Systems and methods for applying data-loss-prevention policies
AssigneeSymantec Corporation
InventorsSumesh Jaiswal, Sarin Sumit Manmohan
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for applying data-loss-prevention policies. The method may include (1) maintaining a list of applications whose access to sensitive data is controlled by data-loss-prevention (DLP) policies, (2) detecting an attempt by a process to access sensitive data, (3) determining that the process has a parent-child relationship with an application within the list of applications, and (4) applying, based at least in part on the determination that the process has the parent-child relationship with the application, a DLP policy associated with the application to the process in order to prevent loss of sensitive data. Various other methods, systems, and computer-readable media are also disclosed.
Claims20
A computer-implemented method for applying data-loss-prevention policies, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
- maintaining a list of applications whose access to sensitive data is controlled by data-loss-prevention (DLP) policies;
- monitoring loading of an application within the list of applications by one or more processes;
- detecting an attempt by a process to access sensitive data;
- determining that the process has loaded the application;
- applying, based at least in part on the determination that the process has loaded the application, a DLP policy associated with the application to the process in order to prevent loss of sensitive data.
A system for applying data-loss-prevention policies, the system comprising:
- a maintenance module programmed to maintain a list of applications whose access to sensitive data is controlled by data-loss-prevention (DLP) policies;
- a detection module programmed to detect an attempt by a process to access sensitive data;
- a relationship-determining module programmed to:
- monitor loading of an application within the list of applications by one or more processes;
- determine that the process has loaded the application;
- an enforcing module programmed to apply, based at least in part on the determination that the process has loaded the application, a DLP policy associated with the application to the process in order to prevent loss of sensitive data;
- at least one processor configured to execute the maintenance module, the detection module, the relationship-determining module, and the enforcing module.
A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- maintain a list of applications whose access to sensitive data is controlled by data-loss-prevention (DLP) policies;
- monitor loading of an application within the list of applications by one or more processes;
- detect an attempt by a process to access sensitive data;
- determine that the process has loaded the application;
- apply, based at least in part on the determination that the process has loaded the application, a DLP policy associated with the application to the process in order to prevent loss of sensitive data.
Dependencies are inferred from the claim text.