DLP
acronymsecuritycloudprivacy
Data Loss Prevention: recognizing sensitive data - card numbers, records, secrets - and stopping it from leaving through email, uploads, or clipboards.
Pattern-matching meets policy; tuning it is the eternal war between security and the business's attachments.
Data loss prevention is the attempt to stop sensitive material leaving before it does, rather than discovering the departure afterwards. It works by inspecting content in motion and at rest, matching it against patterns and classifiers, and acting on matches: block, quarantine, encrypt, or simply record.
The difficulty is that classification is a judgment and DLP is a pattern matcher. A sixteen-digit number might be a payment card or an order reference. A document marked confidential may be genuinely sensitive or a template someone copied. False positives train people to work around the system, and every workaround is a channel the system no longer sees, which is why aggressive tuning often produces worse real coverage than a modest policy people tolerate.
Encryption complicates it further. Content that leaves over a channel the inspector cannot read is invisible regardless of policy, which is why DLP is usually deployed alongside proxies that terminate TLS, and why the resulting privacy questions are a legitimate part of the design conversation rather than an obstacle to it.