Controlling access to sensitive data based on changes in information classification

Apparatus for detecting changes to security classifications of artifacts in a data loss prevention (DLP) system, the DLP system including a DLP policy that identifies one or more classifications and an enforcement rule associated with a classification, comprising:

• a processor;
• computer memory holding computer program instructions that when executed by the processor perform a method comprising:
• configuring, according to the DLP policy, an artifact state machine that defines a set of artifact security classification states and their associated transitions among the artifact security classification states;
• classifying content of an artifact into a security classification identified in the policy;
• determining, using the set of artifact security classification states and their associated transitions as defined in the artifact state machine, whether a change in the security classification of the artifact has occurred, the change indicative of an attempt to subvert the enforcement rule defined by the DLP policy;
• and
• if a change in the security classification of the artifact has occurred, generating a notification of the change in the classification.

A computer program product in a non-transitory computer readable medium for detecting changes to security classifications of artifacts in a data loss prevention (DLP) system, the DLP system having a DLP policy that identifies one or more classifications and an enforcement rule associated with a classification, the computer program product holding computer program instructions which, when executed by the data processing system, perform an automated method comprising:

• configuring, according to the DLP policy, an artifact state machine that defines a set of artifact security classification states and associated transitions among the artifact security classification states;
• for each security classification in the DLP policy, for each of a set of artifacts:
• classifying content of the artifact into a security classification as identified in the DLP policy;
• determining, using the set of artifact security classification states and their associated transitions as defined in the artifact state machine, whether a change in the security classification of the artifact has occurred, the change indicative of an attempt to subvert the enforcement rule defined by the DLP policy;
• and
• if a change in the security classification of the artifact has occurred, generating a notification of the change in the classification.