Method and apparatus for associating data loss protection (DLP) policies with endpoints
AssigneeInternational Business Machines Corporation
InventorsNeil Ian Readshaw, Jayashree Ramanathan, Gavin George Bray
Life of this patent
Estimating the term…
Abstract
A method of policy management in a Data Loss Prevention (DLP) system uses a policy model that associates a user with one or more DLP endpoints. When an endpoint is added to the system, a set of policies for that endpoint are determined using an identity of the user that is associated with the endpoint and a list of roles or groups for that user. At policy distribution time, the method determines a set of endpoints to which the policy is to be distributed.
Claims15
A method of policy management in a data loss prevention (DLP) system, comprising:
- defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
- determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated;
- and
- determining a set of endpoints to which a policy is to be distributed by:
- identifying the user owning the endpoint;
- retrieving a list of roles or groups for that user;
- and
- defining the set of policies as the policies that reference each role or group to which the user is associated;
- wherein at least one of the determining steps is performed using a computer program executing in a hardware element.
Apparatus for policy management in a data loss prevention (DLP) system, comprising:
- a processor;
- computer memory holding computer program instructions that when executed by the processor perform a method comprising:
- defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
- determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated;
- and
- determining a set of endpoints to which a policy is to be distributed by:
- identifying the user owning the endpoint;
- retrieving a list of roles or groups for that user;
- and
- defining the set of policies as the policies that reference each role or group to which the user is associated.
A computer program product in a non-transitory computer readable medium for policy management in a data loss prevention (DLP) system, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:
- defining a policy model that associates a user with one or more endpoints, the user being associated with at least one role or group;
- determining a set of policies for an endpoint in the DLP system using an identity of the user that is associated with the endpoint and a list of roles or groups for the user, wherein the set of policies for the endpoint reference each role or group to which the user is associated;
- and
- determining a set of endpoints to which a policy is to be distributed by:
- identifying the user owning the endpoint;
- retrieving a list of roles or groups for that user;
- and
- defining the set of policies as the policies that reference each role or group to which the user is associated.
Dependencies are inferred from the claim text.