0

My company are preparing to install DLP (Data Loss Prevention) on our machines. I don't know what that means, how it works, what it can block for us, or how they can control our PCs and our connections.

I hear that this tools can block everything like USB Ports, or transfer of information to another machine. Is that true? What if I use a Linux boot, can I access my information when this tools is installed or is that not possible?

Can you please give me an idea, how I should prepare my self to this tools?

  • Probably the kind of question to ask the company - it would depend on the configuration they're using. In general, though, companies deploy these systems to pick up on potential theft of data - as a result, they need to look at USB devices and transfer of data between machines, since that's the point! – Matthew Feb 28 '17 at 9:48
  • so, what if i use linux boot, i mean the snaky way, can i access to my data or this is not possible @Matthew? – YCF_L Feb 28 '17 at 9:53
  • 1
    If you can't access data you need for your work, speak to your IT department - any attempts you make to bypass a system like this are likely to be considered misconduct. It's quite possible that there are ways to bypass them, but they're likely to result in you no longer having a job. – Matthew Feb 28 '17 at 9:56
  • mmm, so can you present to us this ways to avoid them to not lose our jobs @Matthew ? – YCF_L Feb 28 '17 at 9:58
  • Yes. Speak to your IT department! – Matthew Feb 28 '17 at 9:59
1

If you know what vendor and/or solution was chosen, I would check their docs.

One key thing is whether this is a network based DLP solution (in which case, you could check the docs for BroIDS to see how they conceive of DLP), or a local agent based one (i.e. some extension to an antivirus solution).

On a very basic level, a DLP solution will look for either keywords, or content hashes (e.g. sha256 digests) to identify 'sensitive' data that should not be allowed to leave your control/area of visibility. As usual, it is more complicated than that, but that's the very, very basic functionality you should expect.

In theory at least, DLP shouldn't prevent you from accessing something (that's a job for ACLs and other access control mechanism), it is more meant to prevent you from storing the data in bad or unauthorised places (e.g. sending yourself or others passwords, credit card data, proprietary code/information, etc).

There are generally ways around DLP if you really, really, want to find them, but if your DLP solution isn't allowing you to do your job, fix the solution, don't work around the limitation.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.