas and capabilities. While one is not dependent on the other, both are required for end-to-end protection across the entire data management lifecycle.

Why Modern Organizations Need DFPM

A DFPM platform is built to equip teams with the tools needed to maintain full visibility of data in transit and to remediate any risks before they reach a 3rd-party. With Riscosity, teams get continuous visibility into where data is going, can mask or redirect sensitive data, and are able to simplify how they meet data security, privacy, and compliance requirements. Ready to implement a DFPM program? We’d love to talk to you - find a time that works for you here.