ADAPTIVE DATA LOSS PREVENTION POLICIES

• US 20100162347A1
• Filed: 12/22/2008
• Published: 06/24/2010
• Est. Priority Date: 12/22/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Barile, Ian
• Granted Patent: US 8,613,040 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A monitor detects a policy violation on a computing device, wherein the policy violation includes a user attempt to perform an operation to move data that includes sensitive information off the computing device. The monitor determines whether one or more previous policy violations have occurred on the computing device. The monitor performs an action to minimize a risk of data loss based on the one or more previous policy violations.

Claims

1. A method of safeguarding sensitive information comprising:

detecting a policy violation on a computing device, wherein the policy violation includes a user attempt to perform an operation to move data including sensitive information off the computing device;

determining whether one or more previous policy violations have occurred on the computing device; and

performing an action to minimize a risk of data loss based on the one or more previous policy violations.

2. The method of claim 1, further comprising:

storing the policy violation in a policy violation record, wherein the one or more previous policy violations are stored in the policy violation record.

3. The method of claim 2, further comprising:

removing any of the policy violation or the one or more previous policy violations that exceed an age threshold from the policy violation record.

4. The method of claim 1, wherein performing the action includes comparing the policy violation and the one or more previous policy violations to a plurality of policy violation responses and performing the action in one of the plurality of policy violation responses that corresponds to the policy violation and the one or more previous policy violations.

5. The method of claim 1, wherein detecting the policy violation comprises:

detecting the user attempt to perform the operation;

scanning the data to determine that the data includes the sensitive information; and

determining that the user is not authorized to perform the operation.

6. The method of claim 1, further comprising:

performing a first action if no previous policy violations have occurred; and

performing a second action if the one or more previous policy violations have occurred, wherein the second action depends on a number and severity of the one or more previous policy violations.

7. The method of claim 1, wherein the action depends on a data loss vector through which the user attempted to move the data off the computing device.

8. The method of claim 1, further comprising:

enabling an additional policy based on at least one of the policy violation or the one or more previous policy violations.

9. A computing apparatus having a memory and a processor, the memory including instructions that, when executed by the processor, cause the computing apparatus to include a data loss prevention system comprising:

a policy violation detector to detect a policy violation on the computing apparatus, wherein the policy violation includes a user attempt to perform an operation to move data including sensitive information off the computing apparatus; and

a policy violation responder to determine whether one or more previous policy violations have occurred on the computing device, and to perform an action to minimize a risk of data loss based on the one or more previous policy violations.

10. The computing apparatus of claim 9, further comprising:

a policy violation record that stores the one or more previous policy violations; and

a policy violation recorder to store the policy violation in the policy violation record.

11. The computing apparatus of claim 10, further comprising:

the policy violation recorder to remove any of the policy violation or the one or more previous policy violations that exceed an age threshold from the policy violation record.

12. The computing apparatus of claim 9, wherein the policy violation responder to perform the action based on comparing the policy violation and the one or more previous policy violations to a plurality of policy violation responses and performing the action in one of the plurality of policy violation responses that corresponds to the policy violation and the one or more previous policy violations.

13. The computing apparatus of claim 9, wherein the policy violation detector to detect the policy violation based on detecting the user attempt to perform the operation, scanning the data to determine that the data includes sensitive information, and determining that the user is not authorized to perform the operation.

14. The computing apparatus of claim 9, further comprising:

the policy violation responder to perform a first action if no previous policy violations have occurred and to perform a second action if the one or more previous policy violations have occurred, wherein the second action depends on a number and severity of the one or more previous policy violations.

15. The computing apparatus of claim 9, wherein the action depends on a data loss vector through which the user attempted to move the sensitive data off the computing device.

16. The computing apparatus of claim 9, further comprising:

the policy violation responder to enable an additional policy based on at least one of the policy violation or the one or more previous policy violations.

17. A computer readable medium including instructions that, when executed by a processing system, cause the processing system to perform a method of safeguarding sensitive information, comprising:

detecting a policy violation on a computing device, wherein the policy violation includes a user attempt to perform an operation to move data including sensitive information off the computing device;

determining whether one or more previous policy violations have occurred on the computing device; and

performing an action to minimize a risk of data loss based on the one or more previous policy violations.

18. The computer readable medium of claim 17, the method further comprising:

storing the policy violation in a policy violation record, wherein the one or more previous policy violations are stored in the policy violation record.

19. The computer readable medium of claim 18, the method further comprising:

removing any of the policy violation or the one or more previous policy violations that exceed an age threshold from the policy violation record.

20. The computer readable medium of claim 17, wherein performing the action includes comparing the policy violation and the one or more previous policy violations to a plurality of policy violation responses and performing the action in one of the plurality of policy violation responses that corresponds to the policy violation and the one or more previous policy violations.

21. The computer readable medium of claim 17, wherein detecting the policy violation comprises:

detecting the user attempt to perform the operation;

scanning the data to determine that the data includes sensitive information; and

determining that the user is not authorized to perform the operation.

22. The computer readable medium of claim 17, the method further comprising:

performing a first action if no previous policy violations have occurred; and

performing a second action if the one or more previous policy violations have occurred, wherein the second action depends on a number and severity of the one or more previous policy violations.

23. The computer readable medium of claim 17, wherein the action depends on a data loss vector through which the user attempted to move the sensitive data off the computing device.

24. The computer readable medium of claim 17, the method further comprising:

enabling an additional policy based on at least one of the policy violation or the one or more previous policy violations.