M0803 Data Loss Prevention

Data Loss Prevention (DLP) technologies can be used to help identify adversarial attempts to exfiltrate operational information, such as engineering plans, trade secrets, recipes, intellectual property, or process telemetry. DLP functionality may be built into other security products such as firewalls or standalone suites running on the network and host-based agents. DLP may be configured to prevent the transfer of information through corporate resources such as email, web, and physical media such as USB for host-based solutions.

Item	Value
ID	M0803
Version	1.0
Created	11 September 2020
Last Modified	30 March 2023
Navigation Layer	View In ATT&CK® Navigator

Techniques Addressed by Mitigation

Domain	ID	Name	Use
ics	T0893	Data from Local System	Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.
ics	T0882	Theft of Operational Information	Apply DLP to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).