CIS-3.13 Deploy a Data Loss Prevention Solution

• T1041 Exfiltration Over C2 Channel — DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions explicitly monitor and restrict unauthorized outbound transfer of sensitive data. • T1048 Exfiltration Over Alternative Protocol — DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP inspection capabilities may identify sensitive-data transfer across non-standard protocols. • T1052.001 Exfiltration over USB — DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Device-control and removable-media DLP policies directly target USB-based exfiltration. • T1537 Transfer Data to Cloud Account — DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. DLP solutions commonly inspect and restrict uploads to external cloud services. • T1567 Exfiltration Over Web Service — DLP is a direct control for blocking or alerting on exfiltration and data staging behaviors. Web upload monitoring and restriction are core DLP use cases.