<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-data-loss-prevention
description: >-
  Implement and manage Data Loss Prevention (DLP) policies across endpoints,
  network, and cloud channels to detect, alert, and block unauthorized
  transmission of sensitive data including PII, PHI, PCI, and trade secrets.
domain: cybersecurity
subdomain: data-security
tags:
  - dlp
  - data-classification
  - endpoint-dlp
  - network-dlp
  - casb
  - data-exfiltration
  - pci-dss
  - gdpr
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Implementing Data Loss Prevention

## Overview

Data Loss Prevention (DLP) enforces policies that prevent sensitive data from
leaving authorized boundaries via email, web uploads, USB, clipboard, print,
or cloud sharing. Effective DLP combines content inspection, context analysis,
and user behavior to reduce data breach risk while minimizing business friction.
This skill covers policy design, pattern authoring, deployment across channels,
and tuning to reduce false positives.

Mode: `[MODE: BLUE]` — DLP policy deployment and operations.

## Prerequisites

- Data classification taxonomy with defined sensitivity levels
- DLP platform access (Microsoft Purview, Symantec DLP, or equivalent)
- TLS inspection capability for network DLP
- Endpoint agent deployment infrastructure (SCCM, Intune, or MDM)
- Log aggregation platform for DLP event correlation

## Key Concepts

### DLP Architecture Layers

| Layer | Coverage | Enforcement |
|-------|----------|-------------|
| Endpoint | USB, clipboard, print, screen capture | Agent-based |
| Network | Email gateway, web proxy, DNS | Inline proxy |
| Cloud | SaaS apps, cloud storage, collaboration | CASB / API |
| Discovery | File shares, databases, repositories | Scheduled scan |

### Content Detection Methods

```
Detection stack:
├── Exact Data Match (EDM)
│   ├── Hash fingerprints of sensitive records (SSN, CC#)
│   ├── Structured data from HR/finance databases
│   └── Lowest false positive rate, requires data feeds
├── Regular Expression Patterns
│   ├── SSN: \d{3}-\d{2}-\d{4} with Luhn validation
│   ├── Credit card: \b(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2})\d{8,12}\b
│   ├── IBAN: [A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}[A-Z0-9]{0,16}
│   └── Custom: internal project codes, account numbers
├── Document Fingerprinting
│   ├── Index sensitive documents (contracts, designs)
│   ├── Detect partial matches in outbound content
│   └── Works across file format conversions
├── Machine Learning Classifiers
│   ├── Trained on labeled sensitive/non-sensitive corpus
│   ├── Handles unstructured content and context
│   └── Requires ongoing model retraining
└── Keyword Dictionaries
    ├── Medical terms (ICD-10 codes, drug names)
    ├── Legal terms (attorney-client, privileged)
    └── Business terms (acquisition targets, revenue)
```

### Policy Actions

```bash
# DLP policy action hierarchy (least to most disruptive)
# 1. Audit    — log event, no user impact
# 2. Notify   — warn user with policy explanation
# 3. Override — block with business justification option
# 4. Encrypt  — auto-encrypt before allowing transfer
# 5. Block    — prevent action entirely

# Microsoft Purview DLP policy via PowerShell
New-DlpCompliancePolicy -Name "PCI-Data-Protection" \
  -ExchangeLocation All \
  -SharePointLocation All \
  -OneDriveLocation All \
  -Mode Enable

New-DlpComplianceRule -Name "Block-Credit-Card-External" \
  -Policy "PCI-Data-Protection" \
  -ContentContainsSensitiveInformation @{Name="Credit Card Number"; minCount="1"} \
  -BlockAccess $true \
  -NotifyUser "SiteAdmin" \
  -GenerateAlert "Medium"
```

### Scanning CLI

```bash
# Scan file for DLP policy violations
node scripts/agent.js --action scan --input /data/export.csv \
  --policy pci --output /tmp/dlp_findings.json

# Evaluate DLP coverage against data classification
node scripts/agent.js --action coverage --input /tmp/classified_data.json \
  --output /tmp/dlp_coverage.json

# Generate DLP policy template
node scripts/agent.js --action policy --policy-type endpoint \
  --sensitivity restricted --output /tmp/dlp_policy.json
```

## Workflow

### Step 1: Define Data Classification Policies

Map sensitivity levels to DLP actions for each channel.

### Step 2: Deploy Content Inspection

```bash
node scripts/agent.js --action scan --input /data/export.csv \
  --policy pci --output /tmp/dlp_findings.json
```

### Step 3: Configure Policy Enforcement

Start with audit mode, review findings, tune patterns, then enable blocking.

### Step 4: Monitor and Tune

Review false positives weekly. Adjust thresholds and add exclusions.

## Detection

```yaml
title: Data Loss Prevention Detection
id: a328a341-de75-4abd-9598-b010e94d30c7
status: experimental
description: Detects suspicious activity related to implementing data loss prevention techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1048
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```

## Verification

- [ ] DLP policies cover all three channels (endpoint, network, cloud)
- [ ] Content inspection patterns validated against test data
- [ ] Policy actions escalate correctly by sensitivity level
- [ ] False positive rate below 5% after tuning period
- [ ] DLP events forwarded to SIEM for correlation
- [ ] User notification templates reviewed by legal
- [ ] Incident response workflow triggered on block events

## References

- [NIST SP 800-53 SC-7 — Boundary Protection](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [PCI DSS Requirement 3 — Protect Stored Account Data](https://www.pcisecuritystandards.org/)
- [Microsoft Purview DLP Documentation](https://learn.microsoft.com/en-us/purview/dlp-learn-about-dlp)
- [MITRE ATT&CK T1048 — Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048/)
