A company classifies data using document footers, labeling each file with security labels “Public”, “Pattern”, or “Company Proprietary”. A new policy forbids sending “Company Proprietary” files via email. Which control could help security analysis identify breaches of this policy?

The policy aims to prevent the exfiltration of data labeled "Company Proprietary". A Data Loss Prevention (DLP) system is the appropriate control. By configuring a DLP tool to perform deep packet inspection on outbound SMTP traffic, security analysts can scan the content of emails and their attachments for the specific keyword "Company Proprietary". When this string is detected, the system can log the event and alert the security team, allowing them to identify the policy breach. This method directly inspects the data content for the specific classification label defined in the policy.

A. Monitoring failed authentications is an access control measure and does not inspect the content of data being sent.
B. Enforcing TLS encryption protects data confidentiality during transit but does not prevent the data from being sent or identify policy violations.
C. Blocking based on file hashes is easily bypassed; it only works if the file is an exact, unmodified copy of a template.

1. National Institute of Standards and Technology (NIST) Special Publication 800-45 Version 2, Guidelines on Electronic Mail Security. Section 3.3.3, "Content Filtering," discusses how mail gateways can scan email messages and attachments for sensitive content based on keywords, patterns, or other attributes to enforce organizational policies.

2. Alneyadi, S., Al-Marridi, A., & Al-Dhaheri, A. (2016). Data Loss Prevention: A Comprehensive Survey. IEEE Communications Surveys & Tutorials, 18(3), 2271-2289. Section III-A, "Content Analysis Techniques," describes keyword matching as a fundamental method used by DLP systems to identify sensitive information within data streams by searching for specific words or regular expressions. (https://doi.org/10.1109/COMST.2016.2583009)

3. Carnegie Mellon University, Heinz College of Information Systems and Public Policy. Course 14-817: Information Security and Privacy, Lecture 10: Network Security. The courseware discusses network-based Data Loss Prevention (DLP) systems that monitor network traffic (e.g., SMTP, HTTP) to detect and prevent unauthorized data disclosures by inspecting content for sensitive keywords and patterns.