SYSTEM, METHOD, AND COMPUTER PROGRAM PRODUCT FOR PREVENTING DATA LEAKAGE UTILIZING A MAP OF DATA

• US 20130247208A1
• Filed: 05/22/2007
• Published: 09/19/2013
• Est. Priority Date: 05/22/2007
• Status: Active Grant

• Current Assignee: Skyhigh Security LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Bishop, Michael G.
• Granted Patent: US 8,793,802 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A system, method, and computer program product are provided for preventing data leakage utilizing a map of data. In use, information describing data stored on at least one system is received. To this end, a map of the data is generated, utilizing the information. Further, data leakage is prevented, utilizing the map.

Claims

1. A method, comprising:

receiving information describing data stored on at least one system;

generating a baseline map of the data, utilizing the information;

generating a current map that reflects a network map;

comparing the baseline map to the current map prior to receiving a request to transmit at least some of the data in order to determine whether the at least some of the data is permitted to be transmitted, wherein the comparing includes;

identifying differences in categorizations for documents between the baseline map and the current map with respect to respective geographic locations

2. The method of claim 1, wherein the data includes at least one file.

3. The method of claim 1, wherein the data includes at least one electronic mail message.

4. The method of claim 1, wherein the information includes a categorization of the data.

5. The method of claim 4, wherein the categorization is associated with criteria.

6. The method of claim 5, wherein the criteria is predetermined.

7. The method of claim 6, wherein the criteria is based on a selected document.

8. The method of claim 1, wherein the information includes a statistical analysis of the data.

9. The method of claim 1, wherein the data is stored on a single system.

10. The method of claim 1, wherein the data is stored on a group of systems.

11. The method of claim 1, wherein generating the baseline map includes mapping a location of the data to a categorization of the data.

12. The method of claim 11, wherein the location of the data includes at least one of a pathname associated with the data, a user name, and a machine name.

13. The method of claim 11, wherein the location of the data includes an internet protocol address associated the at least one system.

14. The method of claim 1, wherein the information describing the data is identified by parsing the data.

15. The method of claim 1, further comprising accessing a policy, which indicates an allowable threshold number of differences between the baseline map and the current map, for permitting a transmission of at least some of the data.

16. The method of claim 15, wherein data leakage is conditionally prevented based on the policy.

17. The method of claim 1, wherein data leakage is prevented by securing the data.

21. The method of claim 4, wherein the categorization is associated with a group within an organization.

22. The method of claim 8, wherein the statistical analysis indicates a number of occurrences of at least one predetermined keyword within the data

18. Logic embodied on a tangible non-transitory computer readable medium, comprising:

receiving information describing data stored on at least one system;

generating a baseline map of the data, utilizing the information;

generating a current map that reflects a network map; and

comparing the baseline map to the current map prior to receiving a request to transmit at least some of the data in order to determine whether the at least some of the data is permitted to be transmitted, wherein the comparing includes;

identifying differences in categorizations for documents between the baseline map and the current map with respect to respective geographic locations.

19. A system, comprising:

a processor and a memory, wherein the system is configured for;

receiving information describing data stored on at least one system,

generating a baseline map of the data, utilizing the information, and

generating a current map that reflects a network map,

comparing the baseline map to the current map prior to receiving a request to transmit at least some of the data in order to determine whether the at least some of the data is permitted to be transmitted, wherein the comparing includes;

identifying differences in categorizations for documents between the baseline map and the current map with respect to respective geographic locations.

20. (canceled)