DLP Artifact Classification State Machine for Policy Subversion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) systems lack automated techniques to detect and respond to changes in information classification, allowing users to potentially subvert the system's policies.
Innovation Solution
An automated method within a DLP system uses an artifact classification state machine to track changes in security classifications, issuing notifications for changes, declassifications, and significant category increases, enabling authorized personnel to assess user actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If automated tracking of classification changes is implemented, then detection of policy subversion attempts is improved, but system complexity increases
Solution Approach 1:
The system pre-defines classification categories and state machine transitions before runtime. By establishing the classification framework and possible state changes in advance, the system can automatically detect policy subversion attempts without requiring complex real-time analysis, thus improving reliability while managing system complexity through upfront configuration.
Solution Approach 2:
The state machine continuously monitors classification changes and provides feedback when transitions occur. This automated feedback mechanism detects policy subversion attempts by tracking state changes, improving system reliability through continuous monitoring while maintaining manageable complexity through structured state transition logic.
2Device complexity
If manual monitoring of classification changes is used, then system complexity is reduced, but detection capability and response time deteriorate
Solution Approach 1:
The state machine operates autonomously to monitor and detect classification changes without requiring manual intervention. This self-service capability enables automated detection of policy subversion attempts, significantly improving detection capability and response time while keeping the system relatively simple through the use of pre-defined state transitions.
3Measurement precision
If comprehensive monitoring of all classification changes is implemented, then detection accuracy is improved, but loss of time for processing increases
Solution Approach 1:
The state machine extracts and monitors only the specific classification changes that are relevant to policy subversion attempts. By focusing on critical state transitions rather than all possible changes, the system maintains high detection accuracy for security-relevant events while minimizing processing time by ignoring irrelevant classification modifications.
Data Source
AI summary
A Data Loss Prevention (DLP) system includes an automated method for tracking changes to a security classification (e.g., content category) associated with an artifact to determine whether an attempt is being made to subvert a DLP policy. The method exploits the basic principle that, depending on context, the classification of a particular artifact, or a change to an existing classification, may indicate an attempt to subvert the policy. According to the method, an artifact classification state machine is implemented within a DLP system. For each policy-defined content category on each artifact, the machine identifies a content category change that may be of interest, as defined by policy. When a change in a classification has occurred, an artifact notification event (or, more generally, a notification of the change in classification) is issued.