OpenDLP
Enterprise Data Loss Prevention for macOS
Military-grade data protection powered by the Chaos Defense Engine — 35 adaptive strategies, real-time exfiltration detection, hardware-bound encryption, and automatic ~/Documents vault protection. Built and battle-tested against 15+ real attack vectors.
Key Features
Security Core
- AES-256-GCM Encryption - Military-grade vault encryption
- Secure Enclave Integration - Hardware-backed device fingerprinting
- HMAC-SHA256 Signing - Tamper-proof metadata
- Keychain Integration - Secure key storage
Real-Time Protection
- Live Threat Detection - 5-level threat classification system
- Boundary Detection - Monitors local, network, cloud, and removable storage
- Auto-Encryption - Automatic encryption on boundary crossing
- File System Monitoring - Real-time file operation tracking
Advanced Security
- Tamper Detection - System integrity verification with SHA-256 hashing
- Automated Response - Configurable threat response actions
- Access Control Lists - 4-level device authorization (Owner, Full, ReadOnly, Temporary)
- Forensic Logging - Complete audit trail with event export
Monitoring Dashboard
- Real-Time Status - Live system health and threat level
- Security Events Feed - Chronological event tracking
- Statistics & Analytics - Comprehensive security metrics
- Event Management - Acknowledge, filter, and export events
Use Cases
1Secure USB Vaults
Create encrypted vaults on USB drives with military-grade protection:
- AES-256-GCM encryption
- Device-based access control
- Automatic tamper detection
- Multi-device synchronization
2Data Exfiltration Prevention
Automatically detect and encrypt files when:
- Moving to cloud sync folders (Dropbox, iCloud, etc.)
- Copying to network shares
- Transferring to removable drives
- Crossing network boundaries
3Real-Time Security Monitoring
Monitor your system for:
- Unauthorized access attempts
- Suspicious file operations
- System tampering
- Encryption failures
- ACL violations
4Forensic Analysis
Complete audit trail with:
- Timestamped security events
- Threat level classification
- Source identification
- Detailed event metadata
- JSON export for analysis
Red Team Case Studies
Cross-Machine SCP Exfiltration
Real SCP file pull between two physical Macs on a LAN. File containing SSNs, API keys, and credit cards was exfiltrated via SSH — detected by device UUID mismatch, encrypted with entropy-derived AES-256, plaintext destroyed.
COMPLETED 17/17 Tests Passed
USB Drive Exfiltration
Copy protected files to a USB flash drive. OpenDLP detects the removable media boundary crossing, encrypts the file before it reaches the drive, and logs the event with full forensic metadata.
COMING SOON
Cloud Sync Exfiltration (iCloud / Dropbox)
Move protected files into iCloud Drive or Dropbox sync folders. OpenDLP detects the cloud boundary crossing and encrypts files before they sync to remote servers, rendering cloud copies useless.
COMING SOON
AirDrop & Bluetooth Exfiltration
Transfer protected files via AirDrop or Bluetooth — peer-to-peer channels invisible to traditional network DLP. OpenDLP detects the transfer at the file level and encrypts before delivery completes.
COMING SOONThreat Detection
None
System secure, no threats
Low
Minor events, monitoring only
Medium
Potential threats, investigate
High
Active threats, immediate action
Critical
System compromise, lockdown
Security Event Types
Endpoint Security Framework
Why OpenDLP Needs Apple’s ESF Entitlement
OpenDLP is requesting com.apple.developer.endpoint-security.client to move from user-space file monitoring (FSEvents) to kernel-level interception via Apple’s Endpoint Security Framework. This enables pre-read encryption — stopping exfiltration before data leaves the device.
Validated Against 15+ Real Attack Vectors
OpenDLP has been tested in live red team exercises between two physical macOS devices. The Endpoint Security Framework will close the remaining detection gaps that user-space APIs cannot address:
Current Architecture: Two-Track Approach
OpenDLP ships today with full functionality using FSEvents (Track 1). When the ESF entitlement is granted, the monitoring layer swaps to kernel-level interception (Track 2) with zero changes to the rest of the codebase:
Track 1 (Current): FSEvents → User-space file monitoring
Works today. Detects + encrypts after file access.
Track 2 (With ESF): Endpoint Security Framework → Kernel-level
Intercepts file reads BEFORE data is accessed.
Adds process attribution + code signing verification.
Swap point: FileSystemMonitor.swift
One protocol conformance change. All other
components (encryption, detection, logging,
dashboard) remain identical.Bundle ID: com.aimf.opendlp
Production Ready
OpenDLP is a production-ready, enterprise-grade Data Loss Prevention system for macOS with Chaos Defense Engine V2, hardware-bound encryption, and 35 adaptive defense strategies. 7-day free trial — no credit card required.
System Capabilities
- Device fingerprinting
- Vault encryption (AES-256-GCM)
- Access control (4 trust levels)
- Boundary detection (5 types)
- Auto-encryption (3 policies)
- Real-time monitoring
- Threat detection (5 levels)
- Tamper detection
- Automated response
- Forensic logging
- Security dashboard
- Zero-trust architecture
- Cross-machine exfil defense
- Entropy-based key generation
- xattr device identity binding
- Sanctioned process allowlists
