Page 1253 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Data loss prevention (DLP) systems attempt to detect and block data
exfiltration attempts. These systems have the capability of scanning

unencrypted data looking for keywords and data patterns. For
example, imagine that an organization uses data classifications of
Confidential, Proprietary, Private, and Sensitive. A DLP system can
scan files for these words and detect them.

Pattern-matching DLP systems look for specific patterns. For example,
U.S. social security numbers have a pattern of nnn-nn-nnnn (three

numbers, a dash, two numbers, a dash, and four numbers). The DLP
can look for this pattern and detect it. Administrators can set up a DLP
system to look for any patterns based on their needs.

There are two primary types of DLP systems: network-based and
endpoint-based.

Network-Based DLP A network-based DLP scans all outgoing data
looking for specific data. Administrators would place it on the edge of
the negative to scan all data leaving the organization. If a user sends

out a file containing restricted data, the DLP system will detect it and
prevent it from leaving the organization. The DLP system will send an
alert, such as an email to an administrator.

Endpoint-Based DLP An endpoint-based DLP can scan files stored
on a system as well as files sent to external devices, such as printers.
For example, an organization’s endpoint-based DLP can prevent users
from copying sensitive data to USB flash drives or sending sensitive

data to a printer. Administrators would configure the DLP to scan the
files with the appropriate keywords, and if it detects files with these
keywords, it will block the copy or print job. It’s also possible to
configure an endpoint-based DLP system to regularly scan files (such
as on a file server) for files containing specific keywords or patterns, or
even for unauthorized file types, such as MP3 files.

DLP systems typically have the ability to perform deep-level

examinations. For example, if users embed the files in compressed zip
files, a DLP system can still detect the keywords and patterns.
However, a DLP system doesn’t have the ability to decrypt data.

A network-based DLP system might have stopped some major