Data loss prevention for an online content management platform
Disclosed are systems, methods, and non-transitory computer-readable storage media for providing content management features in a messaging service. A content management system is configured to receive an update to a rule in a data loss prevention (DLP) policy, to identify, based on a log of DLP violations, one or more content items for updating content management permissions, and to update the content management permissions for the one or more content items based on the update to the rule.
1. A non-transitory computer readable medium comprising instructions, the instructions, when executed by a computing system, cause the computing system to:
receive an update to a condition in a rule of a data loss prevention (DLP) policy;
set an outdated flag for a set of content items to be scanned based on the update to the condition;
receive, from a client device, a request for a content item in the set of content items;
determine whether the outdated flag for the requested content item is set;
scan, in response to a determination that the outdated flag for the requested content item is set, one or more content items based on the update to the condition, the one or more content items comprising the requested content item, wherein the request for the content item in the set of content items is received before the scan of the one or more content items is completed;
update, based on the scan, content management permissions for the requested content item;
update a log of DLP violations based on the scan;
remove the outdated flag for the requested content item; and
provide the requested content item to the client device.
2. The non-transitory computer readable medium of claim 1 , wherein the requested content item is provided to the client device based on the content management permissions associated with the requested content item.
3. The non-transitory computer readable medium of claim 1 , wherein the instructions further cause the computing system to:
rescan the requested content item in response to a change in the DLP policy.
4. The non-transitory computer readable medium of claim 1 , wherein the condition comprises a keyword or regular expression.
5. The non-transitory computer readable medium of claim 1 , wherein the scan of the requested content item comprises:
scanning the requested content item stored in a content storage; and
scanning metadata associated with the requested content item stored in a metadata database.
6. The non-transitory computer readable medium of claim 5 , wherein the content storage is separate from the metadata database.
7. A method comprising:
receiving an update to a condition in a rule of a data loss prevention (DLP) policy;
setting an outdated flag for a set of content items to be scanned based on the update to the condition;
receiving, from a client device, a request for a content item in the set of content items;
determining whether the outdated flag for the content item is set;
in response to a determination that the outdated flag for the content item is set, scanning one or more content items based on the update to the condition, the one or more content items comprising the requested content item, wherein the request for the content item in the set of content items is received before the scan of the one or more content items is completed;
updating, based on the scan, content management permissions for the content item;
updating a log of DLP violations based on the scan;
removing the outdated flag for the content item; and
providing, to the client device, a response to the request for the content item.
8. The method of claim 7 , wherein providing the response to the request for the content item comprises providing the content item to the client device based on the content management permissions associated with the content item.
9. The method of claim 7 , further comprising:
rescanning the content item in response to a change in the DLP policy.
10. The method of claim 7 , wherein the condition comprises a keyword or regular expression.
11. The method of claim 7 , wherein the scan of the content item comprises:
scanning the content item stored in a content storage associated with a content management system; and
scanning metadata associated with the content item stored in a metadata database associated with the content management system.
12. The method of claim 11 , wherein the content storage is separate from the metadata database.
13. The method of claim 7 , wherein providing the response to the request for the content item comprises denying the request based on content management permissions associated with the content item.
14. A content management system comprising:
one or more processors; and
at least one non-transitory computer-readable medium storing instructions that, when executed by the one or more processors, cause the content management system to:
receive an update to a condition in a rule of a data loss prevention (DLP) policy;
set an outdated flag for a set of content items to be scanned based on the update to the condition;
receive, from a client device, a request for a content item in the set of content items;
determine whether the outdated flag for the content item is set;
in response to a determination that the outdated flag for the content item is set, scan one or more content items based on the update to the condition, the one or more content items comprising the requested content item, wherein the request for the content item in the set of content items is received before the scan of the one or more content items is completed;
update, based on the scan of the content item, content management permissions for the content item;
update a log of DLP violations based on the scan of the content item;
remove the outdated flag for the content item; and
provide, to the client device, a response to the request for the content item.
15. The content management system of claim 14 , wherein providing the response to the request for the content item comprises providing the content item to the device based on the content management permissions.
16. The content management system of claim 14 , the at least one non-transitory computer-readable medium storing instructions that, when executed by the one or more processors, cause the content management system to:
rescan the content item in response to a change in the DLP policy.
17. The content management system of claim 14 , wherein the condition comprises a keyword or regular expression.
18. The content management system of claim 14 , wherein the scan of the content item comprises:
scanning the content item stored in a content storage associated with the content management system; and
scanning metadata associated with the content item stored in a metadata database associated with the content management system.
19. The content management system of claim 18 , wherein the content storage is separate from the metadata database.
20. The content management system of claim 14 , wherein providing the response to the request for the content item comprises denying the request based on content management permissions associated with the content item.