DLP Controls
Block leaks at endpoints and network.
DLP Controls is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Enforcing DLP
Once data is classified, DLP controls enforce policy by blocking or restricting leaks at the points where data leaves. Controls live at endpoints, on the network, and in the cloud.
Endpoint DLP
An endpoint DLP agent runs on laptops and workstations to control local data movement:
- Block or audit USB and removable media.
- Restrict clipboard and screen capture.
- Control printing of sensitive files.
Controlling Removable Media
USB drives are a classic exfiltration path. Endpoint DLP can allowlist approved devices, force encryption on writes, or block transfers of classified data entirely.
# conceptual endpoint policy rule
if file.label == 'Restricted' and destination == 'USB':
action = 'BLOCK'
alert('Restricted data USB attempt')Network DLP
Network DLP inspects traffic leaving the perimeter, primarily email and web uploads. It scans content against policies and blocks or quarantines violations before they reach the internet.
Email DLP
Email is the most common leak channel. Email DLP can:
- Block messages containing card numbers to external recipients.
- Force encryption on sensitive mail.
- Warn the sender or require a manager approval.
Web and Upload Controls
DLP integrated with a web proxy or CASB inspects uploads to personal cloud storage, webmail, and unsanctioned SaaS, blocking sensitive data from being posted to unapproved destinations.
Cloud DLP and CASB
A Cloud Access Security Broker (CASB) extends DLP to SaaS apps like Office 365, Google Workspace, and Salesforce. It scans data stored in and shared from the cloud and enforces consistent policy there.
TLS Inspection
Most traffic is encrypted, so network DLP often relies on TLS inspection (decrypt, inspect, re-encrypt) to see content. This raises privacy and certificate-management considerations that must be planned and disclosed.
Response Actions
When a control triggers, the policy chooses an action:
- Block the transfer.
- Quarantine for review.
- Encrypt automatically.
- Notify user and security team.
User Coaching
Effective DLP educates as it enforces. A real-time pop-up explaining why an action was blocked, and offering an approved alternative, reduces repeat mistakes and turns users into partners rather than adversaries.
Layering Controls
No single control covers every channel. Combine endpoint, network, and cloud DLP so a leak blocked on one path is not simply rerouted through another. Consistent policies across layers prevent gaps.
Quick Check
Pick the right control for the channel.
Recap
DLP controls block leaks at every exit point:
- Endpoint DLP guards USB, clipboard, and printing.
- Network DLP inspects email and web traffic (often via TLS inspection).
- CASB extends DLP to cloud SaaS.
- Choose actions, coach users, and layer controls to close gaps.
Frequently asked questions
Is the “DLP Controls” lesson free?
Yes — the full text of “DLP Controls” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “DLP Controls”?
Block leaks at endpoints and network. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “DLP Controls” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- What Is DLP
- Classifying Data
- DLP Controls
- Insider Threats