Data loss prevention for an online content management platform
Disclosed are systems, methods, and non-transitory computer-readable storage media for providing content management features in a messaging service. A content management system is configured to receive an update to a rule in a data loss prevention (DLP) policy, to identify, based on a log of DLP violations, one or more content items for updating content management permissions, and to update the content management permissions for the one or more content items based on the update to the rule.
1. A method comprising:
performing a scan of a collection of content items stored on a content management system to determine if any content items are in violation of a rule of a data loss prevention (DLP) policy, wherein the rule comprises a condition and a restriction;
updating content management permissions for one or more content items in violation of the rule;
generating, based on the scan, a log of DLP violations, wherein each violation comprises a first reference to a content item in violation of the rule and a second reference to the rule that was violated;
receiving an update to the rule in the DLP policy;
identifying, based on the log of DLP violations, a content item for updating one or more content management permissions based on the update to the rule;
updating the one or more content management permissions for the content item based on the update to the rule;
receiving an access request based on a link to at least one content item stored on the content management system; and
denying the access request based on content management permissions for the at least one content item,
wherein performing the scan of the collection of content items comprises scanning content items stored in a content storage or scanning metadata associated with the content items, the metadata being stored in a metadata database, wherein the content storage is separate from the metadata database.
2. The method of claim 1 , wherein the update to the rule comprises one of a removal of the rule from the DLP policy or a change in the restriction of the rule in the DLP policy.
3. The method of claim 1 , wherein the restriction comprises at least one of a first limitation on downloading content items to a client device or a second limitation on sharing content items.
4. The method of claim 1 , wherein the update to the rule is received from a client device associated with an administrator for a group of content management system users.
5. The method of claim 1 , wherein the condition comprises a keyword or regular expression.
6. A non-transitory computer-readable medium comprising:
instructions that, when executed by a computing system, cause the computing system to:
perform a scan of a collection of content items stored on a content management system to determine if any content items are in violation of a rule of a data loss prevention (DLP) policy, wherein the rule comprises a condition and a restriction;
update content management permissions for one or more content items in violation of the rule;
generate, based on the scan, a log of DLP violations, wherein each violation comprises a first reference to a content item in violation of the rule and a second reference to the rule that was violated;
receiving an update to the rule in the DLP policy;
identify, based on the log of DLP violations, a content item for updating one or more content management permissions based on the update to the rule;
update the one or more content management permissions for the content item based on the update to the rule;
receive an access request based on a link to at least one content item stored on the content management system; and
deny the access request based on content management permissions for the at least one content item,
wherein performing the scan of the collection of content items comprises scanning content items stored in a content storage or scanning metadata associated with the content items, the metadata being stored in a metadata database, wherein the content storage is separate from the metadata database.
7. The non-transitory computer-readable medium of claim 6 , wherein the update to the rule comprises one of a removal of the rule from the DLP policy or a change in the restriction of the rule in the DLP policy.
8. The non-transitory computer-readable medium of claim 6 , wherein the restriction comprises at least one of a first limitation on downloading content items to a client device or a second limitation on sharing content items.
9. The non-transitory computer-readable medium of claim 6 , wherein the update to the rule is received from a client device associated with an administrator for a group of content management system users.
10. The non-transitory computer readable medium of claim 6 , wherein the condition comprises a keyword or regular expression.
11. A system comprising:
a processor; and
a non-transitory computer-readable medium storing instructions that, when executed by the system, cause the system to:
perform a scan of a collection of content items stored on a content management system to determine if any content items are in violation of a rule of a data loss prevention (DLP) policy, wherein the rule comprises a condition and a restriction;
update content management permissions for one or more content items in violation of the rule;
generate, based on the scan, a log of DLP violations, wherein each violation comprises a first reference to a content item in violation of the rule and a second reference to the rule that was violated;
receiving an update to the rule in the DLP policy;
update, based on the update to the rule, one or more content management permissions associated with a content item identified based on the log of DLP violations;
receive an access request based on a link to at least one content item stored on the content management system; and
deny the access request based on content management permissions for the at least one content item,
wherein performing the scan of the collection of content items comprises scanning content items stored in a content storage or scanning metadata associated with the content items, the metadata being stored in a metadata database, wherein the content storage is separate from the metadata database.
12. The system of claim 11 , wherein the update to the rule comprises one of a removal of the rule from the DLP policy or a change in the restriction of the rule in the DLP policy.
13. The system of claim 11 , wherein the restriction comprises at least one of a first limitation on downloading content items to a client device or a second limitation on sharing content items.
14. The system of claim 11 , wherein the update to the rule is received from a client device associated with an administrator for a group of content management system users, and wherein the condition comprises a keyword or regular expression.