Data Loss Prevention

We've had two known instances this week where using IE8 to get to specific sites failed. One site complained about unknown added data and the other one refused to display.

We are currently using Vontu 11 for USB monitoring and blocking. We have Vontu set not to monitor http\https traffic, however if we unisntall the vontu agent on the end device, each time the sites started functioning again.

The problem is that it seems not easily reproducible and random. We often try other troubleshooting measures and then an uninstall of Vontu fixes the problem, which does not re-occur on demand after a re-install.

Anyone else seeing issues like this?

Does HTTP traffic still pass-through the endpoint agent\filter drivers with HTTP monitoring turned "off" or does it actually just pass through the agent\filter drivers set to an 'allow all' type mode?

Are you facing this issue on all your systems? This may be a system specific issue.

Denis,

We have this deployed to a very limited number of devices, mine and just a handfull of others for testing prior to enterprise wide deployment.

Unfortunatley with the small number of test devices. The problem does not occur globally on all test devices at the same time and in reality, Vontu ends up being the last thing we try to uninstall to see if it fixes a specific problem. 

Any suggestion on client side logs or debugging we can enable?

Thanks in advance.

Is any other policy set- like web DLP at proxy level etc?

Endpoint agents (used for USB monitoring) will not disrupt your http/https traffic in such case.

Also check for incidents at DLP console. More information may help further.

Agree with AR Sharma and adding couple of additional questions:

1) How are you turning off HTTP monitoring in DLP UI?

2) Does HTTP blocking occur for all browsers or just for IE8? Have you tried other browser? Web-mail over HTTP?