Endpoint data loss prevention (DLP)

1. A computer-implemented method of enforcing data loss prevention policies at an endpoint, the method comprising:

maintaining, at the endpoint, a metadata store that comprises sensitivity metadata corresponding to individual data elements, wherein the maintaining comprises periodically synchronizing the metadata store with a cloud-based metadata store and wherein the sensitivity metadata is generated by a cloud-based content sensitivity scanner and configured to classify individual sensitivity levels of the individual data elements;

receiving, at the endpoint, a request for a first data element of the individual data elements;

determining, at the endpoint, that the request comprises a request for egress of the first data element;

retrieving a first sensitivity level corresponding to the first data element; and

enforcing the data loss prevention policies in accordance with the first sensitivity level.

2. The computer-implemented method of claim 1 , wherein the step of enforcing the data loss prevention policies comprises determining that the first sensitivity level identifies the first data element as sensitive and blocking the request for the first data element.

3. The computer-implemented method of claim 1 , wherein the step of enforcing the data loss prevention policies comprises determining that the first sensitivity level identifies the first data element as non-sensitive and allowing fulfillment of the request for the first data element.

4. The computer-implemented method of claim 1 , wherein the sensitivity metadata comprises data that was generated by the cloud-based content sensitivity scanner through inspection of a selection of the individual data elements while the individual data elements were resident in a cloud-based document store.

5. The computer-implemented method of claim 1 , wherein the sensitivity metadata comprises data that was generated by the cloud-based content sensitivity scanner through inspection of a selection of the individual data elements while the individual data elements were in transit to or from a cloud-based document store.

6. The method of claim 1 , wherein the step of retrieving the first sensitivity level corresponding to the first data element comprises retrieving the first sensitivity level corresponding to the first data element from the metadata store at the endpoint.

7. The method of claim 6 , wherein the endpoint does not access the cloud-based metadata store during the steps of receiving, determining, retrieving, and enforcing.

8. The method of claim 1 , wherein the step of retrieving the first sensitivity level corresponding to the first data element comprises:

identifying that the first sensitivity level is not available at the metadata store at the endpoint;

requesting the first sensitivity level from the cloud-based metadata store; and

receiving the first sensitivity level at the endpoint.

9. The computer-implemented method of claim 8 , further comprising keeping the request on hold until the first sensitivity level is retrieved.

10. A non-transitory computer readable storage medium having stored thereon computer program instructions that, upon execution by one or more processors, cause the one or more processors to:

maintain a metadata store that comprises sensitivity metadata corresponding to individual data elements, wherein the maintaining comprises periodically synchronizing the metadata store with a cloud-based metadata store and wherein the sensitivity metadata is generated by a cloud-based content sensitivity scanner and configured to classify individual sensitivity levels of the individual data elements;

receive a request for a first data element of the individual data elements;

determine that the request comprises a request for egress of the first data element;

retrieve a first sensitivity level corresponding to the first data element; and

enforce data loss prevention policies in accordance with the first sensitivity level.

11. A device for enforcing data loss prevention policies at an endpoint, the device comprising:

a metadata store, comprising sensitivity metadata corresponding to individual data elements, the sensitivity metadata generated by a cloud-based content sensitivity scanner and configured to classify individual sensitivity levels of the individual data elements, the metadata store configured to be synchronized periodically with a cloud-based metadata store; and

an endpoint policy enforcer in communication with the metadata store, configured to:

receive, at the endpoint, a request for a first data element of the individual data elements;

determine, at the endpoint, that the request comprises a request for egress of the first data element;

retrieve a first sensitivity level corresponding to the first data element; and

enforce the data loss prevention policies in accordance with the first sensitivity level.

12. The device of claim 11 , wherein the endpoint policy enforcer is configured to step retrieve the first sensitivity level corresponding to the first data element from the metadata store at the endpoint.

13. The device of claim 12 , wherein the endpoint policy enforcer is configured to receive, determine, retrieve, and enforce without accessing the metadata store.

14. The device of claim 11 , wherein the endpoint policy enforcer is configured to retrieve the first sensitivity level corresponding to the first data element at least by:

identifying that the first sensitivity level is not available at the metadata store at the endpoint;

requesting the first sensitivity level from the cloud-based metadata store; and

receiving the first sensitivity level at the endpoint.

15. The device of claim 14 , wherein the endpoint policy enforcer is further configured to keep the request on hold until the first sensitivity level is retrieved.

16. The device of claim 11 , wherein the endpoint policy enforcer is configured to enforce the data loss prevention policies at least by determining that the first sensitivity level identifies the first data element as sensitive and blocking the request for the first data element.

17. The device of claim 11 , wherein the endpoint policy enforcer is configured to enforce the data loss prevention policies at least by determining that the first sensitivity level identifies the first data element as non-sensitive and allowing fulfillment of the request for the first data element.

18. The device of claim 11 , wherein the metadata store comprises sensitivity metadata that was generated by the cloud-based content sensitivity scanner-through inspection of a selection of the individual data elements while the individual data elements were resident in a cloud-based document store.

19. The device of claim 11 , wherein the metadata store comprises sensitivity metadata that was generated by the cloud-based content sensitivity scanner-through inspection of a selection of the individual data elements while the individual data elements were in transit to or from a cloud-based document store.