Contextual data loss prevention for a group-based communication system
A system, method, and computer-readable media for providing contextual data loss prevention (DLP) within a group-based communication system. At least a portion of a DLP policy may be suspended within a DLP engine based on a context for which a user input is to be displayed. Accordingly, the user input may be displayed without interference from the DLP engine.
1. One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by a processor, perform a method of data loss prevention (DLP) within a group-based communication system, the method comprising:
receiving a first user input in a first channel of the group-based communication systems wherein the first channel of the group-based communication system is accessible to a first plurality of users;
applying, through a DLP engine, a DLP policy to the first user input;
based on applying the DLP policy, if the first user input violates the DLP policy, inhibiting display of the first user input in the first channel of the group-based communication system;
in response to the first user input violating the DLP policy, creating a second channel of the group-based communication system, wherein the second channel of the group-based communication system is accessible to a second plurality of users comprising a subset of the first plurality of users;
wherein the second channel is a vault channel for sharing sensitive information in a safe manner;
receiving a second user input in the second channel of the group-based communication system; and
in response to applying the DLP policy, displaying the second user input in the second channel.
2. The one or more non-transitory computer-readable media of claim 1 , wherein at least one of the first user input or the second user input is a file upload.
3. The one or more non-transitory computer-readable media of claim 1 , wherein the second user input is displayed for a predetermined period of time, and after expiration of the predetermined period of time, the second user input is deleted from the second channel.
4. The one or more non-transitory computer-readable media of claim 3 , wherein the predetermined period of time is configurable by a user.
5. The one or more non-transitory computer-readable media of claim 4 , wherein the method further comprises deleting the second channel from the group-based communication system after expiration of an additional predetermined period of time.
6. The one or more non-transitory computer-readable media of claim 1 , further comprising:
based at least in part on contents of the first user input, displaying a prompt to transfer the contents of the first user input to the second channel.
7. The one or more non-transitory computer-readable media of claim 1 , further comprising:
preventing a capture operation based at least in part on a context for the second channel.
8. A method of data loss prevention (DLP) within a group-based communication system, the method comprising:
receiving a first user input in a first channel of the group-based communication systems wherein the first channel of the group-based communication system is accessible to a first plurality of users;
applying, through a DLP engine, a DLP policy to the first user input;
based on applying the DLP policy, if the first user input violates the DLP policy, inhibiting display of the first user input in the first channel of the group-based communication system;
in response to the first user input violating the DLP policy, creating a second channel of the group-based communication system, wherein the second channel of the group-based communication system is accessible to a second plurality of users comprising a subset of the first plurality of users;
wherein the second channel is a vault channel for sharing sensitive information in a safe manner;
receiving a second user input in the second channel of the group-based communication system; and
in response to applying the DLP policy, displaying the second user input in the second channel.
9. The method of claim 8 , wherein at least one of the first user input or the second user input is a file upload.
10. The method of claim 8 , wherein the second user input is displayed for a predetermined period of time, and after expiration of the predetermined period of time, the second user input is deleted from the second channel.
11. The method of claim 10 , wherein the predetermined period of time is configurable by a user.
12. The method of claim 10 , wherein the method further comprises deleting the second channel from the group-based communication system after expiration of an additional predetermined period of time.
13. The method of claim 8 , further comprising:
based at least in part on contents of the first user input, displaying a prompt to transfer the contents of the first user input to the second channel.
14. The method of claim 8 , further comprising:
preventing a capture operation based at least in part on a context for the second channel.
15. A data loss prevention system comprising:
a data store; and
a processor, programmed to perform a method of data loss prevention (DLP) within a group-based communication system, the method comprising:
receiving a first user input in a first channel of the group-based communication system, wherein the first channel of the group-based communication system is accessible to a first plurality of users;
applying, through a DLP engine, a DLP policy to the first user input;
based on applying the DLP policy, if the first user input violates the DLP policy, inhibiting display of the first user input in the first channel of the group-based communication system;
in response to the first user input violating the DLP policy, creating a second channel within of the group-based communication system, wherein the second channel of the group-based communication system is accessible to a second plurality of users comprising a subset of the first plurality of users;
wherein the second channel is a vault channel for sharing sensitive information in a safe manner;
receiving a second user input in the second channel of the group-based communication system; and
in response to applying the DLP policy, displaying the second user input in the second channel.
16. The data loss prevention system of claim 15 , wherein at least one of the first user input or the second user input is a file upload.
17. The data loss prevention system of claim 15 , wherein the second user input is displayed for a predetermined period of time, and after expiration of the predetermined period of time, the second user input is deleted from the second channel.
18. The data loss prevention system of claim 17 , wherein the predetermined period of time is configurable by a user.
19. The data loss prevention system of claim 17 , wherein the method further comprises deleting the second channel from the group-based communication system after expiration of an additional predetermined period of time.
20. The data loss prevention system of claim 15 , wherein the method further comprises:
based at least in part on contents of the first user input, displaying a prompt to transfer the contents of the first user input to the second channel.