System and method for data loss prevention across heterogeneous communications platforms

• US 9,578,060 B1
• Filed: 11/25/2013
• Issued: 02/21/2017
• Est. Priority Date: 06/11/2012
• Status: Active Grant

• Current Assignee: Quest Software, Inc.
• Original Assignee: Dell Software, Inc. (Dell Technologies Inc.)
• Inventors: Brisebois, Michel, Johnstone, Curtis
• Primary Examiner(s): Smith, Paulinho E
• Application Number:
  US14/089,427
• Time in Patent Office: 1,184 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In one embodiment, a method includes activating a cross-platform DLP policy for enforcement against a plurality of users on each of a plurality of heterogeneous communications platforms. The method further includes monitoring communications of the plurality of users on each of the plurality of communications platforms for violations of the cross-platform DLP policy. The method also includes, responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one communications platform, dynamically acquiring context information for the detected violation using information associated with the detected violation. In addition, the method includes publishing violation information to one or more designated users. The violation information includes at least a portion of the information associated with the detected violation and at least a portion of the context information.

Claims

1. A method comprising, for each cross-platform data loss prevention (DLP) policy of at least one cross-platform DLP policy:

on a computer system comprising at least one server computer, activating the crossplatform DLP policy for enforcement against a plurality of users on each of a plurality of heterogeneous communications platforms;

wherein the activating comprises creating the cross-platform DLP policy, the creating comprising;

defining one or more designated users for a reporting workflow;

establishing one or more enforcement actions that can be taken by the one or more designated users; and

defining how the cross-platform DLP policy can be quasi-violated;

the computer system monitoring communications of the plurality of users on each of the plurality of heterogeneous communications platforms for violations of the cross-platform DLP policy;

responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one communications platform, the computer system dynamically acquiring context information for the detected violation using information associated with the detected violation; and

the computer system publishing violation information to the one or more designated users, the violation information comprising at least a portion of the information associated with the detected violation and at least a portion of the context information.

2. The method of claim 1, wherein the creating the cross-platform DLP policy comprises:

empirically defining how the cross-platform DLP policy can be violated;

identifying one or more contextual parameters for the context information;

generating a query package comprising the one or more contextual parameters; and

storing the cross-platform DLP policy, the storing comprising storing the query package as linked to the cross-platform DLP policy.

3. The method of claim 2, wherein the empirically defining comprises

importing a native policy from a communications platform;

and

translating the native policy into a standardized policy format.

4. The method of claim 2, wherein:

the activating comprises initiating a native DLP policy of one or more of the plurality of heterogeneous communications platforms; and

the monitoring comprises tracking native violations of the native DLP policy.

5. The method of claim 2, wherein the monitoring comprises evaluating collected communications from at least a portion of the plurality of heterogeneous communications platforms.

6. The method of claim 2, wherein the dynamically acquiring comprises:

retrieving the query package;

accessing, from the information associated with the violation, values of the one or more contextual parameters;

executing the query package using the accessed values; and

receiving the context information responsive to the executing.

7. The method of claim 1, wherein the publishing comprises reporting the violation information according to the reporting workflow.

8. The method of claim 7, wherein the publishing comprises, for each designated user of the one or more designated users:

determining which enforcement actions of the one or more enforcement actions that the designated user has permission to perform; and

providing an interface for the one or more designated users to select the determined enforcement actions.

9. The method of claim 8, comprising, responsive to selection of at least one enforcement action of the determined enforcement actions, executing the at least one enforcement action with administrator privileges on at least one of the plurality of heterogeneous communications platforms.

10. The method of claim 1, wherein the at least one cross-platform DLP policy comprises a plurality of cross-platform DLP policies.

11. The method claim 1, wherein the context information comprises information about a communication pattern of a user who initiated the detected violation.

12. The method of claim 1, wherein the context information comprises information about communications on multiple communications platforms of the plurality of heterogeneous communications platforms.

13. The method of claim 1, wherein the information associated with the detected violation comprises information selected from the group consisting of:

a violation type, a communication identifier, and a user name.

14. The method of claim 1, wherein the context information comprises information selected from the group consisting of:

prior violations by the at least one user, communications by the at least one user within a certain period of time, and a communication pattern of the at least one user.

15. The method of claim 1, comprising:

performing a risk query comprising a prospective cross-platform DLP policy;

identifying information related to an impact of implementing the cross-platform DLP policy; and

returning the information to a requestor.

16. An information handling system comprising a computer processor and memory, wherein the computer processor and memory in combination are operable to implement a method comprising, for each cross-platform data loss prevention (DLP) policy of at least one crossplatform DLP policy:

activating the cross-platform DLP policy for enforcement against a plurality of users on each of a plurality of heterogeneous communications platforms;

wherein the activating comprises creating the cross-platform DLP policy, the creating comprising;

defining one or more designated users for a reporting workflow;

establishing one or more enforcement actions that can be taken by the one or more designated users; and

defining how the cross-platform DLP policy can be quasi-violated;

monitoring communications of the plurality of users on each of the plurality of heterogeneous communications platforms for violations of the cross-platform DLP policy;

responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one communications platform, dynamically acquiring context information for the detected violation using information associated with the detected violation; and

publishing violation information to the one or more designated users, the violation information comprising at least a portion of the information associated with the detected violation and at least a portion of the context information.

17. The information handling system of claim 16, wherein the activating comprises creating the cross-platform DLP policy, the creating comprising:

empirically defining how the cross-platform DLP policy can be violated;

identifying one or more contextual parameters for the context information;

generating a query package comprising the one or more contextual parameters; and

storing the cross-platform DLP policy, the storing comprising storing the query package as linked to the cross-platform DLP policy.

18. A computer-program product comprising a non-transitory computer-usable medium having computer-readable program code embodied therein, the computer-readable program code adapted to be executed to implement a method comprising:

activating the cross-platform DLP policy for enforcement against a plurality of users on each of a plurality of heterogeneous communications platforms;

wherein the activating comprises creating the cross-platform DLP policy, the creating comprising;

defining one or more designated users for a reporting workflow; and

establishing one or more enforcement actions that can be taken by the one or more designated users; and

defining how the cross-platform DLP policy can be quasi-violated;

monitoring communications of the plurality of users on each of the plurality of heterogeneous communications platforms for violations of the cross-platform DLP policy;

responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one communications platform, dynamically acquiring context information for the detected violation using information associated with the detected violation; and

publishing violation information to one or more designated users, the violation information comprising at least a portion of the information associated with the detected violation and at least a portion of the context information.