System and method for forced data leakage prevention
An information handling system operating a forced data leakage prevention system may comprise a processor executing code instructions of the forced data leakage prevention system to identify a third party application and an associated first dynamic link library address, identify a control policy associated with the third party application and the identified user, wherein the control policy includes a subset of code instructions associated with a secure data set, identify a call to execute code instructions stored at the first dynamic link library address, move the code instructions stored at the first dynamic link library into a second library prior to execution, inject the subset of code instructions into the code instructions stored in the second library according to the control policy, and move the code instructions stored in the second library including the injected subset of code instructions into the first dynamic link library for execution by the processor.
1. An information handling system operating a forced data leakage prevention system comprising:
a processor executing code instructions of the forced data leakage prevention system to identify a monitored third party application on the information handling system operated by an identified user and identify a first dynamic link library address associated with the monitored third party application;
the processor to retrieve a control policy associated with the third party application for monitoring and the identified user, wherein the control policy includes a subset of code instructions implementing leakage protection measures for a secure data set;
the processor to detect a call from the monitored third party application to execute code instructions stored in a memory at the first dynamic link library address;
the processor to move the code instructions stored at the first dynamic link library into a second library prior to execution of the code instructions stored at the first dynamic link library;
an injection client operating via the processor to inject the subset of code instructions into the code instructions stored in the second library according to the control policy if the code instructions moved to the second library includes an operation on the secure data set; and
the processor to move the code instructions stored in the second library including the injected subset of code instructions into the first dynamic link library.
2. The information handling system of claim 1 , wherein the subset of code instructions includes code instructions to apply a digital watermark if the third party application is identified as a supported application and the operation on the secure data set includes a print command or a command to transform file data type.
3. The information handling system of claim 2 , wherein the digital watermark identifies the user.
4. The information handling system of claim 1 , wherein the subset of code instructions includes code instructions to:
encrypt the secure data set prior to pasting if the third party application is identified as a supported application and the operation on the secure data set includes copying and pasting the secure data set into a secure document.
5. The information handling system of claim 1 , wherein the subset of code instructions includes code instructions to:
end the process described by the code instructions moved to the second library prior to the operation on the secure data set if the operation on the secure data set includes an operation disallowed by the control policy; and
display a warning to the user that the requested action is disallowed by policy.
6. The information handling system of claim 5 , wherein the third party application is identified as unsupported and the control policy disallows any operation on the secure data set.
7. The information handling system of claim 5 , wherein the third party application is identified as supported and the control policy disallows copying and pasting the secure data set into an unsecure document or printing the secure data set.
8. A method of preventing secure data leakage comprising:
receiving an indication an identified user has started a new user session;
identifying a third party application for monitoring associated with the identified user in a memory, and a first dynamic link library address associated with the third party application for monitoring;
identifying a control policy associated with the third party application for monitoring and the identified user in the memory, wherein the control policy includes a subset of code instructions associated with a secure data set;
identifying a call to execute code instructions stored in the memory at the first dynamic link library address;
prior to execution of the code instructions stored at the first dynamic link library, moving the code instructions stored at the first dynamic link library into a second library;
if the code instructions moved to the second library includes an operation on the secure data set, injecting the subset of code instructions into the code instructions stored in the second library according to the control policy; and
moving the code instructions stored in the second library including the injected subset of code instructions into the first dynamic link library.
9. The method of preventing secure data leakage of claim 8 , wherein the subset of code instructions includes code instructions to apply a digital watermark if the third party application is identified as a supported application and the operation on the secure data set includes a print command.
10. The method of preventing secure data leakage of claim 9 , wherein the digital watermark identifies the third party application.
11. The method of preventing secure data leakage of claim 8 , wherein the subset of code instructions includes code instructions to encrypt the secure data set prior to pasting if the third party application is identified as a supported application and the operation on the secure data set includes copying and pasting the secure data set into a secure document.
12. The method of preventing secure data leakage of claim 8 , wherein the subset of code instructions includes code instructions to end the process described by the code instructions moved to the second library prior to the operation on the secure data set if the operation on the secure data set includes an operation disallowed by the control policy and display a warning to the user that the requested action is disallowed by policy.
13. The method of preventing secure data leakage of claim 12 , wherein the third party application is identified as unsupported and the control policy disallows any operation on the secure data set.
14. The method of preventing secure data leakage of claim 12 , wherein the third party application is identified as supported and the control policy disallows copying and pasting the secure data set into an unsecure document or printing the secure data set.
15. An information handling system operating a forced data leakage prevention system comprising:
a processor executing code instructions of the forced data leakage prevention system to identify a monitored third party application on the information handling system operated by an identified user and identify a first dynamic link library address associated with the monitored third party application;
the processor to retrieve a control policy associated with the third party application for monitoring and the identified user, wherein the control policy includes a subset of code instructions implementing leakage protection measures for a secure data set;
the processor to detect a call from the monitored third party application to execute code instructions stored in a memory at the first dynamic link library address;
the processor to move the code instructions stored at the first dynamic link library into a second library prior to execution of the code instructions stored at the first dynamic link library;
an injection client operating via the processor to inject the subset of code instructions into the code instructions stored in the second library according to the control policy if the code instructions moved to the second library includes an operation on the secure data set;
wherein the subset of code instructions includes code instructions to end the process described by the code instructions moved to the second library prior to the operation on the secure data set and display a warning to the user that the requested action is disallowed by policy if the operation on the secure data set includes an operation disallowed by the control policy; and
the processor to move the code instructions stored in the second library including the injected subset of code instructions into the first dynamic link library.
16. The information handling system of claim 15 , wherein the subset of code instructions includes code instructions to:
apply a digital watermark if the third party application is identified as a supported application and the operation on the secure data set includes a print command.
17. The information handling system of claim 16 , wherein the digital watermark identifies a time of execution of the code instructions including the subset of code instructions stored at the first dynamic link library.
18. The information handling system of claim 15 , wherein the subset of code instructions includes code instructions to:
encrypt the secure data set prior to pasting if the third party application is identified as a supported application and the operation on the secure data set includes copying and pasting the secure data set into a secure document.
19. The information handling system of claim 15 , wherein the third party application is identified as unsupported and the control policy disallows any operation on the secure data set.
20. The information handling system of claim 15 , wherein the third party application is identified as supported and the control policy disallows copying and pasting the secure data set into an unsecure document or printing the secure data set.