I know that it is possible to filter web content, say, with Squid+ICAP Server.
But, is it conceptually as well as practically possible to monitor, filter, and programatically transform arbitrary (outgoing + incoming) traffic crossing your organization's routers?
For example, if a programmer in your organization decides to employ a client-server program purposely built to send sensitive data out of the organization (with his server listening on standard http/s port or any other known/arbitrary port somewhere on the Internet), then using what techniques and software can this malicious attempt be monitored and controlled?
I'm interested in getting some pointers on both the concepts/techniques involved, as well as some Linux-based FOSS suggestions that I could explore further. Note that, DLP products such as MyDLP talk only about web content, and not the above scenario, namely, of data theft via a purpose-built program using standard or non-standard data transfer protocol.