Data Loss Prevention (DLP)

DLP covers data in three states: data in use, such as actions on an endpoint; data in motion, such as network traffic; and data at rest, such as data in storage. It works through deep packet content inspection and contextual analysis of each transaction, looking at attributes such as the originator, the data object, the medium, the timing, and the recipient or destination, all within a centralized management framework.

In the Continuous Diagnostics and Mitigation (CDM) program run by CISA for federal agencies, DLP techniques block unauthorized exfiltration of sensitive data and include exfiltration alerts and prevention, role-based data protection, and enhanced protections for sensitive information. DLP is one of five data protection capabilities in that program, next to data discovery and classification, data protection through encryption or masking, data breach and spillage mitigation, and information rights management.

DLP is also built into other security products. Cloud access security brokers (CASBs) provide DLP capabilities for enterprise data on cloud providers' servers and the data flowing in and out of them, and DLP services are among the minimal security services in most commercial secure access service edge (SASE) offerings.