Symantec Corporation

Manish Pai

Milind Torney

Ajil Koshy

Rupesh Hanumant Khetawat

Latency of DLP policy application during file transfer operations is decreased, by front loading the extraction of file content. The potential extraction latencies of files are quantified based on attributes such as size and/or type. Files with potential extraction latencies that meet a given threshold are identified for pre-transfer content extraction, and their content is extracted and stored. An index of the stored extracted content is maintained, tracking all files from which content has been extracted, according to factors such as size and checksum. When a specific file in the filesystem is transferred, it is determined whether its content has already been extracted, for example by matching the file size and checksum against those for which extracted content has been stored. Responsive to determining that content of the specific file has already been extracted and stored, the stored content is utilized when applying DLP, thereby greatly increasing performance.

Optimizing data loss prevention performance during file transfer operations by front loading content extraction

A method and apparatus submitting information to be protected before permitting an outbound data transfer with the information is described. A DLP agent, incorporating a DLP submission tool, receives information of an outbound data transfer by the client computing system. The DLP agent can temporarily block the outbound data transfer and send a request to update a DLP policy to protect the information before permitting the outbound data transfer. The DLP agent subsequently receives receiving an indication that the DLP policy is updated to protect the information. After receiving the indication, the DLP agent permits the outbound data transfer.

Pre-calculating and updating data loss prevention (DLP) policies prior to distribution of sensitive information

Techniques for print monitoring are disclosed. In one embodiment, the techniques may be realized as a method including monitoring a spool directory associated with a printing system; identifying, for a print job file, a file management call that is made before the print job file is submitted to a printer driver to carry out a print job; blocking the file management call; analyzing the print job file for sensitive data; in response to determining that the print job file does not include sensitive data, re-initiating the file management call for the print job file; and submitting the print job file to a printer driver to carry out a print job.

Techniques for print monitoring

A method and apparatus for detecting a violation of a data loss prevention (DLP) policy and correlating an external identifier of an incident record of the violation to a unique internal identifier using an identity-correlation data store are described.

Dynamically populating an identity-correlation data store

A computer-implemented method for data loss prevention may include intercepting a packet sent by an application of an endpoint. The computer-implemented method may also include extracting file-identification information from the packet. The computer-implemented method may further include identifying a list of opened files and matching the file-identification information to a file in the list of opened files. The computer-implemented method may additionally include identifying a data-loss-prevention policy that applies to the file. The computer-implemented method may moreover include filtering the packet based on the data-loss-prevention policy. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for preventing data loss from files sent from endpoints

A method and apparatus for dynamically populating an identity-correlation data store and using the identity-correlation data store to correlate external identifiers and unique internal identifiers are described.

Growing community of inventors

Pune, India

Manish Pai