What a flow policy governs
Data flow control decides where information may go after a user has already opened it. A flow policy takes a transfer and asks who is sending what, to whom, and by which route. Then it allows, warns, holds, or blocks the transfer.
The policy is the rulebook. Data loss prevention technology enforces it at the endpoint, in mail, and on the network, and records each decision for review.
How it differs from access control
Access control decides whether a person can open a file. Flow control starts where that decision ends, with the copy, upload, print, or message that follows. A user can be fully authorized to read a customer list and still have no right to send it to a personal mailbox.
Most data exfiltration does not need a broken door. It uses a path nobody checked: a sync client, a chat attachment, or a printout left on a shared printer.
Channels and their risks
Each channel, from removable media to a personal cloud account, moves data differently, so a flow rule has to name the path it governs. The table lists the common paths and the risk each one carries when nothing checks it.
| Channel | Typical transfer | Risk without a rule |
|---|---|---|
| Corporate email | Attachments and message text sent outside the company | A price list reaches a personal address |
| Web upload | Files posted to a browser form or a file-sharing site | A contract is uploaded to a public service |
| Messengers | Files and text sent in chat or calls | A customer export goes to a private account |
| Removable media | Files copied to a USB drive or memory card | A customer database leaves with a resigning employee |
| Printing | Documents sent to a local or network printer | A confidential report sits in a shared output tray |
How a transfer is evaluated
Every transfer passes the same sequence. The content check runs before the verdict, so the same channel can carry an approved file and stop a risky one. If a document already carries a classification label, the policy reads it first.
- 1
Read the content
The policy checks the file or message against thesauri, hash sums, fingerprints, and sensitivity labels.
- 2
Match the rule
The rule compares the user, computer, destination, and channel with its conditions.
- 3
Apply the verdict
The transfer is allowed, blocked, or held in quarantine, and the user may see a warning.
- 4
Record the decision
The event keeps the user, time, channel, content match, and action taken.
What a blocking rule looks like
In Anexet DLP, every channel has its own rule editor, and the list of conditions changes with the channel. The first frame shows a rule that reacts to a Microsoft sensitivity label. The second shows auditing of blocked clipboard data and the option to keep a shadow copy of it.
1 / 2
Why blocking a whole channel fails
Blocking a whole channel is the simplest control, and it is often the first one a team reaches for. It also stops legitimate work, so people find another route or stop asking for help. Digital fingerprints let the policy recognize a known document by its content, while a flow policy keeps the channel open for everything else:
| Capability | Channel block | Flow policy |
|---|---|---|
| Stops a risky transfer | ||
| Lets approved transfers use the same channel | ||
| Judges what the data contains | ||
| Holds borderline cases for review |
Where to start
Start with the data that would hurt most if it left, then map the channels it actually uses. Policies written for every file at once end up blocking work and get switched off.
Review held transfers in the first weeks, then tune the rules that raise false alarms. A flow policy that people trust is one they keep switched on.
Further reading: DLP Systems — what it is and how it works.
A good flow policy lets the work through and stops only the transfers that should never happen.
Anexet TeamHow Anexet handles this
Anexet covers data flow control with blocking rules set for each channel. A rule combines conditions on content and context, and the verdict follows the route the transfer takes:
Rules for each channel
Rules cover email, web, FTP, messengers, printing, the clipboard, external storage, and network shares, so one policy model applies to every transfer path.
Content and label conditions
A rule can match words, regular expressions, search thesauri, hash sums, digital fingerprints, and Microsoft sensitivity labels, so the verdict follows what the data actually is.
Verdicts and review
A matching transfer can be blocked with a warning to the user, or held in quarantine, where a named handler reviews it within a set time.
On-premise data
Flow policies, captured content, and logs stay within the customer's own infrastructure.
Anexet DLP
Learn more