Systems and methods for preventing data loss from data containers

1. A computer-implemented method for preventing data loss from data containers, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying, at the computing device, a process running in a data container on the computing device;

identifying the process as a minimal process due to absence of at least one of a dynamic link library, a thread environment block, or a process environment block;

intercepting an attempt by the process to exfiltrate information from the computing device via at least one of a file system operation or a network operation, wherein intercepting comprises:

intercepting an application programming interface (API) call with a shim; and

redirecting, from the shim, the API call to at least one of a data loss prevention file system driver or a data loss prevention network driver; and

performing a security action to prevent the intercepted attempt.

2. The computer-implemented method of claim 1 , wherein the data container comprises a server container.

3. The computer-implemented method of claim 1 , further comprising monitoring file system operations of the process and network operations of the process.

4. The computer-implemented method of claim 1 , wherein the attempt by the process to exfiltrate information occurs via the file system operation and the file system operation comprises at least one of an open operation, a read operation, or a write operation.

5. The computer-implemented method of claim 1 , wherein the attempt by the process to exfiltrate information occurs via the network operation and the network operation includes creating an Internet Protocol socket.

6. The computer-implemented method of claim 1 , wherein the security action is performed according to a data loss prevention policy.

7. The computer-implemented method of claim 1 , wherein the attempt by the process to exfiltrate information occurs via the file system operation and performing the security action further comprises at least one of:

blocking the file system operation;

encrypting the information;

converting the file system operation to read-only;

blocking a write operation of the file system operation;

preventing the process from accessing a device that is external to the data container; or

inspecting the information to identify at least a portion of the information as sensitive information.

8. The computer-implemented method of claim 1 , wherein the attempt by the process to exfiltrate information occurs via the network operation and performing the security action further comprises at least one of:

encrypting the information;

interrupting creating a socket;

preventing creating a socket;

blocking the network operation;

preventing the process from accessing a device that is external to the data container;

preventing the process from sending the information via a network coupled to the computing device; or

inspecting the information to identify at least a portion of the information as sensitive information.

9. The computer-implemented method of claim 1 , wherein identifying further comprises identifying a related minimal process external to the container.

10. The computer-implemented method of claim 1 , wherein identifying further comprises:

identifying a memory-mapped image loaded by the process; and

caching, from the memory-mapped image, a minimal process identifier.

11. The computer-implemented method of claim 1 , wherein the API call is a write operation configured to write a file from the data container to a storage device that is external to the data container.

12. The computer-implemented method of claim 1 , wherein the intercepting further comprises:

interrupting process file access;

retrieving, from a cache, a minimal process identifier;

identifying the process from the minimal process identifier; and

determining the process is not permitted to access a device external to the data container.

13. The computer-implemented method of claim 1 , wherein the intercepting further comprises:

interrupting an attempt by the process to write a file;

retrieving, from a cache, a minimal process identifier;

identifying the process from the minimal process identifier;

identifying a presence of sensitive information in the file by inspecting the file; and

determining the process is not permitted to write the file to a device external to the data container.

14. The computer-implemented method of claim 1 , wherein the intercepting further comprises:

interrupting an attempt by the process to read a file;

retrieving, from a cache, a minimal process identifier;

identifying the process from the minimal process identifier; and

determining the process is not permitted to read the file.

15. The computer-implemented method of claim 1 , wherein the intercepting further comprises:

interrupting an attempt by the process to create an Internet Protocol socket;

retrieving, from a cache, a minimal process identifier;

identifying the process from the minimal process identifiers; and

determining the process is not permitted to connect to a device external to the data container.

16. The computer-implemented method of claim 1 , wherein a single data loss prevention agent identifies the process, intercepts the attempt, and performs the security action.

17. The computer-implemented method of claim 1 , wherein identifying the process, intercepting the attempt, and performing the security action are performed external to the data container.

18. A system for preventing data loss from data containers, the system comprising:

at least one physical processor; and

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

identify a process running in a data container on the system;

identify the process as a minimal process due to absence of at least one of a dynamic link library, a thread environment block, or a process environment block;

intercept an attempt by the process to exfiltrate information from the system via at least one of a file system operation or a network operation, wherein intercepting comprises:

intercepting an application programming interface (API) call with a shim; and

redirecting, from the shim, the API call to at least one of a data loss prevention file system driver or a data loss prevention network driver; and

perform a security action to prevent the intercepted attempt.

19. The system of claim 18 , further comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to identify a related minimal process external to the container.

20. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify a process running in a data container on the computing device;

identify the process as a minimal process due to absence of at least one of a dynamic link library, a thread environment block, or a process environment block;

intercept an attempt by the process to exfiltrate information from the computing device via at least one of a file system operation or a network operation, wherein intercepting comprises:

intercepting an application programming interface (API) call with a shim; and

redirecting, from the shim, the API call to at least one of a data loss prevention file system driver or a data loss prevention network driver; and

perform a security action to prevent the intercepted attempt.