Implement Data Loss Prevention (DLP) Measures

Data Loss Prevention (DLP) ensures that sensitive data remains protected from unauthorized access, accidental leaks, and intentional breaches. DLP is essential for:

✅ Preventing unauthorized file modifications and access.
✅ Protecting confidential information from data exfiltration.
✅ Ensuring compliance with security standards (GDPR, HIPAA, PCI-DSS).

By implementing DLP measures, you reduce the risk of data breaches and ensure data integrity.

How to Implement Data Loss Prevention in Linux

1. Track Sensitive Data Changes with File Integrity Monitoring (FIM)

Use AIDE (Advanced Intrusion Detection Environment) to monitor file modifications in critical directories.

Install and Configure AIDE

1. Install AIDE (Debian/Ubuntu):

   sudo apt install aide -y
   

   For CentOS/RHEL:

   sudo yum install aide -y
   

2. Initialize the AIDE database:

   sudo aideinit
   sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz
   

3. Configure AIDE to monitor sensitive directories:

   sudo nano /etc/aide/aide.conf
   

   Add directories to monitor:

   /etc/       p
   /home/user/Documents/  p
   /var/log/   p
   

   (Monitors /etc/, /home/user/Documents/, and /var/log/ for unauthorized changes.)

4. Schedule regular integrity checks:

   sudo crontab -e
   

   Add a scheduled task (runs daily at 3 AM):

   0 3 * * * /usr/bin/aide --check | mail -s "AIDE Integrity Report" admin@example.com
   

2. Encrypt Sensitive Data with GPG or OpenSSL

Encryption ensures that even if data is accessed, it remains unreadable without the correct decryption key.

Encrypt Files Using GPG (GnuPG)

1. Encrypt a file with a passphrase:

   gpg --symmetric --cipher-algo AES256 confidential.txt
   

2. Decrypt the file when needed:

   gpg --output confidential.txt --decrypt confidential.txt.gpg
   

Encrypt Data with OpenSSL

1. Encrypt a file with AES-256:

   openssl enc -aes-256-cbc -salt -in confidential.txt -out confidential.enc
   

2. Decrypt the file:

   openssl enc -aes-256-cbc -d -in confidential.enc -out confidential.txt
   

3. Set Strict File Permissions for Sensitive Data

Restrict access to sensitive files to authorized users only.

Restrict File Access Using chmod

1. Set strict permissions (owner-only access):

   sudo chmod 600 /home/user/confidential.txt
   

2. Restrict entire directories:

   sudo chmod -R 700 /home/user/private/
   

   (Only the owner can access this directory.)

Use Access Control Lists (ACLs) for Fine-Grained Access

1. Grant read-only access to a specific user:

   sudo setfacl -m u:username:r /home/user/confidential.txt
   

2. Verify ACL settings:

   getfacl /home/user/confidential.txt
   

4. Prevent Unauthorized Data Transfers

Block USB Storage Devices (Prevent Data Exfiltration)

1. Disable USB mass storage module:

   echo "blacklist usb-storage" | sudo tee -a /etc/modprobe.d/blacklist.conf
   

2. Reload system modules:

   sudo modprobe -r usb-storage
   

Restrict Data Transfers with iptables

1. Block unauthorized outbound traffic:

   sudo iptables -A OUTPUT -p tcp --dport 21 -j DROP   # Blocks FTP
   sudo iptables -A OUTPUT -p tcp --dport 22 -j DROP   # Blocks SSH File Transfers
   sudo iptables -A OUTPUT -p tcp --dport 80 -j DROP   # Blocks HTTP Uploads
   

2. Allow only trusted IPs to transfer data:

   sudo iptables -A OUTPUT -p tcp -d trusted_ip --dport 22 -j ACCEPT
   

5. Monitor and Log Access to Sensitive Files

Enable Auditd to Log File Access

1. Install auditd (Debian/Ubuntu):

   sudo apt install auditd -y
   

   (Already installed by default on CentOS/RHEL.)

2. Monitor a specific file for access attempts:

   sudo auditctl -w /home/user/confidential.txt -p war -k sensitive_file_access
   

3. Check audit logs for file access:

   sudo ausearch -k sensitive_file_access --start today
   

Best Practices for Data Loss Prevention (DLP)

✅ Regularly back up encrypted copies of sensitive data (rsync -avz /secure_data /backup).
✅ Monitor logs (/var/log/auth.log) for unauthorized access attempts.
✅ Use Intrusion Detection Systems (IDS) like OSSEC or Wazuh to alert on unauthorized file changes.
✅ Restrict sensitive data access to specific users and groups.

By implementing Data Loss Prevention (DLP) measures, you secure critical information, prevent unauthorized access, and ensure compliance with data protection regulations, keeping your Linux server safe from data breaches.