Systems and methods for data loss prevention on mobile computing systems

A system for data loss prevention on mobile computing systems, the system comprising:

• an identification module programmed to identify a mobile computing system, the mobile computing system being configured to execute only one application at a time as a foreground application;
• a monitoring module programmed to determine that the mobile computing system has begun executing a sensitive application as the foreground application, wherein the sensitive application displays information that is subject to a data-loss-prevention policy;
• an enumeration module programmed to:
• in response to determining that the mobile computing system is executing the sensitive application as the foreground application, identify a first enumeration of screenshots stored on the mobile computing system when the mobile computing system began executing the sensitive application as the foreground application;
• identify a second enumeration of screenshots stored on the mobile computing system after the mobile computing system began executing the sensitive application as the foreground application;
• a determination module programmed to determine that at least one new screenshot was taken on the mobile computing system while the sensitive application was the foreground application by detecting a difference between the first enumeration of screenshots and the second enumeration of screenshots;
• a performing module programmed to perform a security action upon detecting the difference between the first enumeration of screenshots and the second enumeration of screenshots;
• at least one processor configured to execute the identification module, the monitoring module, the enumeration module, the determination module, and the performing module.

A computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify a mobile computing system, the mobile computing system being configured to execute only one application at a time as a foreground application;
• determine that the mobile computing system has begun executing a sensitive application as the foreground application, wherein the sensitive application displays information that is subject to a data-loss-prevention policy;
• in response to determining that the mobile computing system is executing the sensitive application as the foreground application, identify a first enumeration of screenshots stored on the mobile computing system when the mobile computing system began executing the sensitive application as the foreground application;
• identify a second enumeration of screenshots stored on the mobile computing system after the mobile computing system began executing the sensitive application as the foreground application;
• determine that at least one new screenshot was taken on the mobile computing system while the sensitive application was the foreground application by detecting a difference between the first enumeration of screenshots and the second enumeration of screenshots;
• perform a security action upon detecting the difference between the first enumeration of screenshots and the second enumeration of screenshots.