-1

If a company allows his employees to use encryption, especially PGP encryption, it will run into trouble. Because AES128 is unbreakable, that means traffic which is routed in the intranet can't be monitored and checked for critical information. The idea behind Data loss prevention is, that a company has control over the data, and PGP bypass this control.

In Windows environments the problem is solved in reality by PGP Endpoint data loss prevention systems. That is computersoftware, who can read a message before it is encrypted. So the IT-department gets control back over his data. Such tools were sold commercially in a Security suite. But how is the situation under Linux? If the company has employees, who are using their own Linux distribution and PGP too, what is here the right choice in Data loss prevention? Could this be one of the reason, why PGP is not very often used?

Improve this question

2 Answers 2

Reset to default
2

First, it is possible to deliberately leak data in almost all environments, even if they are protected by some DLP product. It might be as simple as putting these information into a password protected ZIP file or use ROT13 "encryption". No black listing Data Leakage Prevention will help here. Only white listing does, for example by only allowing data to leave the company which are explicitly signed as exportable by some trusted key.

As for PGP: it is possible to setup a system where all outgoing mails are additionally encrypted for a company specific "master recipient" so that the data could be decrypted for analysis on a mail gateway. And any outgoing PGP mail which does not encrypt for this master too could be simply rejected.

Improve this answer
2
  • Sorry, but it is not possible to decrypt with a master key the subkeys.
    – Manuel Rodriguez
    Apr 30, 2018 at 8:00
  • @ManuelRodriguez: I did not mean the master key in PGP speak but a a "master key" as a specific recipient. I've edited the question to replace this mistakable phrase with "master recipient".
    – Steffen Ullrich
    Apr 30, 2018 at 8:06
0

You can encrypt for multiple recipients using PGP, so one possible solution would be to have employees encrypt the data they are sending using a key belonging to the data loss prevention system as well. This would allow the system to read the data and would only require standard PGP software. Though I do not know if there is data loss prevention system that supports this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .