Data loss prevention
noun · also DLP · NIST CSRC Glossary
Controls that detect and block sensitive data, such as card numbers or confidential files, from leaving the organization through email, uploads or devices.
Data loss prevention (DLP) tools look at data in motion and in use and apply policies to it. They recognize sensitive content through patterns (credit card numbers, national ID numbers), keywords, document fingerprints or labels that classify files as confidential. When a policy matches, the tool can log the event, warn the user, require a business justification or block the action.
DLP usually covers several channels: email, endpoints (copying to USB drives, printing, uploading through a browser) and cloud services (sharing a file publicly). Microsoft Purview, for example, applies DLP policies across Exchange, SharePoint, OneDrive, Teams and Windows devices.
Example
An employee tries to email a spreadsheet containing hundreds of customer card numbers to a personal address. The DLP policy detects the card numbers, blocks the message, shows the user a notice explaining why, and creates an alert for the security team.
Why it matters for a SOC analyst
DLP alerts are often the first sign of data exfiltration, by an insider or by an attacker using a compromised account, but most of them are honest mistakes. Triage starts with context: who the user is, what data was involved, where it was going and whether the behavior is new for that person. Expect to tune policies regularly to keep the noise manageable.
Related terms
- Data exfiltration
The unauthorized transfer of data out of an organization, often the attacker's main goal or the leverage behind a ransomware extortion.
- Data breach
A confirmed incident in which protected data, such as personal or confidential information, was accessed, disclosed or stolen without authorization.
- Insider threat
Risk that comes from people with legitimate access, such as employees or contractors, whether they act maliciously, carelessly or under an attacker's control.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Defense in depth
Protecting systems with several independent layers of controls, so that when one layer fails, the others still stop or detect the attack.