Managing access to documents with a file monitor

Abstract

Disclosed herein is a system and method that can retrieve, via a file monitor, a file and policy data from a case management system or a content management system, wherein the file and the policy data are retrieved in response to detecting a user request for the file. A processor can also modify, via the file monitor, access to the file based on the policy data, and intercept a plurality of document management instructions executed with the file. The processor can also detect at least one of the document management instructions is a malicious action, wherein the malicious action is detected based on the policy data, wherein the policy data is updated in response to detecting each of the document management instructions. Additionally, the processor can execute a policy instruction to prevent execution of the at least one document management instruction.

1 . A method for managing access to documents comprising:
 retrieving, via a file monitor, a file and policy data from a case management system or a content management system, wherein the file and the policy data are retrieved in response to detecting a user request for the file, wherein the policy data indicates a list of file types that are authorized to be generated from the file based on the policy data, indicates an application that is authorized to access the file, and indicates a predetermined encryption key to be used to access the file in an encrypted format when the file is encrypted;   modifying, via the file monitor, access to the file based on the policy data;   intercepting, via the file monitor, a plurality of document management instructions executed with the file, wherein the plurality of document management instructions are instructions performed based on retrieving the file;   detecting, via the file monitor, at least one of the document management instructions is a malicious action, wherein the malicious action is detected based on the policy data, wherein the policy data is updated in response to detecting each of the document management instructions; and   executing, via the file monitor, a policy instruction to prevent execution of the at least one document management instruction, wherein the policy instruction comprises masking sensitive data, preventing the operating system from changing a file type of the file to a second file type, prevent retrieved files from being copied, and prevent printing retrieved files, wherein masking comprises replacing a portion of the file with pseudorandom alphanumeric characters;   detecting sensitive data in the file;   detecting a second retrieved file from the case management system with a similarity to the file above a threshold value; and   modifying a policy for the second file to indicate that the second file comprises sensitive data.