Methods and systems for preventing transmission of sensitive data from a remote computer device
A technique for preventing selected sets of data words from unauthorized transmission out of the secure perimeter of a computer system is disclosed. A set of security rules is applied to an outgoing data message and if one of the set of rules is triggered, scanning by another set of security rules. The server then executes the security command before transmitting the outgoing message out of the secure perimeter of the computer system or blocking transmission.
1. A computer system secured against unauthorized communications of outgoing messages comprised of at least one exact data word from an egress point of the computer system, the computer system comprising:
a memory;
at least one server;
at least one remote device connected to the at least one server by a data network, wherein the at least one remote device is authorized to communicate with the at least one server using the data network in order to transmit to the at least one server the outgoing messages comprised of at least one predetermined exact data word,
wherein the at least one server includes a data scanning component, the data scanning component configured by logic to:
detect at least one candidate exact data word by parsing alphanumeric text data within an outgoing message transmitted to the at least one server from the at least one remote device, the alphanumeric text data representing the at least one candidate exact data word,
attempt to match the detected at least one candidate exact data word against a predetermined set of exact data words,
in dependence on a result of the matching attempt, select at least one security rule and determine a security action using the selected at least one security rule, wherein the selected at least one security rule is comprised of a data structure encoding a logical test for determining whether a subset of the predetermined set of exact data words is present within the outgoing message, said subset being selected by utilizing a heuristic engine that applies a heuristic word selection rule, and wherein the heuristic word selection rule comprises:
skipping over a second word from a plurality of words when the second word has a word-length that is shorter than a first word-length of a shortest registered entity of a plurality of compressed registered entities; and
skipping over a third word from a plurality of words when the third word has a word-length that is longer than a second word-length of a longest registered entity of the plurality of compressed registered entities, and
execute the determined security action on the matched at least one candidate exact data word prior to permitting transmission of the outgoing message through the egress point.
2. The computer system of claim 1 , wherein the heuristic word selection rule is comprised further of:
skipping over a first word from a plurality of words when the first word matches a first stop word of a plurality of stop words.
3. The computer system of claim 1 , wherein the data scanning component is further configured by logic to convert a portion of the outgoing message into a canonical format, wherein the canonical format causes the data scanning component to be impervious to differences in digital format and character encoding.
4. The computer system of claim 1 , wherein the selected at least one security rule corresponds to at least one corresponding data type that is to be secured from unauthorized transmission.
5. The computer system of claim 1 , wherein the determined security action is comprised of:
preventing a portion of data comprising the matched at least one candidate exact data word from being transmitted through the egress point to an exterior of the computer system.
6. The computer system of claim 1 , wherein the data scanning component is further configured by logic to scan the outgoing message using a first at least one security rule to identify a set of at least one exact data word of a predetermined set of words,
wherein a portion of content of the outgoing message transmitted to the at least one server is the identified set of at least one exact data word;
wherein the at least one server is further configured by logic to reduce a possibility that the identified set of at least one exact data word is comprised of a false positive;
wherein the at least one server is further configured by logic to automatically generate an acknowledgement message encoding whether each exact data word in the identified set of at least one exact data word matches the selected at least one security rule stored on the at least one server, and transmit the acknowledgement message to the at least one remote device; and
wherein the at least one server is further configured by logic to perform the determined security action on the outgoing message before the outgoing message is transmitted through the egress point.
7. The computer system of claim 6 , wherein the selected at least one security rule stored on the at least one server encodes a logical condition dependent on at least one of location of the matched at least one candidate exact data word within a document comprising the outgoing message; a data type associated with the matched at least one candidate exact data word comprising content of the outgoing message or an origin information of a particular document.
8. The computer system of claim 6 , wherein the determined security action includes one or more of:
preventing the matched at least one candidate exact data word of the outgoing message from being transmitted through the egress point;
logging transmission of content of the outgoing message as a security violation; and
actuating a user interface process on the at least one remote device for requiring a password from a user to allow the portion of the content of the outgoing message to be disclosed.
9. The computer system of claim 1 , wherein the determined security action is comprised of:
logging transmission of a portion of content of the outgoing message as a security violation.
