Print interface technology agnostic data loss prevention through print operations

At least one non-transitory computer readable-storage medium for monitoring print operations and enforcing a data loss prevention policy on a computer, independently of specific applications executing on the computer that initiate print operations, and independently of a specific print interface used by the specific applications, the at least one non-transitory computer readable-storage medium storing computer executable instructions that, when loaded into computer memory and executed by at least one processor of a computing device, cause the computing device to perform the following steps:

• monitoring for and detecting a print driver being loaded into a print spooler, further comprising using a print hook for intercepting a system function that loads print drivers into the print spooler;
• intercepting creation of a driver object created when the print driver is loaded into the print spooler;
• when the driver object creates device objects, intercepting device object print functions;
• monitoring attempts to send text to a printer at a print driver level, the monitored attempts being made by at least one intercepted device object function;
• for each specific monitored attempt to send specific text to the printer, identifying specific application level context information associated with a specific application that initiated a print operation that resulted in the specific monitored attempt;
• and
• applying a data loss prevention policy to monitored attempts to send specific text to the printer at the print driver level, the application of the data loss prevention policy to a specific monitored attempt taking into account specific identified application level context information and specific text of the specific monitored attempt, wherein applying a data loss prevention policy to monitored attempts to send specific text to the printer at the print driver level further comprises performing at least one action from a group consisting of:
• blocking an attempt to send content to the printer;
• redacting restricted content but sending non-restricted content to the printer;
• logging an attempt to send content to the printer;
• sending a notification to an administrator concerning an attempt to send content to the printer;
• and
• blocking additional operations for a user associated with an attempt to send content to the printer.

A computer system for monitoring print operations and enforcing a data loss prevention policy, independently of specific applications that initiate print operations, and independently of a specific print interface used by the specific applications, the computer system comprising:

• at least one processor;
• system memory;
• a print driver load detecting module residing in the system memory, the print driver load detecting module being programmed to monitor for and detect a print driver being loaded into a print spooler, further comprising using a print hook for intercepting a system function that loads print drivers into the print spooler;
• a print driver intercepting module residing in the system memory, the print driver intercepting module being programmed to intercept creation of a driver object created when the print driver is loaded into the print spooler;
• a device object function intercepting module residing in the system memory, the device object function intercepting module being programmed to intercept device object print functions, when the driver object creates device objects;
• a text monitoring module residing in the system memory, the text monitoring module being programmed to monitor attempts to send text to a printer at a print driver level, the monitored attempts being made by at least one intercepted device object function;
• an application identifying module residing in the system memory, the application identifying module being programmed to identify, for each specific monitored attempt to send specific text to the printer, specific application level context information associated with a specific application that initiated a print operation that resulted in the specific monitored attempt;
• and
• a policy applying module residing in the system memory, the policy applying module being programmed to apply a data loss prevention policy to monitored attempts to send specific text to the printer at the print driver level, the application of the data loss prevention policy to a specific monitored attempt taking into account specific identified application level context information and specific text of the specific monitored attempt, wherein applying a data loss prevention policy to monitored attempts to send specific text to the printer at the print driver level further comprises performing at least one action from a group consisting of:
• blocking an attempt to send content to the printer;
• redacting restricted content but sending non-restricted content to the printer;
• logging an attempt to send content to the printer;
• sending a notification to an administrator concerning an attempt to send content to the printer;
• and
• blocking additional operations for a user associated with an attempt to send content to the printer.