Symantec Corporation

Ca, Inc.

Rupesh Hanumant Khetawat

Sumesh Jaiswal

Manish Pai

Jogesh Sharma

Amit Dhotre

Ameet Shinde

Chandini Sabhnani

Mahesh Pol

Vishal Prafulla Shetye

Amol Sharadchandra Ghatge

Sagar Shashikant Sonawane

Ajey Dudhe

Sumit Jain

Eftiquar Shaikh

The disclosed computer-implemented method for managing illegitimate authentication attempts may include (i) detecting an authentication attempt performed by a user to gain access to a protected computing environment, (ii) determining that the authentication attempt to access the protected computing environment is illegitimate, and (iii) simulating, in response to the determination, a successful attempt to authenticate to the protected computing environment by presenting the user with access to a catch-all environment that poses as the protected computing environment and that isolates the protected computing environment from the user. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for managing illegitimate authentication attempts

A computer-implemented method for enforcing data loss prevention (DLP) policies during web conferences may include (i) detecting, by a computing device, an attempt by a presenter to initiate a web conference, (ii) determining that at least one item of content that a participant of the web conference attempts to share during the web conference contains sensitive data, (iii) identifying a DLP policy associated with the sensitive data, and (iv) securing the web conference against unauthorized dissemination of the sensitive data by enforcing the DLP policy on at least one participant machine participating in the web conference. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for enforcing data loss prevention (DLP) policies during web conferences

Systems and methods for Zero-day Data Loss Protection (DLP) having enhanced file upload processing are provided. One method may include capturing and sending file upload context (e.g. folder name, metadata, an active URL, etc.) associated with the scheduled file or folder upload to a DLP filesystem driver. For example, the method may include detecting whether a single/multi-file upload, a folder upload, or a drag-and-drop operation exists, through interception of the shell dialog API, the browse folder API, or the drop process interface, respectively. Further, the method may include generating a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified; such that, the DLP filesystem driver may intercept and process the file open call based upon the file upload cache. Accordingly, the file may be processed in accordance with a prior file classification, file/domain filter, or DLP policy.

Systems and methods for zero-day DLP protection having enhanced file upload processing

Techniques for clipboard monitoring are disclosed. In one embodiment, the techniques may be realized as a method including identifying text that has been copied from an application to a clipboard; copying the identified text to a cache separate from the clipboard; replacing the identified text in the clipboard with a delayed clipboard object; in response to a reference call from the delayed clipboard object, analyzing the copied text for sensitive data; and in response to determining that the copied text includes sensitive data, providing a response to the reference call from the delayed clipboard object that does not include the copied text.

Techniques for clipboard monitoring

Techniques for print monitoring are disclosed. In one embodiment, the techniques may be realized as a method including monitoring a spool directory associated with a printing system; identifying, for a print job file, a file management call that is made before the print job file is submitted to a printer driver to carry out a print job; blocking the file management call; analyzing the print job file for sensitive data; in response to determining that the print job file does not include sensitive data, re-initiating the file management call for the print job file; and submitting the print job file to a printer driver to carry out a print job.

Techniques for print monitoring

A processing device detects a file system call that is associated with copying data to a destination file. The processing device identifies an application initiating the copying of the data to the destination file and determines one or more files that are opened by the application. The processing device identifies a source file from the one or more files opened by the application. The source file corresponds to the destination file. The processing device determines whether the source file includes data to be protected and allows or denies the copying of the data to the destination file based on whether the source file includes data to be protected.

Providing data loss prevention for copying data to unauthorized media

A computer-implemented method for increasing compliance with data loss prevention policies may include (1) identifying a file that is subject to a data loss prevention policy, (2) determining a classification of the file according to the data loss prevention policy, (3) identifying a graphical user interface that is configured to display a representation of the file, and (4) enhancing the representation of the file within the graphical user interface with a visual indication of the classification of the file according to the data loss prevention policy. Various other methods, systems, and computer-readable media are also disclosed.

Systems and methods for increasing compliance with data loss prevention policies

A system and method for detecting and protecting against potential data loss from unknown applications is described. In one embodiment, a method includes detecting, by a client computing device, that a local application has accessed a document on the client computing device, determining that the document contains sensitive data according to one or more endpoint data loss prevention (DLP) polices, determining that the local application and a type of the document is not included in a whitelist of the DLP policies, capturing visual data pertaining to one or more operations that the application performs on the document, and sending the captured visual data to a server.

Method and system for detecting and protecting against potential data loss from unknown applications

A system and method for detecting and protecting against potential data loss from unknown applications is described. In one embodiment, a method includes detecting, by an endpoint data loss prevention (DLP) system running on a client computing device, that a local application has accessed a document on the client computing device. The method further includes determining that the document contains sensitive data according to one or more DLP polices of the endpoint DLP system and determining that a combination of the local application and a type of the document is not included in a whitelist of the DLP policies. Then, the method includes capturing at least one of one or more screenshots, and video of one or more operations that the application performs on the document and sending the captured at least one of the one or more screenshots, and the video to an enforcement server associated with the endpoint DLP system.

Growing community of inventors

Kothrud, India

Rupesh Hanumant Khetawat