10. The computer system of claim 1 , wherein the determined security action is comprised of:
operating a user interface protocol on the at least one remote device for requiring a password from a user to allow a portion of content of the outgoing message to be transmitted.
11. The computer system of claim 1 , wherein the determined security action is comprised of:
blocking access by a user who transmitted a portion of content of the outgoing message to a user of the at least one remote device.
12. The computer system of claim 1 , wherein the determined security action is comprised of:
transmitting a security alert.
13. The computer system of claim 1 , wherein the determined security action is comprised of:
integration of a portion of content of the outgoing message with rights management information.
14. The computer system of claim 1 , wherein the detected at least one candidate exact data word matching at least one exact data word of the predetermined set of exact data words indicates that the outgoing message is confidential.
15. A method executed by a computer system comprised of at least one server and a remote computer connected to the at least one server by a data network, to secure the computer system against unauthorized external communications of data items from an egress point of the computer system, said method comprising:
transmitting from the remote computer to the at least one server an outgoing message comprised of a document;
using the at least one server to automatically inspect data comprising content of the outgoing message received from the remote computer to determine if the outgoing message is comprised of data indicating a message destination accessed through the egress point;
in dependence on the determination and prior to permitting transmission of the outgoing message, scanning by parsing alphanumeric text data comprising the content of the outgoing message in order to detect at least one exact data word; and
using the at least one server to determine a security action by executing an at least one security rule on the detected at least one exact data word and executing the determined security action on the outgoing message prior to permitting transmission of the outgoing message through the egress point,
wherein the at least one security rule is comprised of a data structure encoding a logical test for determining whether a subset of a predetermined set of exact data words is present within the outgoing message, said subset being selected by utilizing a heuristic engine that applies a heuristic exact data word selection rule, and wherein the heuristic exact data word selection rule comprises:
skipping over a second word from a plurality of words when the second word has a word-length that is shorter than a first word-length of a shortest registered entity of a plurality of compressed registered entities; and
skipping over a third word from a plurality of words when the third word has a word-length that is longer than a second word-length of a longest registered entity of a plurality of compressed registered entities.
16. The method of claim 15 , wherein the heuristic exact data word selection rule is comprised further of:
skipping over a first word from a plurality of words when the first word matches a first stop word of a plurality of stop words.
17. The method of claim 15 , further comprising:
using the at least one server to convert a portion of the outgoing message into a canonical format, wherein the canonical format causes the scanning step to be impervious to differences in digital format and character encoding.
18. The method of claim 15 , wherein the at least one security rule corresponds to at least one corresponding entity exact data word that is to be secured from unauthorized transmission.
19. The method of claim 15 , wherein the determined security action includes one or more of:
preventing a portion of data comprising the detected at least one exact data word of the outgoing message from being transmitted through the egress point;
operating a user interface process on the remote computer for requiring a password from a user to allow a portion of the outgoing message to be transmitted; or
integrating a portion of the outgoing message with rights management information.
20. The method of claim 15 , further comprising:
using the at least one server to scan the outgoing message using the at least one security rule to identify a set of at least one exact data word of a predetermined set of exact data words;
automatically generating an acknowledgement message encoding whether each exact data word in the identified set of at least one exact data word matches the at least one security rule;
transmitting the acknowledgement message to the remote computer; and
using the at least one server to perform the determined security action on the outgoing message before the outgoing message is transmitted through the egress point.
21. The method of claim 20 , wherein the at least one security rule encodes a logical condition dependent on at least one of:
a location of the detected exact data word comprising the content of the outgoing message within the document, or a data type associated with the detected exact data word comprising the content of the outgoing message.
22. The method of claim 15 , wherein the determined security action is comprised of:
logging transmission of a portion of content of the outgoing message as a security violation.
23. The method of claim 15 , wherein the determined security action is comprised of:
operating a user interface protocol on the remote computer for requiring a password from a user to allow a portion of the content of the outgoing message to be transmitted.
24. The method of claim 15 , wherein the determined security action is comprised of:
blocking access by a user who transmitted a portion of the content of the outgoing message to a user of the remote computer.
25. The method of claim 15 , wherein the determined security action is comprised of:
transmitting a security alert.
26. The method of claim 15 , wherein the determined security action is comprised of: integration of a portion of the content of the outgoing message with rights management information.