-1

If a company allows his employees to use encryption, especially PGP encryption, it will run into trouble. Because AES128 is unbreakable, that means traffic which is routed in the intranet can't be monitored and checked for critical information. The idea behind Data loss prevention is, that a company has control over the data, and PGP bypass this control.

In Windows environments the problem is solved in reality by PGP Endpoint data loss prevention systems. That is computersoftware, who can read a message before it is encrypted. So the IT-department gets control back over his data. Such tools were sold commercially in a Security suite. But how is the situation under Linux? If the company has employees, who are using their own Linux distribution and PGP too, what is here the right choice in Data loss prevention? Could this be one of the reason, why PGP is not very often used?

2

First, it is possible to deliberately leak data in almost all environments, even if they are protected by some DLP product. It might be as simple as putting these information into a password protected ZIP file or use ROT13 "encryption". No black listing Data Leakage Prevention will help here. Only white listing does, for example by only allowing data to leave the company which are explicitly signed as exportable by some trusted key.

As for PGP: it is possible to setup a system where all outgoing mails are additionally encrypted for a company specific "master recipient" so that the data could be decrypted for analysis on a mail gateway. And any outgoing PGP mail which does not encrypt for this master too could be simply rejected.

  • Sorry, but it is not possible to decrypt with a master key the subkeys. – Manuel Rodriguez Apr 30 '18 at 8:00
  • @ManuelRodriguez: I did not mean the master key in PGP speak but a a "master key" as a specific recipient. I've edited the question to replace this mistakable phrase with "master recipient". – Steffen Ullrich Apr 30 '18 at 8:06
0

You can encrypt for multiple recipients using PGP, so one possible solution would be to have employees encrypt the data they are sending using a key belonging to the data loss prevention system as well. This would allow the system to read the data and would only require standard PGP software. Though I do not know if there is data loss prevention system that supports this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.