Ravi Sir's Cyber Security Cards › Revision Cards
Spotting data leaving the building
Revision card: Spotting data leaving the building. Easy English, with a real example. Scan the QR for the full lesson.
Read card text
What this card says
What is DLP?
DLP = Data Loss Prevention: tools and rules that find sensitive data and stop it leaving without permission. Exfiltration is the attacker moving data out.
Find it first
You cannot guard what you have not found. Label sensitive data (card numbers, Aadhaar, health records), then set rules for those patterns.
Watch the exits
Baseline normal outbound traffic and alert on big jumps. Watch DNS for floods to one odd domain, and log USB and personal-cloud use.
| Sign of theft | What to check |
|---|---|
| Big upload out | Who, when, where |
| DNS flood to one domain | Possible DNS tunnelling |
| USB copy | Endpoint DLP log |
| Mail to personal id | Email DLP rule |
Learn more in the lesson: 39.10 Detecting Data Theft (DLP)