Data owner controls in DLP
Systems and methods include receiving an index of data for exact data matching, wherein the index includes Personally Identifiable Information (PII); receiving policy related to actions to perform for any violations associated with the exact data matching; loading the index and the policy into memory; monitoring traffic for violations, wherein the violations include detection of any values in the index in the traffic; and performing an action responsive to any violations and associated policy. The action can be one of reporting the violation, blocking the traffic associated with the violation, reporting the violation and allowing the traffic associated with the violation when the violation is based on authenticated PII, allowing the traffic associated with the violation when the violation is based on authenticated PII, and a combination thereof.
1 . A method comprising:
receiving an index of data for exact data matching, wherein the index includes Personally Identifiable Information (PII);
receiving policy related to actions to perform for any violations associated with the exact data matching;
loading the index and the policy into memory;
monitoring traffic for violations, wherein the violations include detection of any values in the index in the traffic, wherein the monitoring is continuous inline monitoring of the index in real-time; and
performing an action responsive to any violations and associated policy,
wherein the index is based on a one-way hash to transform the data into a digest, such that the data is unreadable by a cloud-based system, wherein the data is one or more look up tables is provided by a virtual appliance, and wherein the virtual appliance is auto-updated via a cloud feed node.
2 . The method of claim 1 , wherein the action is one of reporting the violation, blocking the traffic associated with the violation, and a combination thereof.
3 . The method of claim 1 , wherein the action is a combination of two or more of:
reporting the violation,
blocking the traffic associated with the violation,
reporting the violation and allowing the traffic associated with the violation when the violation is based on authenticated PII, and
allowing the traffic associated with the violation when the violation is based on authenticated PII.
4 . The method of claim 1 , further comprising
detecting a violation is authenticated PII of a user performing transmission of the traffic, and allowing the authenticated PII.
5 . The method of claim 1 , further comprising
detecting a violation is authenticated PII where the traffic is associated with a data owner of the authenticated PII, and allowing the authenticated PII; and
detecting a second violation is unauthenticated PII, and blocking the second violation.
6 . The method of claim 1 , wherein the index further includes a user identifier, and the policy is tenant-specific and defines access privileges for users, and further includes allowability of some or all of the PII that is authenticated PII, wherein the authenticated PII includes PII for a given user based on the user identifier.
7 . A non-transitory computer-readable medium comprising instructions that, when executed, cause one or more processors to perform steps of:
receiving an index of data for exact data matching, wherein the index includes Personally Identifiable Information (PII);
receiving policy related to actions to perform for any violations associated with the exact data matching;
loading the index and the policy into memory;
monitoring traffic for violations, wherein the violations include detection of any values in the index in the traffic, wherein the monitoring is continuous inline monitoring of the index in real-time; and
performing an action responsive to any violations and associated policy,
wherein the index is based on a one-way hash to transform the data into a digest, such that the data is unreadable by a cloud-based system, wherein the data is one or more look up tables is provided by a virtual appliance, and wherein the virtual appliance is auto-updated via a cloud feed node.
8 . The non-transitory computer-readable medium of claim 7 , wherein the action is one of reporting the violation, blocking the traffic associated with the violation, and a combination thereof.
9 . The non-transitory computer-readable medium of claim 7 , wherein the action is one of
reporting the violation,
blocking the traffic associated with the violation,
reporting the violation and allowing the traffic associated with the violation when the violation is based on authenticated PII,
allowing the traffic associated with the violation when the violation is based on authenticated PII, and
a combination thereof.
10 . The non-transitory computer-readable medium of claim 7 , wherein the steps further include
detecting a violation is authenticated PII of a user performing transmission of the traffic, and allowing the authenticated PII.
11 . The non-transitory computer-readable medium of claim 7 , wherein the steps further include
detecting a violation is authenticated PII where the traffic is associated with a data owner of the authenticated PII, and allowing the authenticated PII; and
detecting a second violation is unauthenticated PII, and blocking the second violation.
12 . The non-transitory computer-readable medium of claim 7 , wherein the index further includes a user identifier, and the policy further includes allowability of some or all of the PII that is authenticated PII, wherein the authenticated PII includes PII for a given user based on the user identifier.
13 . A node in a cloud-based system comprising
a network interface;
a processor communicatively coupled to the network interface; and
memory storing instructions that, when executed, cause the processor to:
receive an index of data for exact data matching, wherein the index includes Personally Identifiable Information (PII),
receive policy related to actions to perform for any violations associated with the exact data matching,
load the index and the policy into memory,
monitor traffic for violations, wherein the violations include detection of any values in the index in the traffic, wherein the monitoring is continuous inline monitoring of the index in real-time; and
perform an action responsive to any violations and associated policy,
wherein the index is based on a one-way hash to transform the data into a digest, such that the data is unreadable by the cloud-based system, wherein the data is one or more look up tables is provided by a virtual appliance, and wherein the virtual appliance is auto-updated via a cloud feed node.
14 . The node of claim 13 , wherein the action is one of reporting the violation, blocking the traffic associated with the violation, and a combination thereof.
15 . The node of claim 13 , wherein the action is one of
reporting the violation,
blocking the traffic associated with the violation,
reporting the violation and allowing the traffic associated with the violation when the violation is based on authenticated PII,
allowing the traffic associated with the violation when the violation is based on authenticated PII, and
a combination thereof.
16 . The node of claim 13 , wherein the instructions that, when executed, further cause the processor to
detect a violation is authenticated PII where the traffic is associated with a data owner of the authenticated PII, and allowing the authenticated PII.
17 . The node of claim 13 , wherein the instructions that, when executed, further cause the processor to
detect a violation is authenticated PII where the traffic is associated with a data owner of the authenticated PII, and allowing the authenticated PII, and
detect a second violation is unauthenticated PII, and blocking the second violation.
18 . The node of claim 13 , wherein the index further includes a user identifier, and the policy further includes allowability of some or all of the PII that is authenticated PII, wherein the authenticated PII includes PII for a given user based on the user identifier.