I've been asked to implement some external commands to be called by our email server in order to perform some basic check over outgoing messages.

I'm doing a research to understand what kind of checks I can implement.

Some notes:

  • keyword DLP rules are under scrutiny
  • there's no confidential classification scheme in the company. We're gonna do it in the near future. Therefore, there's still no way to identify a document based on classification keyword
  • there's no budget to implement a dedicated DLP solution

Here are some checks I thought to implement:

  • count the number of messages sent by a user per day. If the number of messages of the current day is higher of a defined threshold (in percentage, say 100%) compared to the average number of messages sent in the last N days, raise an alert. I should also consider a minimum number of messages, below which this check has no sens
  • analyze the size or the number of attachments sent by a user per day. Same check over a threshold as described in the previous rule

Did any of you performed any kind of such an activity? Do you have any advise on other kind of rules or approach?

4 Answers 4


I don't mean this to sound harsh, but this is part of my day job, and to be honest I don't think you have the experience or scope necessary to pull something like this off successfully by yourself while achieving any sort of meaningful result.

DLP is a HUGE domain. You haven't even been given any clear direction in what it is you need to be catching which makes this all the more difficult. Stolen internal sales leads or books of business? PII? HIPAA? PCI? You might not pass an audit of the latter two rolling your own solution (talk to your auditor BEFORE you start development).

And neither of your triggers will catch anything but a rogue spambot running on your network. In my experience people that exfiltrate data know they're doing something bad and take at least ONE step to cover it up. They're also not going to suddenly start sending 100x more emails than they usually do. At best using a regex for socials or A/R numbers might catch some accidental cases of Outlook autocompleting the wrong address and the sender sending it without looking.

  • How are you going to distinguish 16-digit card numbers from any other 16-digit sequence?
  • You could catch them all, but who is reviewing these false positives? Is anybody? If you don't have the budget for a commercial solution, do you even have analysts that are going to review anything you find?
  • Word documents. Are you capturing and/or reading through those?
  • Text files or docs renamed as something else?
  • Images. Are you performing OCR on all outbound images?
  • Alternate data streams/stego?
  • If I export cardholder information to a PDF and stick it in an encrypted zip file, would you catch that? What if I stuck that encrypted zip inside another encrypted rar? You'd have to decrypt at least one layer of zip/rar file and parse a PDF to catch it. You could block all binary attachments, but when they turn to an alternate channel to send it out another way, will you catch that?
  • You want to catch social security numbers? How are you going to distinguish those from mistyped phone numbers? Is 273-555-1010 a phone number or a social? How about 123769931? The same regexes will catch either.

Keep in mind none of these cases involve a change in velocity or attachments, as you're proposing you'd look for. It's just one malicious email among many benign ones I'll send that day. Maybe yours is different but in my experience most people aren't dumb enough to just dump PII into the body of an email and send it; 90% of the time it's encapsulated in at least one other format (pdf, txt, doc, doc inside zip, zip inside rar, etc).

Your question specifically pertained to email, but you also need to consider people using Facebook messaging, Dropbox, USB sticks, etc. to exfiltrate data...otherwise you might as well not bother. Email is just one tiny vector.

Don't mean to dump on you, just pointing out some of my own experiences with this field in the hopes it spares you some headache. You have no idea what you're getting into if you have no budget for tooling. DLP is one of the few areas I truly believe commercial solutions can do far better than rolling your own.


While you don't have protective marking, you should consider searching messages for content that has a reasonable expectation of being non-compliant.

For example, in a financial organisation, searching for 16 digit strings could be an indicator of card data being sent. Possibly not useful in itself, but multiple instances of such numbers is suspicious. Similarly, social security numbers, or their equivalent where you are etc.

Also think about destination address as a possible item to flag on - do you want people to be sending emails to home addresses, competitors etc.?

There are a long list of things you can do - my preferred approach is to view it from a risk perspective. What things could an employee do that present a risk to your company? Assess the risks and work out how to measure behaviours leading to those risks.

(Of course, if the risk from DLP is too great, the extreme control is to ban external email altogether. It is an appropriate solution for some organisations)


DLP is not only about verifying outgoing e-mails for sensitive content. If you were asked to set up DLP controls, you should reply with several questions, like what data is sensitive for your company, other than e-mail, what other online applications do employees use, do they also have access to portable storage devices? Before writing commands, you should also check what's on the market, even though you don't have a budget. It might give you a better idea on what DLP is and how a company should approach it. The number of e-mails or attachments sent by employees might not be relevant for security incidents. Context is also important. If an employee is having a busy period and sends more e-mails than usually, does it necessarily mean that he is leaking data? Just something to think about...


From GTB Technologies "Why is DLP Failing":

The function of DLP system protection is to be a precise tool that monitors and protects sensitive data. Security and compliance officers must understand and require that their DLP system is able to have answers to questions such as:

“What data do I want to protect?” and

“Can my DLP system classify data correctly in real-time?” or

“Can I truly prevent a data breach?”

  • Jim - this doesn't actually answer the question.
    – Rory Alsop
    Commented Sep 16, 2016 at 7:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .