How do you make sure that your private code repository/data files aren't leaked by your employees?
On their work device, they would need to simultaneously have sensitive code/data, along with internet access to be productive (ability to send emails/arbitrary POST requests). None of the solutions that occur to me are convincing:
- Disable data access ports (USBs, Optical Drives etc.). This gets complicated with USB-c charging ports, can't really disable them
- Network Monitoring Could be done with a VPN with request logs retained. Still wouldn't help with for eg. gmail, where everything is https encrypted
- Screen recording Overkill? How would one even analyze this
- WebSite blacklists/whitelists Seems quite difficult to get right
Since a number of firms would be strongly interested in protecting sensitive materials (Google etc.), I'm wondering if there are standard controls out there that I'm just not aware of.
Any pointers appreciated!