Method and apparatus for associating data loss protection (DLP) policies with endpoints
A method of policy management in a Data Loss Prevention (DLP) system uses a policy model that associates a user with one or more DLP endpoints. When an endpoint is added to the system, a set of policies for that endpoint are determined using an identity of the user that is associated with the endpoint and a list of roles or groups for that user. At policy distribution time, the method determines a set of endpoints to which the policy is to be distributed.
1. A method of policy management in a data loss prevention (DLP) system, comprising:
defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and
determining a set of endpoints for distribution of a policy by generating an endpoint set, the endpoint set for the policy generated by the following sub-steps:
for each role or group that is a target of the policy, identifying each user associated with the role or group;
for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and
adding the one or more endpoints from the list into the endpoint set, wherein at least one of the determining steps is performed using a computer program executing in a hardware element;
generating a policy distribution list that includes the endpoint set associated with one or more policies for distribution to the endpoints; and
distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.
2. The method as described in claim 1 , wherein the set of policies for the endpoint reference each role or group to which the user is associated.
3. An apparatus for policy management in a data loss prevention (DLP) system, comprising:
a processor;
computer memory holding computer program instructions that when executed by the processor perform a set of operations comprising:
defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and
determining a set of endpoints for distribution of a policy by generating an endpoint set, the endpoint set for the policy generated by the following sub-steps:
for each role or group that is a target of the policy, identifying each user associated with the role or group;
for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated; and
adding the one or more endpoints from the list into the endpoint set;
generating a policy distribution list that includes the endpoint set associated with one or more policies for distribution to the endpoints; and
distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.
4. The apparatus as described in claim 3 , wherein the set of policies for the endpoint reference each role or group to which the user is associated.
5. A computer program product in a non-transitory computer readable medium for policy management in a data loss prevention (DLP) system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a set of operations comprising:
defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user; and
determining a set of endpoints for distribution of a policy by generating an endpoint set, the endpoint set for the policy generated by the following sub-steps:
for each role or group that is a target of the policy, identifying each user associated with the role or group;
for each user associated with the role or group, identifying a list of one or more endpoints with which the user is associated;
adding the one or more endpoints from the list into the endpoint set; and
generating a policy distribution list that includes the endpoint set associated with one or more policies for distribution to the endpoints; and
distributing each policy included in the distribution list to the endpoints identified in its associated endpoint set.
6. The computer program product as described in claim 5 , wherein the set of policies for the endpoint reference each role or group to which the user is associated.