2 cissp ® Official Study Guide Eighth Edition

Endpoint-Based DLP
An endpoint-based DLP can scan files stored on a system as well 
as files sent to external devices, such as printers. For example, an organization’s endpoint-
based DLP can prevent users from copying sensitive data to USB flash drives or sending 
sensitive data to a printer. Administrators would configure the DLP to scan the files with 
the appropriate keywords, and if it detects files with these keywords, it will block the copy 
or print job. It’s also possible to configure an endpoint-based DLP system to regularly scan 
files (such as on a file server) for files containing specific keywords or patterns, or even for 
unauthorized file types, such as MP3 files.
DLP systems typically have the ability to perform deep-level examinations. For example, 
if users embed the files in compressed zip files, a DLP system can still detect the keywords 
and patterns. However, a DLP system doesn’t have the ability to decrypt data.
A network-based DLP system might have stopped some major breaches in the past. For 
example, in the Sony attack of 2014, attackers exfiltrated more than 25 GB of sensitive 
unencrypted data on Sony employees, including social security numbers, medical, and sal-
ary information. If the attackers didn’t encrypt the data prior to retrieving it, a DLP system 
could have detected attempts to transmit it out of the network.
However, it’s worth mentioning that advanced persistent threats (such as Fancy Bear and 
Cozy Bear discussed in Chapter 14) commonly encrypt traffic prior to transmitting it out of 
the network.

---

Logging, Monitoring, and Auditing 
783
The U.S. Department of Homeland Security and the Federal Bureau of 
Investigation released a joint analysis report (JAR-16-20296A) in December 
2016 outlining the actions of Fancy Bear (APT 28) and Cozy Bear (APT 29).