Method and apparatus for associating data loss protection (DLP) policies with endpoints

1. A method of policy management in a data loss prevention (DLP) system, comprising:

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated; and

determining a set of endpoints to which a policy is to be distributed by:

identifying the user owning the endpoint;

retrieving a list of roles or groups for that user; and

defining the set of policies as the policies that reference each role or group to which the user is associated;

wherein at least one of the determining steps is performed using a computer program executing in a hardware element.

2. The method as described in claim 1 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

3. The method as described in claim 2 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

4. The method as described in claim 3 further including generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

5. The method as described in claim 4 further including distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.

6. Apparatus for policy management in a data loss prevention (DLP) system, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method comprising:

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated; and

determining a set of endpoints to which a policy is to be distributed by:

identifying the user owning the endpoint;

retrieving a list of roles or groups for that user; and

defining the set of policies as the policies that reference each role or group to which the user is associated.

7. The apparatus as described in claim 6 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

8. The apparatus as described in claim 7 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

9. The apparatus as described in claim 8 wherein the method further includes generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

10. The apparatus as described in claim 9 wherein the method further includes distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.

11. A computer program product in a non-transitory computer readable medium for policy management in a data loss prevention (DLP) system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;

determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated; and

determining a set of endpoints to which a policy is to be distributed by:

identifying the user owning the endpoint;

retrieving a list of roles or groups for that user; and

defining the set of policies as the policies that reference each role or group to which the user is associated.

12. The computer program product as described in claim 11 wherein the step of determining the set of endpoints to which the policy is to be distributed generates an endpoint set.

13. The computer program product as described in claim 12 wherein the endpoint set for the policy is generated by the following sub-steps:

for each role or group that is a target of the policy, identifying each user associated with the role or group;

for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and

adding the one or more endpoints from the list into the endpoint set.

14. The computer program product as described in claim 13 wherein the method further includes generating a policy distribution list that includes the endpoint set associated with one or more policies to be distributed to the endpoints.

15. The computer program product as described in claim 14 wherein the method further includes distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.