Endpoint Data Loss Prevention (DLP)

The traditional approach to DLP put inspection at the network edge, where a device watched traffic moving in and out. That worked when data moved through a few well-defined channels, such as corporate email and a few web protocols. In a modern environment it breaks down for three reasons.

Encryption is everywhere. When a user uploads a file to a cloud storage service over HTTPS, a network appliance sees only an encrypted stream. The file content, which DLP needs to inspect, stays invisible. Endpoint DLP sees the file before it is encrypted for transit, because the agent reads the content at the moment of upload, on the device.

Channels are local. Copying a file to a USB drive, printing a document or pasting text into an application never touches the network. A network appliance cannot see these actions. An endpoint agent can.

Cloud and SaaS bypass the perimeter. When employees use cloud applications directly from their browsers or desktop clients, the network edge is no longer a single choke point. Endpoint DLP follows the data to wherever it is handled.

An endpoint DLP agent performs four functions. The first one relies on the data classification rules that the administrator sets:

1. 1

   Content inspection

   When a file is about to be uploaded, emailed, copied or printed, the agent checks its content against classification rules. These include keyword dictionaries, regular expressions for card and national ID numbers, exact-data matches, digital fingerprints of known documents and sensitivity labels.

2. 2

   Channel monitoring

   The agent watches every channel through which data can leave the device: network traffic (HTTP/HTTPS, FTP, SMTP), email clients, webmail, cloud storage apps, instant messengers, removable storage, printers, the clipboard, and screen capture.

3. 3

   Policy enforcement

   On a match, the agent can block the transfer, quarantine the file, allow it while logging an event, warn the user or alert a security analyst. The action depends on the severity of the rule.

4. 4

   Event reporting

   Captured events go to a central server for storage, search, and audit. Each event carries metadata: user, timestamp, channel, content classification, and the action taken.

Endpoint DLP is one of several DLP variants, and each one watches a different place.

Many organizations deploy a combination, for example, endpoint DLP alongside cloud DLP. Endpoint DLP is the only variant that gives complete visibility, because the endpoint is the single point through which all user data activity flows.

The table shows where each variant watches, what it does well and where it stops.

A rollout of endpoint DLP depends on four practical points.

• Agent footprint. The agent runs continuously on each workstation, so its CPU and disk use must stay low enough not to disrupt work. Modern agents are lightweight and, in some deployments, hidden from the user.
• Platform coverage. Enterprise environments usually run mixed fleets of Windows, Linux, and macOS, including ARM64. The agent must support every platform in use, or coverage gaps appear.
• Offline behavior. When a workstation is disconnected, the agent must keep enforcing policies locally and queue events for upload to the central server later.
• Privacy and proportionality. Endpoint DLP can see a great deal of user activity. Deployments need a clear policy, employee notice, and access controls on the collected data, in line with employment and data protection law in the relevant jurisdiction.

Each workstation card in the console lists the hardware that the agent detected, with device type and manufacturer. The list shows what is connected to the machine and is the starting point for a hardware inventory.

Start with the channels that carry the most risk on the workstations themselves: USB storage, printing, the clipboard, and uploads to web services. Rules written for every file at once block ordinary work and end up switched off, so begin with a few narrow rules and widen them once the events show what normal work looks like.

Review the captured events every month. The rules that fire without a reason are the first ones to tune, and the events show which channels the work actually depends on.

Further reading: DLP Systems — what it is and how it works; How to buy the DLP system?.