Course Preview

Data Loss Prevention

Data loss prevention (DLP) detects and prevents sensitive information from leaving an organization through unauthorized channels. It uses content inspection, context-aware policies, and enforcement actions to stop accidental or malicious exposure of confidential data.

itDefensive security and security operations | OpenSkills.info

Course pathWalk it in order

Look it upDip in anytime

Go furtherLeaves this page

Don't Panic — Data Loss Prevention

Data loss prevention, mercifully shortened to DLP, is the set of controls that find sensitive data and govern how people and systems use or send it. Despite the name, it has nothing to do with backups or disaster recovery. It is about confidentiality: keeping a readable copy from reaching someone who should not have one.

The problem it exists for is annoying precisely because it has no clean solution. Sensitive data has to stay available for real work, and that same access is what lets it leak. Someone picks the wrong email recipient. A compromised account downloads records. A departing employee copies files to a USB stick. A laptop is left on a train. Before DLP, the answer was mostly "write a policy and hope"; DLP adds a system that actually watches the handling points and can act.

Three ideas carry the rest. First, a DLP decision is really five questions: what data is this, where is it, who is acting, what are they doing, and what should happen. Second, data lives in three states, and coverage should span all of them: at rest in storage, in motion across a network or email, and in use on an endpoint while it is copied, pasted, or printed. Third, enforcement is a spectrum, from silently recording an event, through warning the user or asking for a justification, up to blocking or quarantining. You start at the quiet end, in audit or simulation mode, and tighten only once you understand what real work you are about to break.

The thing that surprises people: the classifier does not make the decision. A payment-card number sitting in an approved finance system is fine. The exact same number pasted into a public upload is not. Content without context is just noise, and a rule that ignores context generates a great deal of it. The related trap, covered in Field Notes, is treating DLP as a product you install rather than an operation you staff. If nobody reviews the alerts and tunes the detectors every week, the tool quietly becomes an expensive log that no one reads.

Where to go next. The intro builds the full model and the program sequence. The cheatsheet is the decision table, the enforcement ladder, and the tuning signals in dense form. The slides are the same map, drawn. Field Notes covers what teams reliably get wrong. The practice reference and exercise walk you through building a tiny detector and policy engine on synthetic data, which is the fastest way to feel why precision and recall matter here. The quiz checks that it stuck.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources