Data Loss Prevention (DLP)
- •
def
- •
tools and processes that stop sensitive data (SSNs, credit card numbers, medical records) from leaving the organization before an attacker can get it
- •
- •
deployment locations
- •
endpoint DLP (data in use), network DLP (data in motion), server DLP (data at rest), and cloud-based DLP (sits between users and the internet, blocking custom-defined data strings, managing URL access, and blocking malware)
- •
- •
email
- •
DLP checks inbound email (blocking keywords, identifying impostors, quarantining messages) and outbound email (fake wire transfers, W-2 data, employee information)
- •
- •
example
- •
November 2008 — the U.S. Department of Defense banned removable flash media after the "agent.btz" worm spread via USB storage; the ban was lifted in February 2010, replaced by strict guidelines
- •
November 2016 — a Boeing employee emailed their spouse a spreadsheet template that contained the hidden personal information of 36,000 Boeing employees; Boeing had its own DLP software, but only used it for classified work
- •
- •
related
- •