Policy-Based Active Data Loss Prevention for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data loss prevention techniques for mobile devices are inadequate in addressing insider threats and accidental data leaks, as they are either too restrictive or prone to false negatives, and do not effectively manage complex security contexts, leading to potential breaches and productivity issues.
Innovation Solution
A policy-backed, multiple-query system for active data loss prevention that monitors and controls data access and distribution on network-connected devices, employing policy decision points and enforcement points to intercept and manage sensitive data access, with encryption techniques to protect against unauthorized disclosure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional data loss prevention techniques are implemented on mobile devices, then data security is improved, but device functionality and user productivity deteriorate due to excessive restrictions
Solution Approach 1:
The system dynamically adjusts security controls based on real-time context assessment. Instead of static restrictions, the DLP system evaluates current device state, application behavior, and data sensitivity to adaptively apply prevention measures, allowing legitimate productivity activities while blocking actual data loss risks.
Solution Approach 2:
The system changes security parameters based on contextual factors such as location, time, device state, and application behavior. Security policies are not fixed but adjusted according to varying parameters, enabling the system to maintain strong security when needed while relaxing controls during normal productive activities.
2Reliability
If strict data loss prevention policies are enforced, then unauthorized data access is reduced, but false negatives increase leading to legitimate data being blocked
Solution Approach 1:
The system incorporates feedback loops where DLP decisions are continuously evaluated against actual outcomes. When false positives occur, the system learns from these errors and adjusts its detection algorithms and policy enforcement to reduce future false negatives, improving overall detection precision over time.
Solution Approach 2:
The system performs preliminary assessments of data and context before enforcing restrictions. By pre-evaluating data sensitivity, application trustworthiness, and contextual factors, the system makes more accurate real-time decisions, reducing false negatives while maintaining security against actual threats.
3Reliability
If comprehensive monitoring of device capabilities and data access is implemented, then data loss detection is improved, but system complexity and processing overhead increase
Solution Approach 1:
The DLP system is segmented into modular components that independently monitor specific device capabilities, data types, and access patterns. Each module handles a discrete aspect of monitoring, reducing overall system complexity while maintaining comprehensive detection coverage through coordinated operation of specialized subsystems.
4Reliability
If multiple security policies are applied to manage complex usage contexts, then data protection coverage is improved, but policy management and enforcement difficulty increase
Solution Approach 1:
The policy management system is designed to universally handle multiple security policies across diverse usage contexts through a unified framework. The system can manage corporate, personal, and shared data policies simultaneously, applying appropriate rules based on data classification and context without requiring separate management systems for each policy type.
Data Source
AI summary
A system and method for policy-based active Data Loss Prevention (DLP) using a two-step process to first determine if an attempt to access a data object is governed by DLP policy, and if so, then applying the DLP policy to either allow or deny access. Attempts by an agent to access, create, modify, or distribute a data object are trapped by a policy execution point. A first query determines if DLP policies govern that access request. If they do, then the metadata is decrypted to form a second query to a policy decision point to adjudicate the access request. If the access request is allowed, then a second key is provided to decrypt the data object for further processing. The system further provides for the encryption of unencrypted data objects to protect them for all future access queries.