Systems and methods for enforcing data loss prevention policies on endpoint devices
The disclosed computer-implemented method for enforcing data loss prevention policies on endpoint devices may include (i) detecting that an endpoint device has terminated a connection with a protected network that is protected by a network-level data loss prevention system and has connected to an external network that is not protected, (ii) switching, in response to detecting that the endpoint device has connected to the external network, from an in-network data loss prevention policy to an out-of-network data loss prevention policy, (iii) detecting an inbound data transfer to the endpoint device, (iv) determining that the inbound data transfer comprises a transfer from a protected source that is protected by the out-of-network data loss prevention policy, and (v) performing a security action in response to determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source. Various other methods, systems, and computer-readable media are also disclosed.
1. A computer-implemented method for enforcing data loss prevention policies on endpoint devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
detecting, at an endpoint device that comprises an endpoint data-loss prevention agent, that the endpoint device:
has terminated a connection with a protected network that is protected by a network-level data loss prevention system that protects sensitive data on the protected network; and
has connected to an external network that is not protected by the network-level data loss prevention system;
switching, by the endpoint data-loss prevention agent and in response to detecting that the endpoint device has connected to the external network, from an in-network data loss prevention policy that applied to the connection between the endpoint device and the protected network to an out-of-network data loss prevention policy that applies to the connection between the endpoint device and the external network, wherein the out-of-network data loss prevention policy protects the sensitive data by monitoring both inbound and outbound data transfers on the endpoint device;
detecting, by the endpoint data-loss prevention agent, an inbound data transfer to the endpoint device via the external network;
determining, by the endpoint data-loss prevention agent, that the inbound data transfer to the endpoint device comprises a transfer from a protected source that is protected by the out-of-network data loss prevention policy; and
performing, by the endpoint data-loss prevention agent, a security action in response to determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source.
2. The computer-implemented method of claim 1 , wherein the security action comprises blocking the inbound data transfer.
3. The computer-implemented method of claim 1 , wherein the security action comprises encrypting data transferred by the inbound data transfer.
4. The computer-implemented method of claim 1 , wherein the security action comprises creating an audit record documenting the inbound data transfer.
5. The computer-implemented method of claim 1 , further comprising:
detecting an outbound data transfer from the endpoint device;
determining that the outbound data transfer from the endpoint device comprises a transfer of protected data that is protected by the out-of-network data loss prevention policy; and
performing a security action in response to determining that the outbound data transfer from the endpoint device comprises the transfer of the protected data.
6. The computer-implemented method of claim 1 , further comprising:
detecting that the endpoint device has terminated a connection with the external network that is not protected by the network-level data loss prevention system and has initiated a connection with the protected network that is protected by the network-level data loss prevention system; and
switching, in response to detecting that the endpoint device has connected to the protected network, from the out-of-network data loss prevention policy the in-network data loss prevention policy, wherein the out-of-network data loss prevention policy comprises at least one policy rule not present in the in-network data loss prevention policy.
7. The computer-implemented method of claim 6 , wherein switching to the in-network data loss prevention policy comprises ceasing monitoring, by a data loss prevention system on the endpoint device, inbound data transfers to the endpoint device.
8. The computer-implemented method of claim 1 , wherein detecting the inbound data transfer to the endpoint device comprises monitoring a file system process via a plugin that extends the functionality of the file system process by providing information about data received by the file system process.
9. The computer-implemented method of claim 1 , wherein:
detecting the inbound data transfer to the endpoint device comprises identifying the inbound data transfer by a file system driver; and
determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source comprises identifying, by a network driver, an address of the protected source.
10. The computer-implemented method of claim 1 , wherein:
detecting the inbound data transfer to the endpoint device comprises detecting the inbound data transfer via an application programming interface hook to a web browser; and
determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source comprises identifying, by a browser extension, at least one of a uniform resource locator and a server of the protected source.
11. The computer-implemented method of claim 1 , wherein detecting that the endpoint device has terminated the connection with the protected network and has connected to the external network comprises detecting that the endpoint device has terminated a virtual private network connection.
