- [DevOps stage](https://about.gitlab.com/direction/#devops-stages) label: ~"devops:defend" - [Product category](https://about.gitlab.com/handbook/product/categories/#defend) label: ~"data loss prevention" - [Epics](https://gitlab.com/groups/gitlab-org/-/epics/?state=opened&label_name[]=runtime%20application%20security) | [Issues](https://gitlab.com/groups/gitlab-org/-/issues?state=opened&label_name[]=runtime%20application%20security&sort=milestone) ## Description TODO ### Goal TODO ### Roadmap TODO ## What's Next & Why TODO ## Competitive Landscape TODO ## Analyst Landscape TODO ## Top Customer Success/Sales Issue(s) - There is no feature available for this category. - BLOCKER: FIPS 140-2 label: ~"federal::140-2" - BLOCKER: (DHS CDM ~"federal::CDM") Approved Products List application (depends on ~"federal::140-2") ## Top Customer Issue(s) source: Continuous Diagnostic and Mitigation CDM Technical Requirements (https://www.gsa.gov/cdnstatic/CDM_Tech_Cap_Vol_Two_Req_Catalog_v12_2018-05-17.pdf) about CDM: (https://www.gsa.gov/technology/technology-products-services/it-security/continuous-diagnostics-mitigation-cdm-program) # II - 5.4.2 DATA_DLP Functional Requirements (DHS CDM Phase 4) The DATA_DLP capability is related to DATA_PROT when cryptographic data protection methods are employed and to DATA_PROT when data masking/obfuscation methods are employed as part of DLP protections. This capability is related to DATA_PROT through the use of fine-grained access control for data protection. This capability is related to DATA_IRM when information rights management policies trigger DLP prevention measures for data in transit. This capability is related to PRIV, to support logical access control decisions for access to sensitive data. This capability is related to BOUND-E through the use of encryption for data protection. This capability may integrate with BOUND-F to enforce data protection for data in transit. This capability is related to MNGEVT as a log generation capability. This capability is related to OMI when security orchestration is used to respond to the data protection events/incidents. ## DATA_DLP_FR-1-1: Shall provide audit trail information related to execution of DLP methods and the movement of data. The information will support the continuous monitoring and update of access DLP policies and administration activities to ensure enforcement of data protection policies. ## DATA_DLP_FR-1-2: Shall perform DLP using one or more of the following DLP methods: - a. Encryption - b. Quarantine - c. Block - d. Notification - e. Allow with user justification ## DATA_DLP_FR-1-3: Shall perform one or more DLP methods to reduce risk and potential impacts to data and operational processes. DLP methods may be implemented in one or more of the following: - a. Endpoint DLP monitoring, alerting on, and preventing used or manipulation of sensitive data by end-user activity (e.g., copy, paste, save, open, print operations, and screen captures) to detect or prevent data exfiltration. - b. Network DLP monitoring, alerting on, and preventing the movement of data over the network using various network protocols (e.g., email, web, file transfer, instant messaging) to detect or prevent data exfiltration. - c. User and/or system DLP monitoring to alert and prevent unauthorized use, storage, and transmission of privacy data by a user and/or system that has other legitimate access to the privacy data. ## DATA_DLP_FR-1-4: Should integrate DLP with other data use and protection capabilities to protect data and detect potential compromise. Other data protection capabilities may include one or more of the following: - a. Identity/attribute stores to provide federated identification, authentication, and attribute assertions - b. IRM solutions to protect information leaving an Agency, which may include the use of encryption or masking/obfuscation - c. Data repositories - d. Office automation applications - e. Cloud applications - f. Log/event analysis systems (e.g., SIEM, User and Entity Behavior Analytics [UEBA]) - g. Enterprise Data Discovery solutions ## DATA_DLP_FR-2-1: Shall perform orchestration of data protection functions across platforms and capabilities, such as encryption/decryption, data masking, exfiltration prevention, auditing and reporting, and access control. ## II - 5.4.3 DATA_DLP Tool Functionalities The following is a non-exclusive list of tool functionalities that support the above Data Loss Prevention functional requirements: - DLP regulatory rules/policy interpretation and translation - DLP endpoint functionalities - DLP network inspection functions - DLP alerts and notifications - DLP incident report generation - DLP blocking/quarantining function - Security orchestration control and management of data protection capabilities ## Top Vision Item(s) TODO