I would like to setup DLP in Network taping mode to identify and protect if someone is sending the encryption keys outside to organization.

Is it possible to configure such rule in the DLP policy?

  • 1
    First it is unknown what kind of device you have where you can configure DLP. Then it is unknown what kind of encryption keys you mean. But, if somebody is deliberately trying to smuggle some key outside no DLP will prevent it because at the end these are just data which can be packet into various formats and no DLP is able to find all of this w/o marking the majority of sane traffic as potential leaks. – Steffen Ullrich Feb 16 '17 at 8:44
  • @SteffenUllrich Here I'm talking about symmetric encryption keys. I don't want to install an Endpoint Agent on user devices, i want to tap on egress network after proxy (Network Prevent mode). – Rahul9386 Feb 16 '17 at 10:35
  • 2
    Again, keys are just data. Random data mostly. Because of this it is impossible to create a signature for it unless the key is transferred inside some container format (like PEM) which can be detected because it contains some typical strings. Even then it is unknown if this is possible with the unknown DLP detection software you use. I assume that you have some specific security appliance in mind but I cannot look into your mind. – Steffen Ullrich Feb 16 '17 at 11:00
  • What rules are possible is entirely up to your specific DLP software ... – schroeder Feb 16 '17 at 11:28
  • 1
    It should be trivial to set up a rule that looks for -----BEGIN RSA PRIVATE KEY-----, but I'm guessing that's not what you are looking for ... – schroeder Feb 16 '17 at 11:30

I did some search and while I feel it depends on how you can find a common string / type in the file / date you want to block. Most DLP's - I checked with symantec offer ability to block an "encrypted" file but not the keys for encryption itself. If the user sends encryption keys in a particular file format such as .asc you can block those but if they're copy pasted in a document, my gut feeling is that there's no way you can block it unless you find a pattern (impossible given the variables involved in cryptosystem.)


DLP can help against accidental leaks or attempted leaks done by dumb users (i.e. just attach information to mail) but does never protect against a deliberate data leak done by a knowledgeable attacker.

In your specific case it is about leakage of secret keys which only few users should have access to anyway. If the attacker manages to get access to such keys he is probably knowledgeable enough to modify the key for transport, i.e. transfer it in multiple parts, do some simple hiding using ROT13, use an encrypted ZIP archive or similar. No classical DLP solution which just looks for pattern of important data will detect the leakage in such case.

More helpful would be solutions which don't simply block traffic based on pattern but instead allow only specific traffic, i.e. use a whitelist instead of a blacklist. But even then there are probably enough side channels possible (like timing) to transfer the few bits of the key.

In other words: you better make sure that only the users have access to the keys which are trusted enough to not leak the key by accident or deliberately. And that these users or you infrastructure cannot be hacked and the key stolen. Maybe use hardware security modules instead so that nobody has even access to the key.


DLP software products use business rules to classify and protect confidential and critical information so that unauthorized end users cannot accidentally or maliciously share data whose disclosure could put the organization at risk. For example, if an employee tried to forward a business email outside the corporate domain or upload a corporate file to a consumer cloud storage service like Dropbox, the employee would be denied permission.

Adoption of DLP is being driven by insider threats and by more rigorous state privacy laws, many of which have stringent data protection or access components. In addition to being able to monitor and control endpoint activities, some DLP tools can also be used to filter data streams on the corporate network and protect data in motion.

DLP products may also be referred to as data leak prevention, information loss prevention or extrusion prevention products.


You want to prevent anyone from sending the encrypted keys outside the network by installing a DLP. Yes it is possible and also not.

Not possible in such a way that your employee or any other person can even copy the encrypted keys in physical ways(USB drives etc) or by sending the Encrypting keys in any sort of data...even by adding it into a text document or even in some other sort of file like changing the format of text document(.txt) to some other unsupported formats(.tar .exe .msi) etc. It can even send the encrypted keys by re-encrypting.

Possible in such a way if you add many more security protocols along DLP ...like some text scanners, some file scanners...scanning every text in every text document..etc.

Not the answer you're looking for? Browse other questions tagged or ask your own question.