DLP
Data Loss Prevention — technology and policies that detect and prevent sensitive data from leaving the organization, deliberately or by accident. It monitors data "in motion" (email, uploads), "at rest" (storage), and "in use" (endpoint) and blocks unauthorized transfers.
Mechanic: DLP identifies sensitive data via patterns (national ID numbers, credit card numbers, a "confidential" marking, fingerprints of specific documents) and applies rules — e.g. "block email with credit card numbers to external recipients", "don't allow uploading source code to private cloud", "warn when someone copies a customer database to USB". Use case: prevent both malicious exfiltration and accidental mistakes (wrong recipient, wrong attachment), and meet compliance (GDPR, PCI-DSS). Deployment points: the email gateway, an endpoint agent, a cloud proxy (often via a CASB), the network. Challenge: false positives and balancing security against not hindering legitimate work; encryption can hide content from DLP. A core control against data leakage. Related to data exfiltration and CASB.