System and method for reducing data loss prevention scans

摘要

A computing device receives a file. The computing device determines whether the file has previously been scanned for violations of a data loss prevention policy. If the file was previously scanned, a result of the previous scan is used to decide whether or not the file violates the data loss prevention policy. If the file was not previously scanned, the file is scanned to decide whether or not the file violates the data loss prevention policy.

主权项

1. A method comprising:
receiving a file, the file having metadata comprising data indicating that the file has previously been scanned for confidential information, whether content of the file contains confidential information, and a version of a data loss prevention (DLP) policy associated with a previous scan of the file; determining, by a processing device, from the metadata for the file, that the content of the file contains confidential information; determining, from the metadata for the file, whether the data loss prevention policy has been modified since the file was previously scanned; and if the metadata of the file indicates that the DLP policy has not been modified since the file was previously scanned, determining whether or not the file violates the data loss prevention policy using the data in the metadata indicating whether the content of the file contains confidential information; and if the metadata of the file indicates that the DLP policy has been modified since the file was previously scanned, scanning the file to determine whether or not the file violates the modified data loss prevention policy.