Sophos Data Loss Prevention

Key facts

• Sophos DLP is included in Sophos Endpoint and Sophos Email at no additional licence cost, and is configured in Sophos Central rather than bought separately.
• Policies are built from two rule types: file rules, which act on file type or name, and content rules, which inspect the contents of a file against a Content Control List.
• SophosLabs maintains the Content Control Lists, covering common financial and personally identifiable data such as credit card numbers, postal addresses and identity document numbers.
• Rules can target specific destinations, including removable storage, optical media, browser uploads and instant messaging clients.
• Actions are allow, allow on user acceptance, or block, and a blocking rule always takes priority over a rule that allows on acceptance.
• Known limits: files under 8 bytes are not scanned, and webmail message body content and file downloads are not inspected, so email needs Sophos Email data control rather than endpoint DLP alone.

What does Sophos data loss prevention actually do?

Sophos DLP watches what happens to files on a managed Windows or macOS device and what leaves through email, then applies the rules you have set. When someone copies a spreadsheet full of customer bank details to a USB stick, the endpoint policy fires. When someone attaches the same spreadsheet to an email heading outside the business, the Sophos Email data control policy fires. The two are configured separately and both matter, which is a detail plenty of businesses miss when they turn on the endpoint half and assume email is covered.

The detection is content aware. It is not just looking at the file name, it is reading the contents and matching them against a definition, which is why a file called “notes.txt” containing 40 credit card numbers still triggers.

How are Sophos DLP rules built?

A Sophos DLP policy contains one or more rules, and a file that matches any rule in the policy violates the policy. Each rule has conditions, an action and optional exclusions.

• File rules act on file type or name. Useful for blunt controls, for example blocking database files from being copied to removable storage.
• Content rules act on what is inside the file, matched against one or more Content Control Lists, with a configurable number of matches before the rule fires. Set the match count to two and a single stray number will not trigger it.

You can start from a Sophos template or build a custom policy. In our experience the templates are a decent starting point for the obvious data types and a poor fit for anything specific to the business, so most of our clients end up with a custom Content Control List covering their own client reference format, matter numbers or document markings.

Does Sophos DLP cover email?

Email is handled by data control policies in Sophos Email, not by the endpoint DLP policy. The endpoint policy does catch attachments in some desktop clients, but message content in webmail is explicitly not scanned, so relying on it for email is a gap rather than a control. If email is where your risk sits, and for most SMEs it is, the Sophos Email data control policy is the piece that does the work, and it uses the same Content Control Lists so the definitions stay consistent across both.

How does 4iT roll out Sophos DLP?

We never start with blocking. The first pass is discovery and rule design against the data your business actually holds, then the policies run in a reporting posture so we can see how people work. Four to six weeks of that tells us which rules are safe to enforce and which would break a legitimate process, such as the bookkeeper who genuinely does email remittance files to a client every Thursday.

From there, the high confidence rules move to block, the borderline ones move to allow on user acceptance so the person gets a prompt and a moment to think, and the rest stay as reporting. We then review the alerts as part of your managed service rather than handing you a console and wishing you luck.

One practical note from doing this repeatedly: content scanning reads the whole file, so scan time rises with file size. If a client works with very large exports, we scope the rules rather than pointing them at everything and letting the device crawl.