We have an issue where people are taking laptops home and connecting them to their personal home networks in order to backup corporate data to their private NAS devices. From a DLP standpoint we have trouble reconciling this activity because the activity destination is typically a private IP, something like 192.168.1.12, which is also being used within the corporate network for various labs and testing environments. Short of major policy changes about IP ranges in use and things like that, are there any creative ways to determine the difference between a personal NAS device on a home network vs a corporate-issued one being used from within the corporate network?
We tried frequency analysis of similar activities, but again many generic private IP's are being reused across both corporate and personal environments. I thought about tracking against the 'name' of the network to which the user is connected, but haven't had a ton of luck with that information being readily available in the logs I have. I've been tasked with trying to explore this from an incident response/SOC standpoint, so my available logs are more so correlated with IDS/IPS, mcafee, CIRT, and DLP-type solutions, rather than something like OS event logs.