METHOD AND TECHNIQUE FOR APPLICATION AND DEVICE CONTROL IN A VIRTUALIZED ENVIRONMENT

摘要

A data loss prevention (DLP) manager running on a security virtual machine manages DLP policies for a plurality of guest virtual machines. The DLP manager identifies a source associated with a file open or create event. The source is at least one of an application or a device being used by a guest virtual machine (GVM). The DLP manager enforces a first response rule associated with the GVM when the source is a non-approved source per a source control policy. The DLP manager enforces a second response rule when the file violates a DLP policy.

主权项

1. A method comprising:
monitoring, by a dedicated security virtual machine (SVM) executing by a computing system, a file open event to access a file by a guest virtual machine (GVM) executing by the computing system; identifying a source associated with the file open event, wherein the source is at least one of an application or a device being used by the GVM; enforcing a first response rule associated with the GVM when the source associated with the file open event is a non-approved source per a source control policy; and enforcing a second response rule associated with the GVM when the file violates a data loss prevention (DLP) policy.