Question

A financial services firm discovers that employees are exfiltrating classified customer records by uploading them to personal cloud storage accounts over TLS-encrypted connections. The existing network DLP appliance sees only encrypted traffic and cannot inspect payloads. The security architect must design a control that reliably detects and blocks sensitive data leaving via these HTTPS uploads while preserving user privacy for personal banking and healthcare sites. Which design best meets these requirements?

Accepted Answer

Deploy a forward proxy performing TLS inspection with selective decryption bypass for categorized privacy-sensitive domains, integrated with content-aware DLP policies that classify and block sensitive uploads

Answer

Block all outbound TLS traffic to uncategorized and personal cloud storage domains at the perimeter firewall, allowing only approved corporate SaaS destinations

Answer

Enable full-packet capture at the network egress and retroactively analyze traffic for indicators of data loss during incident response

Answer

Deploy endpoint disk encryption and require multifactor authentication for all cloud storage logins to prevent unauthorized data access