Top search result is from Gartner: alarm bells ringing. Data loss prevention seems to be enterprise speak for doing as much intrusive monitoring you can do, in as neutral speak as possible.

1984 is so appealing for so many people, it seems like it is just a book about the tendencies that power can take when it is not guided by sane principles. I have always been employed in a high trust capacity since I was a young adult, there is not a technically feasible system in the world that could prevent me from wrecking havoc in a company. Social ones though, they are extremely effective.

Every so often a client asks if we are using a DLP, and if not, why not.

All the DLPs rely on, effectively, regular expression searches of traffic.

This is fine if what you need to protect are SSNs, phone numbers, credit card numbers... but if your data is not easily recognized that way, they don't work.

If you ask the DLP vendors about their threat model -- and the salespeople generally don't know what a threat model is -- it's always a set of stories about a salesperson who clicks the download-as-CSV button on a CRM system, a DB reporting specialist who generates a report full of raw passwords and credit card numbers, and an off-shore programmer who sends AWS credentials via email.

Hopefully you can spot the non-DLP prevention mechanisms for all of these...

> Hopefully you can spot the non-DLP prevention mechanisms for all of these...

What is it?

What does any of this have to do with theft? In most lawful places, if you dump source code and documents to take with you it’s not going to end well.

https://www.cnbc.com/amp/2020/08/04/anthony-levandowski-gets...

> I’ve even seen off shore people work from VMs only where they can’t download or store any file locally, much less dump everything to a USB stick.

Sure, they can't do any of that, and development becomes miserable. You don't have to go full VM and remote desktop to prevent those things.

If you really want protection you don't want a DLP, you want a (limited) air-gap.

Basically the machine is not allowed to access the internet and USB drives do not work. Only specific locked down applications like the email app, web browser, and so forth have internet access. Downloads are allowed but uploads are not.

A permissions interface is available for say legitimate transfers of data to a flash drive or a web upload, in that case the user will have to add a valid reason and the specific files into the form. Once that's checked and approved by a higher-up the files are temporarily placed in a special folder that permits transfer out. The same thing goes for external emails that aren't on a whitelist, they'll need approval before they get sent.

If you're running a VM you're storing the whole state of the VM on the host machine, there's nothing technically stopping you from copying all the data, and worse, there's no way to even know that it happened.

What VMs are helpful for is cross-contamination and spyware attacks from other clients a contractor is working for.