CompTIA Security+ Preparation · lesson 44 of 45 · 25 min
Data Loss Prevention (DLP) Fundamentals
DLP (Data Loss Prevention) — technology and processes that detect and prevent unauthorized transmission, storage, or use of sensitive data. Protects against both accidental and malicious data leakage.
DLP deployment types:
Endpoint DLP — agent installed on endpoints. Monitors and controls data on devices: file copies to USB, printing, email attachments, cloud uploads. Can block or alert on policy violations.
Network DLP — inspects network traffic for sensitive data. Deployed at network egress points (proxy, email gateway). Detects sensitive data in emails, web uploads, FTP transfers.
Cloud DLP — monitors and controls data in cloud services (SaaS, IaaS). Often integrated with CASB. Detects sensitive data in cloud storage, collaboration tools.
DLP policies — define what data is sensitive and what actions are allowed. Based on data classification: PII (SSN, credit cards, email addresses), PHI (medical records), PCI data (cardholder data), intellectual property.
DLP Detection Methods
Pattern matching (regex) — detects data matching known patterns. Example: SSN pattern 123-45-6789, credit card 16-digit numbers, email addresses.
Keyword matching — detects documents containing specific words: “confidential,” “proprietary,” “trade secret.”
Fingerprinting (exact data matching) — creates a fingerprint of sensitive documents. Detects exact copies or near-copies even if renamed or reformatted.
Machine learning classification — uses ML to classify documents by content. Can detect sensitive data that does not match known patterns.
DLP actions: Block (prevent the action), Alert (notify the user and/or security team), Quarantine (hold for review), Encrypt (automatically encrypt sensitive data), Log (record for audit).
False positive management — DLP generates many false positives. Tuning policies to reduce false positives is critical for user acceptance and analyst efficiency.
Key Terms
Key Terms
Knowledge Check — 10 Questions
Security+ — Data Loss Prevention
Endpoint DLP monitors:
- Network traffic only
- File copies to USB, printing, email attachments, and cloud uploads on devices
- Cloud storage only
- Email servers only
- Answer: File copies to USB, printing, email attachments, and cloud uploads on devices
Endpoint DLP agents monitor all data movement on the device — USB copies, printing, email, and cloud uploads. DLP fingerprinting detects:
- Malware signatures
- Exact copies or near-copies of sensitive documents even if renamed
- Network intrusions
- Password reuse
- Answer: Exact copies or near-copies of sensitive documents even if renamed
Fingerprinting creates a hash/fingerprint of sensitive content — detects the data regardless of filename or format changes. Network DLP is deployed at:
- Every endpoint
- Network egress points like proxy and email gateway
- The database server
- The domain controller
- Answer: Network egress points like proxy and email gateway
Network DLP inspects traffic leaving the organization — at the proxy, email gateway, or firewall — to catch data exfiltration. A DLP policy that detects SSN patterns uses:
- Fingerprinting
- Machine learning
- Pattern matching (regex)
- Keyword matching
- Answer: Pattern matching (regex)
SSNs have a known format (XXX-XX-XXXX) — regex pattern matching detects them reliably in documents and network traffic. Cloud DLP is often integrated with:
- Endpoint antivirus
- CASB (Cloud Access Security Broker)
- Network switches
- Physical access control
- Answer: CASB (Cloud Access Security Broker)
CASB provides visibility into cloud usage — integrating DLP with CASB enables policy enforcement across all cloud services. DLP false positives occur when:
- Sensitive data is exfiltrated
- Legitimate data transfers are incorrectly flagged as policy violations
- DLP fails to detect a violation
- Encryption is applied incorrectly
- Answer: Legitimate data transfers are incorrectly flagged as policy violations
False positives frustrate users and overwhelm analysts — DLP policies must be tuned to minimize them while maintaining detection.
Which DLP action holds data for security team review?
- Block
- Alert
- Quarantine
- Log
Answer: Quarantine
Quarantine holds the data (email, file) for a security analyst to review before deciding whether to allow or block it.
PHI stands for:
- Personal Health Information
- Protected Health Information
- Private Health Infrastructure
- Personal Health Infrastructure
- Answer: Protected Health Information
PHI = Protected Health Information — medical records and health data protected by HIPAA. A key DLP data category for healthcare.
DLP can protect against both accidental and malicious data leakage.
- True
- False
Answer: True
DLP catches both: an employee accidentally emailing a spreadsheet with SSNs AND a malicious insider intentionally exfiltrating data.
Machine learning DLP classification can detect:
- Only known patterns
- Only exact document copies
- Sensitive data that does not match known patterns
- Only malware
- Answer: Sensitive data that does not match known patterns
ML-based DLP learns from examples — it can classify sensitive documents even when they do not match regex patterns or keywords.
Previous lesson: Third-party risk management and vendor assessment
Back to CompTIA Security+ Preparation
Next lesson: Security awareness training: phishing simulations, role-based training, metrics