12. The computer-implemented method of claim 1 , wherein detecting that the endpoint device has terminated the connection with the protected network and has connected to the external network comprises detecting that the endpoint device is no longer connected to a predetermined server.
13. The computer-implemented method of claim 1 , wherein determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source that is protected by the out-of-network data loss prevention policy comprises determining that the protected source is within the protected network.
14. A system for enforcing data loss prevention policies on endpoint devices, the system comprising:
a network detection module, stored in memory, that detects, at an endpoint device that comprises an endpoint data-loss prevention agent, that the endpoint device:
has terminated a connection with a protected network that is protected by a network-level data loss prevention system that protects sensitive data on the protected network; and
has connected to an external network that is not protected by the network-level data loss prevention system;
a switching module, stored in memory, that switches, by the endpoint data-loss prevention agent and in response to detecting that the endpoint device has connected to the external network, from an in-network data loss prevention policy that applied to the connection between the endpoint device and the protected network to an out-of-network data loss prevention policy that applies to the connection between the endpoint device and the external network, wherein the out-of-network data loss prevention policy protects the sensitive data by monitoring both inbound and outbound data transfers on the endpoint device;
a transfer detection module, stored in memory, that detects, by the endpoint data-loss prevention agent, an inbound data transfer to the endpoint device via the external network;
a determination module, stored in memory, that determines, by the endpoint data-loss prevention agent, that the inbound data transfer to the endpoint device comprises a transfer from a protected source that is protected by the out-of-network data loss prevention policy;
a security module, stored in memory, that performs, by the endpoint data-loss prevention agent, a security action in response to determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source; and
at least one physical processor that executes the network detection module, the switching module, the transfer detection module, the determination module, and the security module.
15. The system of claim 14 , wherein the security action comprises blocking the inbound data transfer.
16. The system of claim 14 , wherein the security action comprises encrypting data transferred by the inbound data transfer.
17. The system of claim 14 , wherein the security action comprises creating an audit record documenting the inbound data transfer.
18. The system of claim 14 , further wherein:
the transfer detection module detects an outbound data transfer from the endpoint device;
the determination module determines that the outbound data transfer from the endpoint device comprises a transfer of protected data that is protected by the out-of-network data loss prevention policy; and
the security module performs a security action in response to determining that the outbound data transfer from the endpoint device comprises the transfer of the protected data.
19. The system of claim 14 , wherein:
the network detection module detects that the endpoint device has terminated a connection with the external network that is not protected by the network-level data loss prevention system and has initiated a connection with the protected network that is protected by the network-level data loss prevention system; and
the switching module switches, in response to detecting that the endpoint device has connected to the protected network, from the out-of-network data loss prevention policy the in-network data loss prevention policy, wherein the out-of-network data loss prevention policy comprises at least one policy rule not present in the in-network data loss prevention policy.
20. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
detect, at an endpoint device that comprises an endpoint data-loss prevention agent, that the endpoint device:
has terminated a connection with a protected network that is protected by a network-level data loss prevention system that protects sensitive data on the protected network; and
has connected to an external network that is not protected by the network-level data loss prevention system;
switch, by the endpoint data-loss prevention agent and in response to detecting that the endpoint device has connected to the external network, from an in-network data loss prevention policy that applied to the connection between the endpoint device and the protected network to an out-of-network data loss prevention policy that applies to the connection between the endpoint device and the external network, wherein the out-of-network data loss prevention policy protects the sensitive data by monitoring both inbound and outbound data transfers on the endpoint device;
detect, by the endpoint data-loss prevention agent, an inbound data transfer to the endpoint device via the external network;
determine, by the endpoint data-loss prevention agent, that the inbound data transfer to the endpoint device comprises a transfer from a protected source that is protected by the out-of-network data loss prevention policy; and
perform, by the endpoint data-loss prevention agent, a security action in response to determining that the inbound data transfer to the endpoint device comprises the transfer from the protected source.