Small-footprint endpoint data loss prevention (DLP)
The technology disclosed presents an improved endpoint data loss prevention (DLP) solution, referred to herein as “small-footprint endpoint DLP (sf-EDLP),” which enforces security policies at endpoints by relying on previously generated sensitivity metadata, rather than by performing content sensitivity scans at the endpoints. Since content sensitivity scans are computationally intensive and time consuming, sf-EDLP leads to a significantly simpler implementation, reduced runtime computation, and a smaller memory footprint; making it suitable for computationally constrained environments such as modern mobile devices.
1. A computer-implemented method of enforcing data loss prevention policies at an endpoint without needing to perform content sensitivity scan at the endpoint, the method including:
receiving, at an endpoint policy enforcer running on the endpoint, data egress requests to push data in documents from the endpoint to uncontrolled locations;
the endpoint policy enforcer having access to a cloud-based metadata store that includes sensitivity metadata previously generated in advance of the requests to classify the documents as sensitive or non-sensitive based on deep inspection of the documents;
wherein the sensitivity metadata data that was generated by an inspection service that inspected the documents while the documents were resident in a cloud-based document store;
wherein the sensitivity metadata data that was generated by an inspection service that inspected the documents while the documents were in transit to or from a cloud-based document store;
in response to receiving a data egress request for a document, the endpoint policy enforcer determining sensitivity of the document by retrieving the sensitivity metadata for the document from the cloud-based metadata store; and
the endpoint policy enforcer enforcing a data loss prevention policy at the endpoint based on the retrieved sensitivity metadata and without performing a content sensitivity scan of the document at the endpoint.
2. The computer-implemented method of claim 1 , further including determining that the retrieved sensitivity metadata identifies the document as sensitive and blocking the data egress request.
3. The computer-implemented method of claim 1 , further including determining that the retrieved sensitivity metadata identifies the document as non-sensitive and allowing fulfillment of the data egress request.
4. The computer-implemented method of claim 1 , wherein the sensitivity metadata further includes data that was generated by an inspection service that inspected the documents while the documents were resident in a mounted file system.
5. The computer-implemented method of claim 1 , further including the endpoint policy enforcer having access to a local metadata store of the sensitivity metadata at the endpoint that is periodically synchronized with the cloud-based metadata store.
6. The computer-implemented method of claim 5 , wherein the endpoint policy enforcer first retrieves the sensitivity metadata for the document from the local metadata store and, if no sensitivity metadata is available for the document in the local metadata store, then retrieves the sensitivity metadata from the cloud-based metadata store.
7. The computer-implemented method of claim 6 , further including, when no sensitivity metadata is available for the document, the endpoint policy enforcer invoking a local anchor pattern scanner running on the endpoint that preliminarily classifies the document as sensitive or non-sensitive based on an anchor pattern check;
sends the document that scored positive on the anchor pattern check to a cloud-based content sensitivity scanner that confirmatory classifies the document as sensitive or non-sensitive based on deep inspection; and
receives sensitivity metadata identifying the confirmatory sensitivity classification.
8. The computer-implemented method of claim 7 , further including, when the local anchor pattern scanner preliminarily classifies the document as non-sensitive based on the anchor pattern check, allowing fulfillment of the data egress request.
9. The computer-implemented method of claim 7 , further including updating the local metadata store to include the sensitivity metadata that identifies the confirmatory sensitivity classification for further data loss prevention policy enforcement at the endpoint.
10. The computer-implemented method of claim 7 , further including keeping the data egress request on hold until the confirmatory sensitivity classification is received.
11. The computer-implemented method of claim 7 , further including the endpoint policy enforcer invoking the local anchor pattern scanner for sensitivity classification of uninspected documents added to the endpoint and updating the local metadata store to identify the sensitivity classification of the uninspected documents for further data loss prevention policy enforcement at the endpoint.
12. A computer-implemented method of controlling exfiltration of data in documents via an endpoint, the method including:
in response to detecting data egress events at the endpoints that would push the data in the documents from the endpoint to uncontrolled locations,
accessing a cloud-based metadata store and retrieving sensitivity metadata previously generated in advance of the data egress events to classify the documents as sensitive or not sensitive based on deep inspection of the documents;
wherein the sensitivity metadata data that was generated by an inspection service that inspected the documents while the documents were resident in a cloud-based document store;
wherein the sensitivity metadata data that was generated by an inspection service that inspected the documents while the documents were in transit to or from a cloud-based document store; and
enforcing data loss prevention policies at the endpoint based on the retrieved sensitivity metadata and without scanning the documents at the endpoint for sensitivity.
13. The computer-implemented method of claim 12 , further including the endpoint having access to a local metadata store of the sensitivity metadata that is periodically synchronized with the cloud-based metadata store.
14. A device for enforcing data loss prevention policies at an endpoint, the device comprising:
a local metadata store maintained at the endpoint and configured to periodically receive from a cloud-based metadata store sensitivity metadata previously generated to classify documents as sensitive or non-sensitive based on deep inspection of the documents;
a local anchor pattern scanner running on the endpoint and configured to preliminarily classify the documents as sensitive or non-sensitive based on an anchor pattern check, to send the documents that scored positive on the anchor pattern check to a cloud-based content sensitivity scanner that confirmatory classifies the documents as sensitive or non-sensitive based on deep inspection, and to receive sensitivity metadata identifying the confirmatory sensitivity classification; and
an endpoint policy enforcer running on the endpoint and configured to respond to data egress requests that would push data in the documents from the endpoint to uncontrolled locations based on sensitivity of the documents determined
by a look up of the local metadata store,
followed by a look up of the cloud-based metadata store for documents not identified in the look up of the local metadata store,
followed by preliminary sensitivity classification by the local anchor pattern scanner of documents not identified in the look ups of the local metadata store and the cloud-based metadata store, and
followed by confirmatory sensitivity classification by the cloud-based content sensitivity scanner of documents that scored positive on the anchor pattern check.
15. A non-transitory computer readable storage medium impressed with computer program instructions, the instructions, when executed on a processor, implement the method of claim 1 .
16. A non-transitory computer readable storage medium impressed with computer program instructions, the instructions, when executed on a processor, implement the method of claim 12 .
17. A system including one or more processors coupled to memory, the memory loaded with computer instructions, the instructions, when executed on the processors, implement actions of claim 1 .
18. A system including one or more processors coupled to memory, the memory loaded with computer instructions, the instructions, when executed on the processors, implement actions of claim 12 .